Customers should receive the intended customer role, while staff use named accounts with appropriate store-management permissions. Avoid giving ordinary customers or temporary support staff administrator access. Review inactive staff accounts, application passwords and API keys separately.

1. Verify HTTPS on checkout, My Account and password-reset pages.
2. Create two separate test customer accounts and place isolated sandbox orders.
3. Confirm each account sees only its own orders, downloads and saved details.
4. Test password setup and reset delivery, including clear expiry or error behaviour.
5. Check that personalised account pages bypass shared full-page caching.
6. Review any membership, social-login or account-management extension that changes the default access flow.

Payment integrations normally use provider-managed tokens or limited display information for saved methods. Do not build a workflow that stores full card numbers or security codes in WordPress fields or order notes. Follow the gateway's supported saved-payment implementation.

Use the store's approved private verification process and the account's recovery methods. Do not ask for the customer's password. A claimed order number or a forwarded screenshot alone may not justify changing the account email or exposing order details.

Keep WordPress and extensions updated, use strong staff authentication and configure compatible abuse controls. Test that rate limits or security rules do not break legitimate password resets and checkout. If a customer reports unexpected account changes, preserve relevant logs and investigate before simply resetting the password and closing the case.

Review customer-data exports, integrations and administrator access periodically. Revoke unused credentials when an agency or application leaves. Apply the store's confirmed retention and privacy policy to old accounts and order data, with appropriate business guidance, rather than deleting records indiscriminately to reduce database size.

• Configuring guest checkout and customer account creation
• Creating a WooCommerce REST API key with limited permissions
• Reading WooCommerce logs without exposing customer data
• Backing up WooCommerce before an extension update

• WooCommerce: Accounts And Privacy
• WooCommerce: The My Account Page
• WordPress documentation
• WordPress hardening guidance