SuiteCommerce Site Security Best Practices

Based on an analysis of 7 million websites, SiteLock reported that websites experience an average of 94 attacks per day and are visited by bots 2,608 times per week. eCommerce sites are disproportionately targeted because they process payment data, store customer records, and handle high-value transactions. For B2B merchants in particular, the risk is elevated: larger transaction values, extended payment terms, and complex account hierarchies make SuiteCommerce stores attractive targets for fraud, account takeover, and data theft.

SuiteCommerce, as a cloud-based platform hosted on NetSuite’s infrastructure, provides a strong security foundation. But a secure platform is not the same as a secure implementation. The settings you configure, the code you deploy, and the processes your team follows determine whether that foundation holds.

The most common eCommerce security threats in 2025 include phishing attacks targeting admin credentials, SQL injection attempts, distributed denial-of-service (DDoS) attacks, account takeover via credential stuffing, and malicious scripts injected through third-party integrations. Each of these has a corresponding mitigation in the practices below.

1. Use HTTPS Across Every Page

HTTPS is no longer optional. NetSuite has stated it will end support for non-secure website domains, meaning SuiteCommerce stores operating on HTTP will lose platform support. An SSL/TLS certificate encrypts all data transmitted between your store and your visitors’ browsers, including login credentials, payment information, and personal data.

Implement HTTPS across your entire site, not just checkout pages. Configure automatic redirects from HTTP to HTTPS at the server level. Monitor for mixed content issues, where HTTPS pages load HTTP assets such as images, scripts, or fonts, as these generate browser warnings that erode customer trust and can break security headers.

Use TLS 1.2 or higher and avoid legacy SSL protocols. TLS 1.0 and 1.1 are deprecated and vulnerable to known attacks. Renew SSL certificates before expiry and include a monitoring alert in your calendar at least 30 days before the renewal date.

2. Enforce Two-Factor Authentication (2FA) for Admin Access

All NetSuite roles with access to SuiteCommerce configuration, custom code deployment, or customer data should be protected with Two-Factor Authentication. 2FA requires users to verify their identity with a second factor beyond their password, typically a time-based code from an authenticator app.

Require 2FA for all administrator roles, developers, third-party integrators, and anyone with access to sensitive areas of your NetSuite account. Even strong passwords can be compromised through phishing or data breaches from unrelated services. 2FA makes those stolen credentials significantly harder to exploit because the attacker would need physical access to the secondary authentication device.

Consider enforcing Multi-Factor Authentication (MFA) for high-value customer accounts as well, particularly B2B buyers managing large order volumes, credit limits, or multiple users under a shared account. This adds a layer of protection against account takeover attacks targeting your buyers rather than your admin team.

3. Keep Themes, Extensions, and Platform Updates Current

NetSuite releases two major platform updates per year. Each release includes security patches alongside functional improvements. SuiteCommerce themes and custom extensions that are not maintained against current platform versions can develop vulnerabilities as the underlying platform evolves around them.

Maintain a staging environment that mirrors your production store. Test every NetSuite release against your staging environment before applying it to production. Review NetSuite’s release notes for security-related changes and prioritize those patches.

Assign ownership of the update process to a specific person or partner. Updates that are no one’s explicit responsibility tend not to happen on schedule. If you work with a NetSuite partner on a support retainer, confirm in writing that update testing and deployment is included in the scope.

4. Implement Role-Based Access Control

SuiteCommerce is integrated with NetSuite’s Role-Based Access Control (RBAC) system. RBAC allows you to assign precise permissions to each user based on what they need to do, not a blanket level of access.

Follow the principle of least privilege: every user, developer, and integration should have only the access required to perform their specific function. An employee who manages product content does not need access to financial records. A third-party integration that syncs inventory does not need write access to customer payment data.

Conduct a role and permission audit at least quarterly. Remove or downgrade access for users who have changed roles or left the organization. Inactive accounts with elevated permissions are a significant and preventable vulnerability. NetSuite’s system logs can surface accounts that have not logged in recently, which is a useful starting point for access reviews.

5. Secure Custom Code and Third-Party Integrations

Custom JavaScript, SuiteScript extensions, and third-party API integrations are the most common sources of introduced vulnerability in SuiteCommerce implementations. Improperly validated inputs, insecure API key management, and unvetted third-party scripts can each create exploitable attack surfaces.

Follow NetSuite’s official SuiteScript best practices for all custom development. Validate and sanitize all inputs. Store API keys and credentials in NetSuite’s credential management system rather than hardcoded in scripts.

Implement Content Security Policy (CSP) headers to define a whitelist of trusted sources from which your store may load scripts, styles, and other resources. A well-configured CSP header prevents attackers from injecting malicious scripts into your pages even if they find another entry point.

Before deploying any new third-party SuiteApp, integration, or external script, conduct a security review. Check the vendor’s security documentation, confirm they follow PCI DSS guidelines if they touch payment data, and restrict the permissions their integration requires to the minimum necessary. Regularly audit which third-party tools are active and remove any that are no longer in use.

6. Monitor and Log Site Activity

NetSuite’s system logs provide a record of login activity, configuration changes, and script executions across your account. Review these logs regularly. Unusual login patterns, failed authentication attempts from unfamiliar IP addresses, and unexpected configuration changes are all early indicators of a security incident.

Supplement NetSuite’s native logging with an external monitoring tool. SiteLock, Sucuri, and Intruder are commonly used options that provide real-time alerting for anomalous behavior, malware scanning, and vulnerability detection. Set up automated alerts for critical events such as multiple failed admin logins, new user creation with elevated roles, or unexpected changes to checkout or payment configuration.

7. Configure Session Timeouts and Secure Cookie Policies

Session management is a frequently overlooked security layer. If a user leaves an admin session open on a shared or public device, an attacker can take over that session without needing their credentials.

Configure session timeout settings to automatically log out inactive users after a reasonable period, typically 15 to 30 minutes for admin roles. Apply the following flags to all session cookies:

• HttpOnly: Prevents JavaScript from accessing the cookie, protecting against cross-site scripting (XSS) attacks that attempt to steal session tokens.
• Secure: Ensures the cookie is only transmitted over HTTPS connections.
• SameSite=Strict or Lax: Reduces the risk of cross-site request forgery (CSRF) attacks by controlling how cookies are sent with cross-origin requests.

Review your cookie configuration after each major theme update or custom extension deployment. New scripts added to the site can inadvertently alter cookie behavior or introduce new client-side storage patterns that bypass these protections.

Security Is an Ongoing Process

SuiteCommerce site security is not a one-time setup task. The threat landscape evolves, platform updates introduce changes, and new custom code and integrations add complexity over time. The practices above provide a strong baseline, but maintaining that baseline requires regular attention.

A practical security calendar for SuiteCommerce merchants includes: monthly review of NetSuite system logs, quarterly role and permission audit, review and testing in staging before each NetSuite release, and an annual third-party security audit covering custom code, active integrations, and cookie and header configurations.

Working with a NetSuite partner who understands both the platform’s security architecture and the eCommerce threat landscape reduces the risk of gaps developing between your security posture and the current threat environment. Contact our NetSuite Support team to discuss how we can help you build and maintain a secure SuiteCommerce implementation.