Most Nepali online stores are not broken into by sophisticated hackers. They are opened with a password that was guessed, reused, or handed over by a member of staff who thought the email was real. That is good news, because it means the defences that actually matter are cheap and within reach of any shop. Here is what genuinely protects a store in this market, in the order it pays off.
1. The account layer is where you are actually attacked
Your store admin, your email, your Facebook page and your payment dashboards are the real targets. A stolen product image costs you nothing; a stolen admin login costs you everything.
- Turn on two-factor authentication everywhere it is offered — email first, then the store admin, then social accounts and payment portals. A password alone is one leak away from useless.
- Stop reusing passwords. The most common way a Nepali business account gets taken is a password that leaked from some unrelated site years ago. Use a password manager, even a free one.
- Give staff their own logins. A shared "admin" account means you cannot tell who did what, and cannot remove one person's access when they leave.
- Remove access the day someone leaves. Write it into your handover routine; it is the step everyone forgets.
2. Phishing is the attack you will actually see
The realistic threat is not a stranger breaking your encryption. It is a convincing message: a fake payment-gateway alert, a "your domain is expiring" invoice, a courier notification, a message from what looks like your own bank.
Three habits stop nearly all of it:
- Never log in from a link in a message. Type the address yourself, or use a bookmark.
- Check the sender domain properly, not the display name. Display names are free to fake.
- Treat urgency as a warning sign. "Act within 24 hours or your account closes" is the oldest lever there is.
Tell your staff this out loud. A team that has never been warned will click, and it is not their fault.
3. Encrypt everything in transit — and check it stays that way
HTTPS is not optional. Without a valid certificate, browsers show your customers a "not secure" warning at the exact moment they are typing a phone number, and payment providers will not integrate properly.
Two things sellers get wrong here:
- Letting the certificate expire. A lapsed certificate turns your storefront into a full-page browser warning overnight. Automate renewal and set a calendar reminder anyway.
- Mixed content. One image or script loaded over plain HTTP breaks the padlock for the whole page. Check after any theme change.
Remember what it does and does not do: HTTPS protects data while it travels. It does nothing about a weak admin password or an out-of-date plugin.
4. Do not store what you do not need
The safest customer data is the data you never kept. In particular:
- Never store full card numbers. Let the payment gateway handle cards. If you are writing card details into a spreadsheet or a chat, stop today.
- Do not keep screenshots of payment confirmations longer than you need them for a dispute.
- Keep customer exports off personal laptops and phones. A customer list on a stolen phone is a real breach, and it will be your name attached to it.
Nepal's data protection expectations are tightening, and even where the law is still catching up, the reputational cost of leaking your customers' numbers is immediate.
5. Payment and order fraud, the local version
Fraud in Nepali e-commerce mostly does not look like stolen cards. It looks like:
- Fake cash-on-delivery orders placed with an invented phone number, costing you delivery both ways.
- Forged payment screenshots sent over chat as "proof" of a wallet transfer.
- Refund claims for items that arrived perfectly well.
The defences are procedural rather than technical: verify phone numbers at checkout, confirm high-value COD before dispatch, and — the important one — always verify a payment in your own gateway dashboard or bank statement, never from a screenshot the buyer sent you. Screenshots are trivially edited. Photograph or video the packing of high-value orders so a "it arrived empty" claim can be answered.
6. Keep your software current
Old plugins and old themes are the most common technical way in, because a published vulnerability is a public instruction manual. If you run your own installation, update it on a schedule and remove plugins you no longer use — a deactivated plugin still sitting on the server is still a door. If you use a managed platform, this is handled for you, which is a genuine part of what you are paying for.
7. Back up, and test that the backup restores
A backup you have never restored is a hope, not a plan. Keep an automatic daily backup, keep at least one copy somewhere other than the server itself, and once a quarter actually restore it somewhere and look at it. The businesses that lose everything are almost always the ones who had backups running and had never opened one.
8. Have a plan for the bad day
Write down, before you need it, what happens if you lose access to the store: who to contact at your host and payment providers, where the backups are, which passwords to change first, and what you will tell customers. Half an hour spent on this now saves a frantic day later, and telling customers quickly and plainly does far less damage than being caught hiding it.
A short weekly habit
Security fails through drift, not through a single decision. Once a week: check who has admin access, look at recent orders for anything odd, confirm the backup ran, and confirm the certificate is still valid. Four checks, ten minutes.
The short version
Protect accounts before anything else — two-factor, unique passwords, individual staff logins. Train your team to expect phishing. Keep HTTPS valid and unmixed. Store as little customer data as you can, and never store card numbers. Verify payments in your dashboard rather than from screenshots. Update software, back up, test the backup, and know in advance what you will do on the bad day.
Comments
Be the first to comment.