A WooCommerce incident combines WordPress evidence with payments, orders, customer accounts, stock and third-party systems. Changing gateways or restoring an old database can remove the timeline needed to reconcile charges and fulfilment.
Protect customers immediately, then preserve only the data required for scope and recovery.
Record the first report
Capture affected URL, checkout/payment method, time, device, referrer and visible symptom. Record who reported it and any order/transaction reference through an approved secure channel.
Do not ask for card numbers, security codes or screenshots showing payment details. Never test suspected checkout code with a real card.
Use one timezone across the incident.
Contain checkout safely
Disable checkout/payment or serve static maintenance outside the untrusted WordPress runtime. Keep browsing available only if product pages are demonstrably safe and cannot execute the suspect code.
Notify the payment provider/acquirer under their incident process. Do not simply hide the payment fields with CSS or JavaScript.
Record containment time and any orders already in progress.
Snapshot WordPress and WooCommerce
Preserve filesystem, database, WordPress/PHP/web logs, users, application passwords, cron/Action Scheduler and current configuration. Include hidden files and hosting/CDN rules.
Store snapshots outside public paths with restricted access. Record source, time, size and checksum where practical.
Do not overwrite the only live copy with a backup.
Preserve orders and status history
Export or snapshot orders through the correct WooCommerce storage model, including HPOS where active. Retain status notes, order items, totals, tax, addresses, refunds and transaction IDs.
Do not email a complete customer export or copy card data that WooCommerce should not store. Limit access and follow retention/privacy obligations.
Record the last known trustworthy order.
Preserve payment-provider evidence
Save provider event/webhook IDs, transaction state, payout/configuration changes, API-key metadata and administrator audit events. Use provider support channels for sensitive evidence.
Do not copy secret keys or full webhook payloads into a ticket. Record hashes/identifiers and timestamps.
Check whether payout bank or business contacts changed.
Capture checkout code and network destinations
Preserve rendered script URLs or inline-code hashes, final HTML, Content Security Policy and safe network-domain list. Capture tag-manager/CDN worker versions and plugin/theme sources.
Do not execute or publish malicious code. Compare approved payment, consent, fraud and analytics suppliers with what the browser loaded.
Keep an isolated working sample if authorised.
Preserve sessions and customer-account evidence
Record session/cookie configuration, account-login events, password resets and privileged role changes. Do not collect live cookies or reset tokens.
If account takeover is suspected, revoke sessions only after preserving relevant metadata and provide a safe reset route through a trusted mailbox.
Check guest checkout and registered-customer paths separately.
Preserve external integrations
Inventory CRM, ERP, shipping, tax, invoice, subscription, email and analytics webhooks/keys. Record last successful sync and any queue backlog.
Disable unsafe callbacks through the provider or clean control plane. Do not bulk-run pending actions before understanding payment/order side effects.
Protect credentials and customer data in logs.
Preserve stock and fulfilment state
Capture inventory, reservations, warehouse/shipping status and digital/subscription entitlements for the incident window. One manipulated order can affect stock and downstream access even without a valid payment.
Name the authoritative fulfilment system and stop automatic processing until reconciliation. Do not reduce or restore stock twice.
Document business impact
List potentially affected orders, payment methods, account sessions, customer communications and fulfilment actions. Separate confirmed impact from possible capability.
Coordinate legal/privacy/payment-industry decisions with authorised owners. Technical cleanup does not determine notification obligations alone.
Keep one authoritative reconciliation owner.
Prepare the recovery inventory
List trusted code sources, clean backup candidates, required custom checkout logic and secrets to rotate. Define tests for cart, checkout sandbox, payment/webhooks, refunds, email and customer accounts.
Request emergency WooCommerce rescue when checkout or payments may be affected. Share managed access and redacted IDs—never card data, secret keys, customer exports or malware publicly.