As I said, I've never used it. Is it approved by places such as First Data corp and Card Service International, AuthorizeNet?

That doesnt mean the "works with" sits there. There will be an Approved By statement in the license agreement. That means that it passes their auditing. If it doesnt, then I'd simply not use it.

It makes no difference how many web sites use it. Or you can even call a sized merchant account provider and see if its a registered application or not. How many websites use this or that and all is fine until its not and they are hacked. Its one thing to have a blog or video or whatall site and have information compromised. Its a VERY different thing in eCommerce as that is VERY subject to damages.

Dont believe it? Ask any IT attorney.

Dont want believe him or her? Call First Data or CardService (authorize.net). Dont want believe them? Call any hosting provider not trying to sell you services that is selling more dedicated services (such as Rackspace) and see if you can speak to their IT eCommerce specialist(s) in respect to Woo or others. Woo may be completely solid. I dont know, I never even looked at it.

VirtueMart on Joomla was said to be solid as well. Thats not necessarily where problems reside. Woo could be the best commerce gizmo since Apple's and Honey were slapped together.

The point is not necessarily ITS security. With a CMS system one may be using Plugin "A" which has a security issue that allows for a hacker to get access and thus EXPOSE data. There are all sorts of data that if its compromised people dont tend care, they dont like it such as someone farming 100,000 email addresses and spam rolls in. But when it comes to data that conforms to what amounts to identity theft capability that gets nasty. Fast. Expensive. Fast. Can result in incarceration. Can result in instant injunctions here in the USA from a State Attorney General (essentially that means, your out of business until a court says otherwise, cant update existing anything... nothing, confiscation of anything related to the business, restraints placed on any accounts associated on and on). I cant speak to other nations in these regards.

I dont know what data Woo deals with. Does it hold encrypted card information? Does it hold PayPal login information? I presume it properly handles SSL.

There are plenty of examples all over the Internet news about lawsuits resulting from malicious data access, One of the most recent Anthem with medical records in which the State Of California (and others last I knew) filed suit.

JP Morgan Chase, First Data, Nieman Marcus and buckets of others in class actions, state actions and/or both. So let me understand this. Because a site/business is using Woo Commerce which by nature due to it being a CMS plugin may get database data compromised indirectly via some other plugin how does that escape liability of said activity?

"Mr. Judge, The site was compromised as hackers accessed and farmed data from the ecommerce plugin due to a security hole in the cache mechanism. So I have no liability".

Again... The CMS systems are just as we are seeing with Wordpress more vulnerable to hacking because of its extensibility via plugins and.or widgets.

To the 15,000 consumers who got their identity stolen because of a cache, commerce plugin or because the webmaster just copied and pasted it into some forum could care less how or why and the judge could care less how or why. He assigns liability and whether its a class action, a state action a prosecutor is there and and ignorance of security issues whether they be in the commerce app or cache app or elsewhere are completely immaterial to the matter. The matter is liability and assignment thereof.

Just as JP Morgan Chase, Target Merchandise, and countless really large corporations have found in settlement. Woo can be as solid or even more so than Magento or Amazon.com Doesnt matter.

When dealing with commerce where-ever the security breach occurred does not void liability.

If you are designing websites for other clients (or self for that matter) security of information is part of the deal. In Commerce, its more important. Malicious code can do anything from compromise a database to injecting code that sends back every single credit card entered to some annonymous proxy and off it goes into never never land until your wife finds out that the necklace she ordered At Noodles Necklaces resulted in the next 10 years of her life becoming a nightmare.

These are EXACTLY some of the stakes that our next presidential administration will begin to deal with as well as illegit import/export and what are called "Warrants of Merchantability" which for example every Goodwill store deals with but at eBay its "forgotten".

You can buy Baseball cards at eBay for your son. He's happy as a clam. Next thing you know he is diagnosed with Hepatitis for the rest of his days.

Towards that end its why eBay's OmniChannel exists. Thats the "future of eBay". I know it for fact, Karin Stahl and I go WAAAAAAYYYYY back. While she now is not in the management roles she used to stress out about at one point she was essentially #3 in the company.

When making websites for clients its simple. THINK ABOUT THE CLIENT NOT THE CLIENTS WALLET. Put YOURSELF in their shoes.

If "Suzies Socks" was MY business what would *I* do to ensure *MY* website for ecommerce (or anything else perhaps) is as SECURE as I can make it. Would I use a platform that can have induced security holes due to third party plugins? Do I ONLY put Woo commerce in and nothing else that many compromise security? Do I go with a known approved secure eCommerce package that has been signed off upon by Authorize.NET, First Data, Chase merchant services?

The CLIENT will APPRECIATE that you have THEIR best interests at heart.

Wouldnt you?