Foundation · 3 min
What you need to know
Why are there repeated failed admin login attempts?
Repeated failures may be a typo, automated guessing, credential stuffing, or a broken integration. Compare target accounts, sources, timing, and success while strengthening protection.
Why are customer accounts being taken over?
Takeovers commonly follow password reuse, phishing, stolen sessions, compromised email or weak recovery. Trace the entry path and protect post-login actions as well as authentication.
Why is suspicious bot traffic increasing?
Bot traffic may rise after a promotion, leaked credential list, new scraping target or changed attacker tooling. Identify targeted endpoints and business outcomes before tuning controls.
Why are legitimate customers being blocked?
Legitimate users may share networks, travel, use privacy tools, type quickly, or resemble attack patterns. Review false positives by rule and offer proportionate verification or support recovery.
What should I do if an API credential is exposed?
Revoke it, restrict affected access, create a replacement securely, inspect historical use and logs, identify affected data, and fix the exposure source.
What should I do if an administrator account is compromised?
Lock the administrator identity, invalidate its active sessions and tokens, preserve evidence, inspect actions and privilege grants, restore verified access and assess notification duties.
What should I do if customer data may have been exposed?
Contain access, preserve evidence, identify data and people affected, activate security, privacy and legal owners and follow applicable contractual and notification processes.
Why are customers still being tracked after opting out?
A tag may fire before consent, ignore withdrawal, read stale state or reload through another manager. Test network requests in every consent state and trace the responsible configuration.
Why isn’t customer data being deleted from connected systems?
Connected systems may lack a mapped identifier, fail asynchronously, retain backups, or ignore the request. Reconcile each destination and track failures to a verified final state.
Why don’t my customer-data records agree across systems?
Records diverge because systems use different identifiers, update timing, sources, transformations, or deletion states. Choose authoritative fields and reconcile changes through monitored events.
How do I perform an ecommerce security audit?
Audit assets, responsibilities, identities, permissions, sensitive actions, APIs, apps, encryption, secrets, updates, abuse controls, payments, monitoring, incidents and recovery; rank gaps by likelihood and impact.
How do I perform an ecommerce privacy audit?
Audit data inventory, purposes, minimization, notices, trackers, consent, marketing choices, retention, rights, deletion, transfers, governance and evidence; validate jurisdiction-specific conclusions separately.
A quick store check
Choose one current security or privacy symptom and build a timeline across identity, application, provider, consent and audit records.
Foundation · 2 min
Frequently asked questions
Should an audit begin by buying a new security tool?
No. First map assets, data, owners, controls and evidence; then choose tools for identified gaps.
Can security and privacy audits use the same checklist?
They overlap, but privacy also tests purpose, transparency, consent, rights, retention, and transfers beyond technical security.