Orb44 — WooCommerce on your VPS: grade D → B in a week

A typical WordPress shop on a VPS you control. On Monday threats were found. By Friday it looked better. We never logged in or changed the server.

What was open

Guest orders readable without login. An old plugin that could mint an admin. A payments plugin that skipped the login check. From the machine: Postgres listening on every address.

What changed

The owner updated WooCommerce and plugins, closed guest orders, put a firewall on the database.

Shopify contrast

A password on the storefront can still leak the catalog at a public products URL. That check is outside-only — no satellite on Shopify.