E-commerce Security in Pakistan | Online Store & Payment Protection

Most advice about e-commerce security is written for companies with a security team and a custom platform. Most Pakistani online stores are a WooCommerce site, a payment gateway integration, a WhatsApp number and two or three people doing everything. The risks are different, and so are the fixes that are worth your money.

E-commerce Security in Pakistan: What Actually Gets Online Stores Breached

The single most valuable decision: stay out of card scope

Before anything technical, there is one architectural choice that determines whether securing your store is cheap or expensive.

If card numbers never touch your server, your compliance burden collapses to almost nothing. If they do, you are in full PCI DSS scope and everything becomes more expensive forever.

In practice that means using a payment method where the customer enters card details on the payment provider's own page or in their hosted iframe, rather than on a form you built that posts to your server.

Some developers prefer a fully custom checkout because it looks better. That preference can cost you an order of magnitude in compliance cost and makes a breach catastrophic rather than embarrassing. Make it a business decision rather than leaving it to whoever builds the checkout.

If you already take card details on your own form, that is the first thing to change, ahead of anything else in this article.

How Pakistani stores actually get breached

Not by sophisticated attacks on the checkout logic. The real pattern, in rough order of frequency:

An abandoned plugin

WordPress and WooCommerce power a large share of Pakistani online retail, and the application itself is usually not the problem. The problem is the eleven plugins, one of which was last updated in 2021, and three of which were installed for a campaign that ended two years ago.

Attackers do not target your store specifically. They scan the whole internet for a known vulnerable plugin version and take whatever answers.

The fix is unglamorous and effective: remove every plugin you do not actively use, update the rest on a schedule, and before installing anything new check when it was last updated.

A reused admin password

The store admin password is the same one used on a forum that was breached in 2019. No vulnerability is required.

Enforce multi-factor authentication on every admin account. This is cheap, fast, and prevents the most common real-world compromise. If you do one thing from this article after fixing card scope, do this.

An outdated theme or a nulled one

Pirated premium themes and plugins are common in this market and a meaningful share contain deliberately inserted backdoors. The saving is a few thousand rupees. The cost is someone else having permanent access to your store.

If you are running anything downloaded from a file-sharing site, assume it is compromised and replace it.

Hosting that was never meant for a shop

Cheap shared hosting puts your store on a server with hundreds of other sites. A compromise of any of them can become a compromise of yours, and you have no visibility into either.

You do not need expensive infrastructure. You do need hosting where your site is actually isolated and where you can get logs when something happens.

The developer who left

The freelancer who built the site two years ago still has admin access, FTP credentials and possibly the database password. They are not malicious. Their laptop is just another place your store can be compromised from.

Review who has access every few months and remove everyone who no longer needs it.

Account takeover, which is where the money goes

Breaching your server is one route. The easier one is logging in as your customers, or as your sellers if you run a marketplace.

Attackers take credentials leaked from other breaches and try them against your login form at scale. A percentage always works, because people reuse passwords.

What stops it is unexciting and effective. Rate limit login attempts per account and per IP. Do not reveal whether an email exists when login fails. Offer MFA to customers and require it for sellers and anyone who can change payout details. Alert on changes to email address, phone number and bank details, and require re-authentication for those changes specifically.

That last one matters most for marketplaces. The attack is not stealing an order, it is changing where the payouts go, and it often sits unnoticed until a seller asks where their money is.

Cash on delivery fraud, which international guides never mention

COD remains a large share of Pakistani e-commerce and it creates a loss channel that has nothing to do with hacking.

The common patterns are bulk fake orders placed to tie up stock and courier capacity, repeat refusal at the door from the same address under different names and numbers, and address or phone variations used to evade a blocklist.

Controls that work without annoying genuine customers: verify the phone number by OTP before confirming high-value COD orders, score orders on history rather than treating every order as new, set a value threshold above which COD requires prepayment or a callback, and normalise addresses so that small variations do not defeat your own blocking.

This is a fraud problem rather than a security problem, but it comes out of the same budget and it is frequently the larger number.

The payment integration mistakes we find most often

When we test Pakistani e-commerce applications, the same integration flaws recur.

The callback is trusted without verification. The payment provider notifies your server that payment succeeded. If your code accepts that notification without verifying its signature, anyone can send the same message and get free goods. This is the single most common serious finding in local checkout code.

The amount is taken from the request instead of the order. If the price is submitted by the browser and the server does not re-read it from its own database, the customer decides what to pay.

Order state can move backwards or skip steps. Workflows that assume customers move forwards in sequence allow a cancelled or unpaid order to be pushed to shipped.

Coupons and loyalty points race. Submit the same single-use coupon twenty times in parallel and, without a lock or a uniqueness constraint, it applies twenty times.

None of these are found by a vulnerability scanner, because to a scanner they all look like the application working. They are found by a person testing the business logic.

What to do, in priority order and on a small budget

Keep card data off your servers. Hosted payment page or provider iframe. This is the decision with the largest effect on everything else.

Enforce MFA on every admin account. Free, takes an afternoon, prevents the most common compromise.

Remove unused plugins and update the rest. Then put a monthly reminder in a calendar, because this is maintenance rather than a project.

Replace anything pirated. Themes and plugins both.

Review who has access. Remove old developers, agencies and staff who have left.

Make backups you have actually restored. An untested backup is a belief, not a control. Restore one to a test environment and see whether it works before you need it.

Then get the application tested. Once the basics above are done, a penetration test finds the things that are specific to you: the callback verification, the price handling, the coupon race, the places where one customer can see another's order.

The order matters. Paying for a test before removing abandoned plugins means paying someone to tell you to remove abandoned plugins.

When a test is actually worth it

If you are a small store selling a few hundred orders a month through a hosted payment page, do the basics and spend your money on the business.

Get tested when any of these are true. You built custom checkout or payment logic. You hold customer data beyond name, address and order history. You run a marketplace with seller payouts. A partner, bank or enterprise customer has asked for evidence. Or you are large enough that a day offline is a number you can calculate and it frightens you.

A single web application starts at USD 399 and a full manual penetration test is USD 1,500, so the test is rarely the expensive part of the decision.

Where we fit

We test e-commerce applications and payment integrations for clients across Pakistan from our base in Multan, and the business logic work is where most of the value is: price and quantity manipulation, coupon and voucher abuse, race conditions on balance and stock, order workflows that can be pushed into states they should not reach, and whether your payment callbacks can be forged.

If you are not sure whether you need a test yet, describe your setup and we will tell you honestly. Quite often the answer is to fix the five free things first and talk to us after.

Frequently asked questions

Do I need PCI DSS compliance for my online store in Pakistan?

It depends almost entirely on whether card data touches your servers. If customers enter card details on your payment provider's hosted page or in their iframe, your scope is drastically reduced and compliance is largely a questionnaire. If you built your own card form that posts to your server, you are in full scope and the cost rises sharply. Choosing a hosted payment page is the single most valuable decision an online store can make about security cost.

How do most Pakistani online stores actually get hacked?

Rarely through clever attacks on checkout logic. The common routes are an abandoned WordPress or WooCommerce plugin that has not been updated in years, an admin password reused from a site that was breached elsewhere, a pirated theme or plugin containing a backdoor, cheap shared hosting where a neighbouring site is compromised, and an old developer or agency who still has access nobody removed.

Is WooCommerce secure enough for a real store?

Yes, and the platform is rarely the problem. The exposure is almost always the plugins around it. Remove every plugin you do not actively use, update the rest on a schedule, check when a plugin was last updated before installing it, and never use a nulled or pirated version. A lean, updated WooCommerce store is considerably safer than a custom application nobody maintains.

What is the cheapest thing I can do this week to improve security?

Enforce multi-factor authentication on every administrator account. It is free, takes an afternoon, and prevents the single most common real-world compromise, which is an attacker logging in with a password reused from another breach. After that, remove plugins you do not use and remove access for anyone who no longer works with you.

How do I stop fake cash-on-delivery orders?

Verify the phone number by OTP before confirming high-value COD orders. Score orders against customer history rather than treating each one as new. Set a value threshold above which COD requires prepayment or a callback. And normalise addresses and phone numbers so that small variations do not defeat your own blocklist. This is a fraud problem rather than a hacking problem, but it often costs more than either.

What payment integration mistakes do you find most often?

Four recur constantly. Accepting the payment provider's success callback without verifying its signature, which lets anyone claim a payment succeeded. Taking the amount from the browser request rather than re-reading it from your own database. Order workflows that allow states to be skipped or reversed, so an unpaid order can reach shipped. And single-use coupons that can be applied many times when submitted in parallel. None of these are found by automated scanners, because each one looks like the application working normally.

How do I protect customer accounts from takeover?

Rate limit login attempts per account and per IP, do not reveal whether an email address exists when login fails, offer MFA to customers and require it for sellers, and alert on changes to email, phone and bank details while requiring re-authentication for those specific changes. For marketplaces the real attack is changing where payouts go, which often sits unnoticed until a seller asks where their money is.

Does a small online store really need a penetration test?

Not necessarily, and we will say so. If you sell a few hundred orders a month through a hosted payment page, do the free basics and spend your money on the business. Testing becomes worthwhile when you have custom checkout or payment logic, hold customer data beyond name and address, run a marketplace with payouts, have been asked for evidence by a partner or bank, or are large enough that a day offline is a number you can calculate.

What does an e-commerce penetration test cover?

Authentication and session handling, authorisation between customers so one cannot reach another's orders or data, the payment flow including callback verification and price handling, business logic such as coupon abuse and stock or balance race conditions, the admin interface, and the usual injection and input handling classes. The business logic work is where most of the findings that matter come from.

How much does testing an online store cost?

A single web application starts at USD 399 and a full manual penetration test is USD 1,500. What moves the figure is how many user roles exist, whether a seller or marketplace side is included, and how much custom payment logic there is. We quote a fixed price in writing after scoping.

Should I test before or after fixing the basics?

After. Paying for a test while abandoned plugins are still installed and admin accounts have no MFA means paying someone to tell you to remove abandoned plugins and enable MFA. Close the free, known gaps first, then test so the engagement spends its time on the issues that are specific to your application.

Is cheap shared hosting a real security problem?

It can be. On shared hosting your store sits alongside many other sites, a compromise of any of them can reach yours, and you usually cannot get the logs you would need to investigate. You do not need expensive infrastructure, but you do need hosting where your site is genuinely isolated and where you can obtain logs when something goes wrong.

E-commerce Security in Pakistan: What Actually Gets Online Stores Breached