Cybersecurity for Thai Online Stores & E-commerce

An online store is an unusually attractive target. It processes payments, stores personal data, runs unattended around the clock, and is typically built on a widely-used platform whose vulnerabilities are public knowledge within hours of disclosure. A breach costs you trust, sales, and — under the PDPA — potentially a great deal more.

The encouraging part is that e-commerce attacks are unusually predictable. They concentrate on a small number of weaknesses, and the defences are well understood.

How do you secure a Thai online store?

Five things cover most of the realistic risk: use a payment gateway so card data never touches your servers, keep the platform and every plugin patched, enforce MFA on all admin accounts, minimise the personal data you retain, and have a breach plan that meets the PDPA 72-hour notification window.

Note what is not on that list: expensive security products. E-commerce breaches in Thailand overwhelmingly exploit an unpatched plugin or a compromised administrator login. Both are free to fix and neither requires a tool you do not already have.

Keep card data off your servers entirely

Use an established payment gateway with a hosted or tokenised checkout so card numbers never reach your infrastructure. This removes most PCI DSS scope and means a compromise of your store cannot expose card data, because you never held any.

For Thai merchants this is straightforward — the major local gateways all support hosted checkout or tokenisation. The temptation to build a custom checkout for a smoother experience is real, and it is almost never worth the liability it creates. If you handle card data, you own PCI DSS obligations and the consequences of losing it.

Serve everything over HTTPS, not just the checkout. Mixed content on product pages undermines the trust indicators customers look for, and modern browsers increasingly flag it.

Patch the platform, and every plugin

Outdated plugins are the single most common entry point for e-commerce compromise. Vulnerabilities in popular WooCommerce, Magento and OpenCart extensions are published openly, and automated scanning finds unpatched stores within hours. Patch weekly, and remove every plugin you are not actively using.

The plugin you forgot about is the dangerous one. Deactivated plugins often remain exploitable because their files are still reachable on the server — deactivating is not removing. Audit the list quarterly and delete rather than disable.

Before installing anything new, check when it was last updated. An extension abandoned two years ago will never be patched, regardless of how well it works today.

Lock down every administrative account

Enforce MFA on admin, staff and hosting accounts, give each person their own login rather than a shared one, and grant administrator rights only to people who genuinely need them. Account takeover is the fastest route to both fraud and data theft, and MFA is free.

Shared logins are the pattern to eliminate first. When four people share one administrator account, you cannot tell who did what, you cannot revoke access for one person, and the password never changes when staff leave. Individual accounts with appropriate roles cost nothing and solve all three.

Include the accounts people forget: your hosting control panel, your domain registrar, and the email account that can reset both. A compromised domain registrar account is a total loss regardless of how well the store itself is secured.

Treat customer data as a liability, not an asset

Under the PDPA every record you retain is a legal responsibility. Collect only what you need to fulfil orders, delete what you no longer need, encrypt what you keep, and be able to produce or erase one customer's data within 30 days of them asking.

Most online stores hold far more than they need. Order history from six years ago, abandoned-cart records with full contact details, and exported spreadsheets sitting in someone's email are all liability with no operational value. Data you have deleted cannot be stolen and does not need protecting — retention limits are a security control, not just a compliance one.

Have a breach plan before you need it. The PDPA expects notification of qualifying breaches within 72 hours, which is not enough time to work out who decides, who notifies the PDPC, and how you tell affected customers. Write that down now, while nothing is on fire.

• Is there a published privacy notice explaining what you collect and why?
• Do you capture explicit consent for marketing, separately from order processing?
• Can you locate and delete one customer's data across every system within 30 days?
• How long do you retain order data, and what enforces that limit?
• If your store were compromised tonight, who would you call first?