WooCommerce Card Skimming Malware: Signs, Response and Prevention

On this page

1. How skimmers work
2. Warning signs
3. What to do immediately
4. Clean the store
5. Reduce the risk with the right payment setup
6. Ongoing protection

Card skimming malware is one of the most damaging attacks an online store can suffer. Malicious code on the checkout page captures customers' card details as they type and sends them to criminals. Customers lose money, and the store loses trust.

How skimmers work

• Injected JavaScript that reads card fields on the checkout page
• Fake payment forms shown before the real payment step, or in place of it
• Code hidden in the database, plugin files or scripts loaded from look-alike domains

Skimmers often activate only on the checkout page, which makes them easy to miss.

Warning signs

• Customers report card fraud after buying from your store
• Your payment gateway or bank contacts you about suspicious patterns
• Unfamiliar scripts or external domains loading on checkout
• An extra or unusual card form at checkout
• Unknown admin users or unexpected file changes

What to do immediately

1. Stop exposure: disable the affected payment method or put the checkout into maintenance
2. Preserve evidence: take a full backup and keep logs
3. Inform your payment gateway and follow their guidance
4. Take advice on notification: Indian rules may require reporting cyber incidents to CERT-In within a short timeframe, and data protection law may require notifying affected customers. Get legal advice promptly

Clean the store

• Follow the full malware clean-up process
• Search the database, especially options and settings, for injected scripts
• Check theme and plugin JavaScript files and any custom checkout code
• Remove backdoors and unknown admins
• Change every password and regenerate security keys
• Test checkout thoroughly before re-enabling payments

Reduce the risk with the right payment setup

The safest approach for most small stores is to never let card details touch your website at all:

• Hosted or redirect checkout: the customer pays on the payment gateway's secure page
• Gateway-hosted popups or embedded fields: card fields are served by the gateway, not your site
• UPI and wallets: no card numbers typed on your site

Even then, attackers can try to swap in fake forms, so monitoring still matters. See accepting online payments.

For the wider picture, including staff accounts, card-testing bots and fraud orders, work through the WooCommerce security checklist.

Ongoing protection

• Keep WooCommerce, plugins and themes updated
• Minimise plugins that load on the checkout page
• File-change monitoring and a web application firewall
• 2FA for all admin and shop manager accounts; see securing logins
• A Content Security Policy limiting which scripts can run; see security headers

Suspect your store is compromised? Get help immediately: WordPress malware removal.