Clear Path step · Business · Your industry's rules and risks
Lock down the store admin, staff accounts and plugins
Why it matters: Store admin access lets an attacker change payout accounts, inject skimming code or export customers. Plugins and apps are a common way in.
On your path if you picked “Retail and e-commerce” for “What's your industry?”.
Do it
- Give every staff member their own account with the least access they need.
- Require phishing-resistant MFA for owners and admins.
- Remove unused apps and plugins; update the rest automatically.
- Turn on alerts for payout account changes and new admin users.
Check it worked: Store platform admins use passkeys or security keys, each staff member has their own limited account, and unused apps and plugins are removed and the rest are updated.
Simply put
It's like giving each employee their own till key instead of sharing the manager's. A limited account per person, strong sign-in for admins and fewer plugins mean fewer ways to change payouts or plant skimming code.
In detail
Store apps are non-human identities with broad API access; review their permissions like you would a staff member's.
If this is new to you: Worried about breaking the store? Remove only plugins you don't use, one at a time, and check the store after each. The rest can update automatically.
Points toward the Long View: store apps and staff with only the access their job needs.