Card payment security for a small online store
This piece for Crazish collects the advice that holds up in practice.
Any business that accepts card payments is expected to protect card data according to industry security standards. For a small online store the simplest way to meet most of those requirements is to avoid handling card numbers at all. Using a reputable payment provider whose hosted checkout collects the details means the sensitive data never touches your own server.
Even then, the shop itself needs basic care. Keep the store software and its plugins updated, use strong unique passwords with two-step verification for every administrator account and remove staff access promptly when people leave. Review payment notifications for unusual patterns, such as many small orders from one address, which can indicate stolen cards being tested.