BigCommerce security · monitored updates

Protect the commerce layer your team controls.

BigCommerce secures the hosted platform. Growtype can review users, permissions, apps, API accounts, webhooks, scripts, checkout customizations, domains, and external commerce integrations.

Review my BigCommerce site See the scope

Direct answer

What does BigCommerce security maintenance cover?

BigCommerce secures the hosted platform. Growtype can review users, permissions, apps, API accounts, webhooks, scripts, checkout customizations, domains, and external commerce integrations.

BigCommerce operates the hosted commerce core. Store owners control users, high-risk permissions, apps, API accounts, scripts, themes, webhooks, checkout customizations, domains, and connected systems.

BigCommerce security scope

Monitor the signals.
Implement the supported response.

The exact controls depend on platform access, plan, hosting model, connected services, and the approved service scope.

What Growtype can monitor

  • Store users, roles, and high-risk permission changes
  • Apps, API accounts, tokens, webhooks, and integrations
  • Script Manager, theme, and checkout customization changes
  • Domain, TLS, storefront, and order-flow signals
  • Platform notices and operational logs available to the store

Updates and remediation

  • Remove unused users, apps, API accounts, and scripts
  • Reduce permissions and rotate exposed credentials
  • Update themes, apps, webhooks, and custom integrations
  • Review domain, checkout, payment, and order-data flows
  • Test storefront, cart, checkout, order, refund, and integration paths

Operating loop

From security signal to verified BigCommerce change.

  1. 01

    Monitor

    Review the agreed security signals, account activity, platform notices, and operational changes.

  2. 02

    Assess

    Confirm exposure, compatibility, ownership, urgency, and the safest supported response.

  3. 03

    Update

    Implement approved patches, app or extension updates, configuration changes, and access improvements.

  4. 04

    Verify

    Test critical journeys, integrations, permissions, logs, and recovery paths after the change.

  5. 05

    Recover

    Keep a proportionate rollback or recovery route and document remaining risk and next ownership.

Risk signals

What deserves attention on BigCommerce.

These signals do not prove compromise. They identify conditions that need investigation, ownership, or a supported change.

Read BigCommerce security and compliance overview
  1. 01

    High-risk permissions assigned too broadly

  2. 02

    API credentials without rotation or ownership

  3. 03

    Unknown storefront scripts or checkout customizations

  4. 04

    Unused apps retaining customer or order access

  5. 05

    Unverified webhooks and downstream commerce systems

Responsibility boundary

Growtype does not claim control of the whole platform.

BigCommerce owns security changes to the hosted core. Payment, ERP, fulfillment, tax, app, and other providers retain their own responsibilities. Growtype covers the merchant-controlled components agreed in scope.

No provider can guarantee permanent security. The practical goal is lower avoidable risk, earlier detection, supported updates, verified changes, and recoverability.

Security across the stack

All website security services
WPWordPress security WOOWooCommerce security SShopify security WIXWix Studio security SQSquarespace security WFWebflow security ACAdobe Commerce security

BigCommerce security questions

Know the boundary before the change.

Which BigCommerce permissions need special attention?

Permissions affecting users, apps, API accounts, store settings, checkout, orders, customers, scripts, and data exports deserve risk-based review. The right set depends on each role.

Can Growtype review BigCommerce apps and API access?

Yes. Each app, API account, webhook, token, and script can be mapped to a purpose, owner, data boundary, and tested business workflow.

Who installs BigCommerce core patches?

BigCommerce manages the hosted core. Growtype can update and test merchant-controlled themes, apps, scripts, credentials, webhooks, and integrations.

BigCommerce security review

Start with the installed system, not a generic checklist.

Share the website, platform plan or version, connected services, known concerns, and critical journeys. Growtype will confirm available evidence, scope, responsibility, and the next safe action.

Request a security review