Securing WooCommerce Customer Accounts

Summary

Protect your WooCommerce customers with two-factor authentication, strong password policies, session management, and suspicious activity monitoring. Essential for ecommerce sites handling payment information and order data.

Step 1: Enable 2FA for Customer Accounts

1. Go to Users → Attributes User Access → Security
2. Navigate to Two-Factor Authentication section
3. Enable 2FA for Customer role:
   • ☑️ Enable for “Customer” role
   • Choose: Required, Optional, or Recommended
   • Select 2FA method: Email or Authenticator App
4. Configure grace period (e.g., 7 days to set up)
5. Save settings

Recommended 2FA Settings for Ecommerce

Step 2: Configure Password Policies

Enforce strong passwords for customer accounts:

Password Requirements

• ✅ Minimum 8 characters (recommend 12+)
• ✅ Require uppercase and lowercase letters
• ✅ Require at least one number
• ✅ Require special character
• ✅ Block common passwords (password123, welcome, etc.)
• ✅ Prevent reuse of last 5 passwords

Password Expiration

// For high-security ecommerce sites
Password Expiration: 90 days
Warning Before Expiration: 14 days
Grace Period After Expiration: 7 days

// For standard ecommerce
Password Expiration: Disabled (optional only)
Encourage periodic password changes via email

Step 3: Enable Session Management

Control how customer sessions are handled:

Session Security Settings

• Session Timeout – Auto-logout after inactivity
  • During checkout: 60 minutes
  • General browsing: 7 days with “Remember Me”
• Concurrent Sessions – Limit devices per account
  • Allow 3 concurrent sessions maximum
  • Show active sessions in My Account
  • Allow customers to terminate sessions
• Force Re-authentication – Require login for sensitive actions
  • Changing email address
  • Updating payment methods
  • Viewing order history with payment details

Step 4: IP Blocking & Whitelisting

Protect against unauthorized access attempts:

Configure IP-Based Security

1. Enable Suspicious Activity Monitoring
2. Configure auto-block rules:
   • Block IP after 5 failed login attempts
   • Block duration: 30 minutes (escalating)
   • Notify admin of blocked IPs
3. Whitelist trusted IPs (optional):
   • Company offices
   • Known customer VPNs
   • Partner organizations

Step 5: Add Security to My Account Page

Give customers control over their account security:

Add Security Dashboard

Create custom endpoint in WooCommerce My Account:

// Add Security tab to My Account
add_filter('woocommerce_account_menu_items', function($items) {
    $items['security'] = 'Security Settings';
    return $items;
}, 10, 1);

// Display security options
add_action('woocommerce_account_security_endpoint', function() {
    echo do_shortcode('[attrua_security_settings]');
});

Security Features for Customers

• 🔐 Enable/configure 2FA
• 🔑 Change password with strength meter
• 📱 View active sessions and devices
• 🔒 Terminate other sessions
• 📧 Update recovery email
• 📜 View login history
• 🚨 Report suspicious activity

Step 6: Monitor Suspicious Activity

Set up alerts for unusual customer account behavior:

Activity Monitoring Rules

Step 7: Audit Logging for Customer Actions

Track important customer account activities:

Logged Events

• ✅ Login/logout events with IP and device info
• ✅ Failed login attempts
• ✅ Password changes
• ✅ Email address updates
• ✅ 2FA enable/disable
• ✅ Billing/shipping address changes
• ✅ Payment method updates
• ✅ Account deletion requests

// View audit logs for specific customer
Users → Attributes User Access → Audit Log
Filter by: User ID, Date Range, Event Type
Export: CSV download for compliance

Best Practices for Ecommerce Security

• ✅ Make 2FA optional but strongly encouraged – Avoid forcing it on first-time customers
• ✅ Use email-based 2FA for accessibility – Most customers already have email access
• ✅ Implement “Remember This Device” – Reduce friction for regular customers
• ✅ Show security indicators – Display “Secure Account” badges for 2FA users
• ✅ Offer incentives for security – Small discount or loyalty points for enabling 2FA
• ✅ Clear communication – Explain why security features protect their data
• ✅ Easy recovery process – Don’t lock customers out of their accounts
• ✅ Monitor for fraud patterns – Use activity logs to identify compromised accounts

Troubleshooting