StoreSweep

For WooCommerce, Shopify and BigCommerce stores

We watch your store for card thieves and accessibility lawsuits.

Criminals slip code onto payment pages that copies card numbers as customers type them. Barriers on your pages stop shoppers with disabilities from buying, and they are behind thousands of lawsuits against online stores every year. We check for both every week, email you the day something changes, and keep a dated record for your bank or your lawyer.

Choose your plan See a sample evidence pack

From $39 a month. Pay, tell us your store, and your first check runs straight away.

scan runningnorthfield-outfitters.example
  1. 00:00robots.txt read · named policy honouredok
  2. 00:02/ home · 4 scripts · 2 hostsok
  3. 00:05/collections/bags · 9 scripts · 5 hostsok
  4. 00:09/product/waxed-canvas-field-bag · added to cartok
  5. 00:13/cart · axe-core · 2 findingsserious
  6. 00:18/checkout · card fields in provider iframeok
  7. 00:19/checkout · 21 script families · 13 outside hostsok
  8. 00:19new tag not in inventory: evil.skimmer.example/c.jsnew
  9. 00:41confirming with a second scan…wait
  10. 01:02still present · alert to ownerconfirmed
22pieces of code
13outside companies
8accessibility problems
Payment pageconfirmed, from alerts@storesweep.app

A new piece of code is on your payment page that was not there last week: evil.skimmer.example/c.js. Your browser refused to load it. Find out who added it.

Why this matters

This is happening to stores your size.

These numbers come from published reports, and the source is named beside each one.

  1. 5,000+

    lawsuits in 2025 over websites that shoppers with disabilities could not use. About seven in ten targeted online stores.

    UsableNet, 2025

  2. 64%

    of the businesses sued make under $25 million a year. Most of them are small stores.

    UsableNet, 2026

  3. 171

    days that card stealing code typically sits on a checkout before anyone notices. The store usually hears about it from its bank, after the damage is done.

    Gemini Advisory

  4. 2025

    is the year a dated list of the code on your payment page stopped being optional. Your card processor's rules now ask for that list, and for someone to check it. We keep it for you.

    PCI SSC, PCI DSS v4.0.1

The store that finds out in a week is in a very different position from the one that hears it from its bank. Every check we make is dated and kept. When someone asks what was on your payment page, or what you did about a problem and when, you answer with a record instead of a memory.

How it works

A robot shopper visits your store every week.

It does what a customer does, right up to paying. Then it writes down everything it saw.

  1. 01

    Shops your store

    The home page, a category, a product, one item in the cart, then the checkout. It never types anything and never buys, and it always says who it is: StoreSweepBot.

  2. 02

    Writes down what it sees

    Every piece of code on your payment page, and every barrier for shoppers with disabilities.

  3. 03

    Checks twice

    Anything new gets a second look within the hour. You only hear about it if it is still there.

  4. 04

    Emails you, keeps the record

    One email saying what changed. Your yes or no is saved with a date, and the evidence pack is built from those decisions.

Pages from a StoreSweep evidence pack. The cover reports 21 script families, 17 authorized, 1 awaiting review, and 8 open accessibility findings. A second page lists each script with who approved it and when.
This is the record, for a made up store. Every line on it came from a decision somebody made. Read the whole thing.

Half one · Card securityPCI DSS 6.4.3 and 11.6.1

Whose code is on your payment page.

Since 2025 your card processor expects you to keep a list of every piece of code on your payment page and why it is there. We keep that list for you, and check every week that nothing was added behind your back.

  • Every piece of code on the page, including any your browser blocked. That it appeared at all is the warning.
  • Every outside company whose code runs on the page, named.
  • Your security settings, and how the card box is built: a frame from your processor, a redirect, or fields on your own page.
  • The form your processor asks for about how often you check, filled in for you.

Half two · AccessibilityWCAG 2.1 AA

Who can't get through your checkout.

Blind shoppers use screen readers, and others cannot use a mouse or read faint text. When your store stops them you lose the sale, and those barriers are the basis of most of the 5,000 lawsuits above. We test the whole path to checkout every week with the same tool the auditors use.

  • Photos with no description, form fields with no label, faint text, and buttons a keyboard cannot reach.
  • A new serious problem on the cart or the checkout emails you the same day. A barrier at checkout is a lost sale.
  • Your fixes are recorded, with the date, the week they take effect.
  • What a machine cannot judge is listed separately, so a specialist knows where to start.

The math

$65 a month is the smallest number in this comparison.

Move the slider to your monthly orders. The costs are published figures applied to your store, so treat them as a comparison rather than a prediction.

600

3,420 customer cards would go through a hijacked checkout in the 171 days it typically takes to notice.

  • One card theft incident, low end$196,000

    The investigation your bank orders runs $25k to $200k, and replacing each stolen card costs $50 to $90, before fines and lawyers. Range at this volume: $196,000 to $507,800.

  • One accessibility lawsuit$25,267

    Settling runs $5k to $25k and a lawyer to answer it $3k to $15k, and then you fix the site on a deadline. Bigger stores land at the higher end of that range.

  • A year of StoreSweep$650

    Weekly checks, an email the same day something changes, the dashboard and the evidence pack.

At that volume, the cheap end of one incident would pay for about 302 years of StoreSweep. What you are buying is finding out in about seven days instead of 171, with a dated record of every check in between.

Sources: Gemini Advisory for how long skimmers go unnoticed, published PCI forensic and card replacement ranges, reported ADA settlement and defence ranges, and UsableNet's 2025 filings. StoreSweep does not prevent a lawsuit or a theft, and none of this is legal or financial advice.

Pricing

$650 a year. One lawsuit starts at twelve times that.

Annual is two months free.

  • Free scan

    One look at one store.

    $0
    no card, no account
    Stores
    1 per scan
    Per day
    2 scans per email
    Same store
    Once a week
    • How many outside scripts run where cards are typed
    • How many accessibility problems, and how serious
    • One named example of each
    • Names, fixes and alerts come with a plan
    Get a free scan
  • Most stores

    Starter

    One store, checked every week.

    $650/ year
    two months free
    Stores
    1
    Scans
    Weekly
    • Payment page code and accessibility
    • An email the same day, plus a weekly summary
    • Dashboard and dated evidence pack
    • Your full history, kept 90 days if you cancel

  • Pro

    Up to five stores, scanned daily.

    $1,490/ year
    two months free
    Stores
    5
    Scans
    Daily
    • Everything in Starter
    • Checked every day, not every week
    • An evidence pack every quarter

You pay on our secure checkout, processed by Stripe, then create your login and name your store. The first check starts the moment you do. Your card number goes straight to Stripe and never touches our servers.

Both halves, or one?

Pick one and the plans above follow.

Almost every store takes both. Code that steals card numbers and a checkout a shopper cannot use are different problems, and neither one waits while you deal with the other.

Running stores for clients? Agency plans cover 25 or 100 stores, with reports in your own branding, from $449 a month. Talk to us.

Not sure which plan? Ask us anything. A person answers, usually the same day.

Questions

Common questions.

What am I actually paying for?

Two things. Someone looking at your store every week, for the code on your payment page and for the barriers that stop shoppers with disabilities. And a dated record of every look, every change, and every decision you made about it. The first tells you fast. The second is what you hand over when your bank, your processor or a lawyer asks what you knew and when.

Does this satisfy my card processor's PCI rules?

It gives you the two records those rules ask for (requirements 6.4.3 and 11.6.1): a list of every piece of code on your payment page with who approved it and why, and a dated log of changes, checked every week. Your yearly questionnaire is still yours to sign, but the questions about your payment page now have an answer you can show rather than one you have to remember.

Does this make my store accessible?

Automated testing finds a real share of accessibility problems, not all of them, and be wary of anyone who says otherwise. What it does do is catch the common ones every week, record what you fixed and when, and list what needs a person to judge. If a demand letter ever arrives, a dated history of finding and fixing problems is a very different starting point from a first look after the fact.

How fast will I hear about a problem?

The same day for anything on the payment page or a new serious barrier at checkout, once a second look within the hour confirms it. Everything smaller waits for the weekly summary. We never email you after a single look, so an email from us means something real.

Do you place orders or change anything on my store?

Never. The bot adds one item to the cart with your own button, opens the checkout page and stops. It types nothing, submits nothing and changes nothing. It always says who it is, and everything it does is written up at /bot.

What if my store blocks bots?

Then we tell you, and we tell you exactly what to allow. Our bot never pretends to be a person, so letting a named bot through is a one-line change for most stores.

What happens after I pay?

You pay on our checkout page, with the card taken securely by Stripe. Straight after, you choose a password and type your store's address, and the first check starts the moment you press the button. It usually takes under half an hour, and we email you when it is done. From then on you sign in at any time to see every check, alert and record.

Can I cancel?

Any time, from your account. Monitoring runs to the end of what you paid for, and your records stay available for 90 days after that so you can still download a pack.

Start watching your store today.

Choose a plan, pay, and tell us your store on the next page. The first check runs straight away, and from then on you hear from us the day something changes.

Choose your plan

From $39 a month, or two months free on annual. Cancel any time. Payments are processed by Stripe.

Choose your plan

Free checkout scan

The bot scans your store now, the way a shopper would, and the report reaches your inbox in about half an hour.

Free. No card, no account. Up to 2 scans a day per email, and the same store once a week. We use your details to send the report: see our privacy policy.