Cybersecurity in e-commerce: what you should know

Cybercriminals are constantly evolving, looking for new ways to access and steal sensitive information, from banking data to login credentials. That's why, we want to give you the keys and best practices to protect both your digital activity and the ecommerce environment you manage.

Cybersecurity applied to the user: start by defending yourself

Two-factor authentication (2FA): your digital shield

Two-step verification is like having a double lock on your front door. It's not enough that someone knows your password; they need a second proof of identity to access your account. This system combines something that you know (your password) with something that you have (your cell phone or an authentication application).

There are three main methods for implementing 2FA, each with its own advantages:

• SMSYou receive a temporary code on your cell phone. This is the most common method but not the most secure, as SMS can be more easily intercepted.
• E-mail addressSimilar to SMS, but the code is sent to your email. Useful when you don't have access to your cell phone.
• AuthenticatorThe most secure option. Applications such as Google Authenticator or Microsoft Authenticator generate codes that change every 30 seconds, without the need for an Internet connection.

Practical adviceActivate 2FA on all your accounts, especially on your main email, online banking and online store administration panel. Always prioritize the use of applications such as Authenticator over SMS or email.

What is OAuth?

OAuth is a protocol that allows you to access services without having to register on a new site.

You've probably seen buttons like «Sign in with Google» or «Continue with Facebook». This is very convenient and can be secure, but it requires precautions.

• Your benefitsYou don't need to remember another password and you reduce the risk of creating weak passwords. 
• What are the precautions: If someone accesses your main account (e.g. Google), they would have access to all linked services. That's why it's crucial to protect that main account with 2FA and a strong password.

Password managers: your safe

Memorizing dozens of complex passwords is impossible, and using the same one everywhere is a huge mistake. From here we always recommend the use of three different passwords.

Password managers are the solution:

• Google Password Managerintegrated into Chrome, offers a basic level of security and is very convenient if you use the Google ecosystem.
• BitwardenA more robust option, with military-grade encryption and available on all devices. You can access it from bitwarden.com.
  

RecommendationUse unique passwords of at least 16 characters for each service. With a password manager, you only need to remember one strong master password.

Updates: keep all your applications up to date

Every operating system or program update includes critical security patches. Hackers know about vulnerabilities in older versions and actively exploit them.

Useful tool, UpdateHubWindows Update: This open source application automates application updates in Windows, saving you time and keeping your system secure.

Backups: your time machine in the event of incidents

Imagine losing all your online store data, your customers' documents or even your own. Regular backups are your insurance against disasters:

• On PremisesExternal hard disks or NAS for physical copies.
• In the cloudGoogle Drive, Dropbox or specialized services for automatic copies.
  

Good practiceFollow the 3-2-1 rule: 3 copies of your important data, in 2 different types of storage, with 1 copy outside of your primary location.

Cybersecurity applied to ecommerce: protect your business and your customers

Phishing: the art of deception

In phishing, cybercriminals impersonate legitimate companies to steal your confidential information. In ecommerce, this can destroy the trust of your customers overnight.

Real cases you should know about:

Fake SMS from parcel delivery companies are a daily occurrence. «Your package is being held, pay €1.99 to release it». The message looks legitimate, but the URL is the key to detecting fraud.

How to identify themAlways pay attention to the URL. Scammers use very similar domains but with small differences:

• Legitimate: www.geotelecom.es
• Fraudulent: www.geotetecom.es (note the duplicate ‘te’)
  

Vulnerabilities in plugins: the Achilles' heel of CMSs

Plugins extend the functionality of your store, but each one is a potential gateway for hackers.

A recent case affected Elementor, one of the most popular visual web builders for WordPress, where a vulnerability in the image import function allowed data to be collected from the server and thus enabled cybercriminals to steal sensitive information.

To avoid these vulnerabilities we always have to keep our plugins up to date just as we do with our operating system.

Advanced access security measures

For online store managers, there are additional techniques that can make a difference:

• Custom URLs for accessInstead of the typical “...": Instead of the typical "...": Instead of the typical "...".“/wp-admin” or “/admin” from other CMSs, you can customize your access URL. For example: “tucomercio.com/a15dw4fa67/”. This simple measure prevents the 90% from automated access attempts.
• Limitation by IP: Through archives “.htaccess”, You can restrict access to the administration panel only from specific IP addresses. It's like having a VIP guest list for your backoffice. Here is a practical example:
  

apache
<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from TU_IP_AQUI
</Files>

Important noteIf you work from home, be aware that your IP may change when you reboot the router. In this case, you will need to update the configuration.

Code injections: the invisible enemy

Code injections are seemingly unnoticeable but malicious markups on your store. Attackers insert code into your website to redirect traffic, steal data or damage your SEO. We have seen cases where links to online casinos appeared in the search results of respectable stores.

Devastating consequences for SEO:

• Google can penalize your site or mark it as dangerous
• Meta titles and descriptions can be altered
• Your brand's reputation can be severely damaged

Reviewing this is a fundamental part of our SEO service. We take care of eliminating these injections and implementing measures to prevent this from happening on your website.

Prevention strategy:

1. Data validationNever trust the data entered by users. Validate and clean all input
2. Active monitoringGoogle Search Console alerts: monitor alerts in Google Search Console for suspicious changes
3. Constant updatesKeep your CMS, themes and all plugins up to date.
4. Periodic reviewsregularly search your site in Google to detect anomalous results or external redirects.

Why do you have to constantly check your security?

Cybersecurity must be something constant. New threats appear every day, but so do new tools and techniques to protect ourselves. The key is to stay informed, be proactive and never let your guard down.

Remember these fundamental principles:

• Enable two-step verification on all your important accounts
• Use unique and complex passwords with a password manager
• Keep all your software up to date
• Performs regular backups
• Educate your team and customers on the risks of phishing
• Regularly audit the plugins and code of your online store.

Cybersecurity not only protects your data, it also preserves the reputation and performance of your ecommerce. At Geotelecom we work on every digital marketing project with the same premise: performance, visibility and taking into account the technical security of your business. Therefore, we can help you boost your digital business and work hand in hand to make your project reach the top. 

Need advice? Contact us now and we will study your case. Call us!