ConsultationOnline stores are hit by account takeover, carding, skimming, and disruption. Security must precede sales campaigns—not follow losses.
Accounts: MFA for admins, brute-force lockouts, safe recovery, and anti-enumeration. Admin panels must not stay on default public patterns.
Payments: minimize card data, isolate the gateway, test price/coupon tampering and API rate limits. Discount logic is often weaker than simple XSS.
Edge: WAF, DDoS readiness, CDN, and an off-path status page. At traffic peaks, capacity weakness becomes a security-operations incident.
Log and alert on suspicious failed payments, role changes, and spikes on sensitive endpoints. Without monitoring, abuse looks like normal sales.
Before major events, run focused web/API pentests and edge config reviews. Hoxy recommends this sequence for ecommerce engagements.