How to fix passive scan only on WooCommerce

Steps for WooCommerce

1. Create a staging environment using your host's built-in staging tool (e.g., WP Engine, Kinsta, SiteGround all offer one-click staging) or use the free 'WP Staging' plugin: Plugins → Add New → search 'WP Staging' → Install & Activate → WP Staging → 'Create new staging site'.
2. Ensure the staging site is not indexed (Settings → Reading → 'Discourage search engines') and is either password-protected at the server level or accessible only from your IP.
3. Install OWASP ZAP on your local machine (download from zaproxy.org). Launch ZAP → Automated Scan → enter your staging URL.
4. Add a 'Context' in ZAP with your WooCommerce test-account login so the scanner can reach the cart, checkout, and My Account pages.
5. Run the active scan, note High/Critical findings, then fix them in staging (theme files via Appearance → Theme File Editor, plugin settings, or .htaccess via Plugins → File Manager).
6. After fixes pass re-scan, sync or deploy staging to production using your host's push-to-live feature or WP Staging Pro's push function.

What is passive scan only?

Passive security scans — like the checks run on your HTTP headers, TLS certificate, cookies, and email DNS records — are a great first step, but they can only see what your store broadcasts to any visitor. They cannot test whether your login form is vulnerable to brute-force attacks, whether your checkout accepts malicious input, or whether an authenticated user can access another customer's data. Active security testing (called DAST — Dynamic Application Security Testing) actually interacts with your live or staging site the way a real attacker would, probing for those deeper vulnerabilities. Tools like OWASP ZAP (free) or commercial equivalents send crafted requests to your store and report weaknesses that a passive scan will never find.

A security breach on an ecommerce store can expose customer payment data, personal information, and order history — leading to regulatory fines (GDPR, PCI DSS), chargebacks, loss of payment processor access, and permanent damage to customer trust. Many of the most damaging attack types — SQL injection, cross-site scripting (XSS), broken authentication, insecure direct object references — are invisible to passive scanning but are caught routinely by DAST tools. Running active tests before each release means you find and fix vulnerabilities before attackers do, protecting your revenue, your customers, and your brand reputation. Skipping this step is one of the top reasons stores appear in breach reports despite having "green" passive security scores.

See the complete Passive scan only guide for every platform and the full background.