hello@kootenaymade.ca
Castlegar, BC. Serving the Kootenays and beyond.
6 min
Key takeaways
- Wix, Squarespace and Shopify host your site and watch their own servers around the clock.
- All three include SSL, and each says its built-in payments meet PCI DSS.
- Your password, two-step verification and the list of people with access stay with you.
- Every app or embed you add is another company with a way in.
- Your domain and email are separate accounts, and they need the same care.
On this page
Is Wix secure?
Wix hosts your site and watches its platform around the clock, which is a real strength. It turns on HTTPS for every new site and says its payments meet PCI DSS Level 1. Squarespace and Shopify make similar claims. What no platform can do is guard your login. Your password, two-step verification and access list stay with you.
Wix says it hosts sites on Amazon and Google cloud data centres. It says a security team watches the platform 24 hours a day, every day of the year. It scans its systems for weak spots on a regular basis and has outside testers try to break in.
For card payments, Wix says it is a PCI DSS Level 1 service provider and merchant. PCI DSS is the card industry’s rulebook for anyone who handles card details. An outside company checks Wix against it every year. On your own account, Wix lets you turn on two-factor authentication. That part is your call.
Is Squarespace safe?
Squarespace makes similar claims. Every domain you connect gets a free SSL certificate. A security operations centre watches for threats 24 hours a day. Card details go straight to the payment company, so Squarespace never holds them. Two-factor sign-in is there for you to turn on.
Squarespace says its own payments and its partners Stripe, PayPal and Square all meet the PCI standards. If you are weighing a move off Squarespace for other reasons, my guide to Squarespace alternatives covers it.
What about Shopify?
Shopify says it is certified Level 1 PCI DSS compliant, and that this covers every store by default. It has SOC 2 Type II and SOC 3 reports from outside auditors. Every domain you add gets a free certificate. You must turn on two-step sign-in to use Shopify Payments.
Each staff member on a Shopify store sets up two-step on their own account. The store owner cannot do it for them. If several people run your store, ask each one to turn it on.
Who handles what on a website builder?
The platform handles the servers, the certificate and its own checkout. You handle the accounts. That split is the same on Wix, Squarespace and Shopify, and the table below shows where each piece sits.
| What is being compared | The platform | You |
|---|---|---|
| Hosting and servers | The platform runs them | Nothing to install or update |
| SSL certificate | Included free on all three | Connect your domain properly |
| Card payments | Built-in checkout meets PCI DSS | Use the built-in checkout where you can |
| Your login | Offers two-step verification | Turn it on, with a password you use nowhere else |
| Who has access | Lets you add and remove people | Remove anyone who no longer needs it |
| Apps and embeds | Offers an app market | Each app is another company with access |
| Domain and email | May sell you a domain | The registrar login, renewal and mail records |
Apps deserve a second look. An app from a platform’s market is written by another company. When you install it, you give that company some access to your site. Remove the ones you no longer use.
What happened with Squarespace domains in 2024?
In July 2024, at least a dozen organizations with domains at Squarespace had their websites taken over. Most were cryptocurrency businesses. Squarespace had bought about 10 million domains from Google Domains a year earlier. Squarespace later blamed a weakness in sign-in through other accounts, and said it fixed it within hours.
KrebsOnSecurity reported the takeovers happened between July 9 and July 12. Outside researchers linked them to moved accounts that owners had not set up yet. They urged owners to turn on multi-factor sign-in and remove users they did not need. Squarespace disagreed with part of that finding. It said the move from Google made no change to multi-factor sign-in.
The lesson is about the account around the website. A domain is only as safe as the login that controls it. My guide to who owns your website and domain shows how to check whose name it is in.
The platform runs the servers. The logins are yours.
What does the owner still look after?
Five things stay with you on any platform. Your password, two-step verification on every key account, the list of people with access, the apps you add, and your domain and email. Most of them take an afternoon to sort out once.
- A password you use nowhere else, kept in a password manager.
- Two-step verification on the platform account, your email and your domain registrar.
- A short list of people with access. Remove past staff and old designers.
- Only the apps and embeds you still use. Delete the rest.
- A domain in your name, on auto-renew, with mail records set up.
I build custom sites, and how I split that work is in my guide to small business website security. The five things above stay yours on any site. If your business email is landing in junk, my guide on why business emails go to spam covers the mail records.
Sources and further reading
- Wix security measures overview, Wix Help Center
Read October 23, 2026. HTTPS on every new site, round-the-clock security monitoring, regular vulnerability scans, and optional two-factor authentication for owners.
- Security of Wix’s billing services and PCI compliance, Wix Help Center
Read October 23, 2026. Wix says it is a PCI DSS Level 1 service provider and merchant, assessed every year, and that every Wix site is PCI compliant by default.
- Security, Squarespace
Read October 23, 2026. Free SSL on added domains, optional two-factor authentication, a security operations centre watching 24/7, and PCI-DSS compliant payment integrations.
- Privacy and security at Squarespace, Squarespace Help Center
Read October 23, 2026. Squarespace Payments and its payment partners Stripe, PayPal and Square meet the applicable PCI standards.
- Security, Shopify
Read October 23, 2026. Shopify says it is certified Level 1 PCI DSS compliant and has SOC 2 Type II and SOC 3 reports.
- TLS certificates for your domains, Shopify Help Center
Read October 23, 2026. TLS certificates are free for every domain added to Shopify.
- Two-step authentication, Shopify Help Center
Read October 23, 2026. Two-step authentication is required to use Shopify Payments, and each staff member turns it on for their own account.
- Researchers: weak security defaults enabled Squarespace Domains hijacks, KrebsOnSecurity
July 15, 2024, updated July 23, 2024, read October 23, 2026. Reports the July 2024 domain hijacks, the researchers’ findings, and Squarespace’s later statement.
Frequently asked questions
Is Wix safe for taking card payments?
Wix says it is a PCI DSS Level 1 service provider and merchant, assessed every year by an outside company. It says every Wix site meets PCI rules by default. That covers the checkout Wix runs. A payment tool you embed from another company is that company’s job.
Do I need to buy an SSL certificate for Squarespace or Shopify?
No. Squarespace adds a free SSL certificate to every domain connected correctly. Shopify gives every domain added to a store a free TLS certificate. Wix turns on HTTPS for every new site.
Can someone break into my Wix or Squarespace site?
The platforms run and watch their own servers. Anyone who gets your password can still log in as you. Turn on two-step verification, use a password you use nowhere else, and keep the list of people with access short.
Is Shopify more secure than Wix or Squarespace?
All three say their built-in payments meet PCI DSS. I would not choose between them on this point. Choose on what you sell and how you want to work, then lock down your own login on whichever you pick.
What should I do first?
Turn on two-step verification on your platform account today. Then do the same on your email and your domain registrar. Those three logins can reset almost everything else.
Related pages
Kootenay Made Digital
I build websites, local presence, and calm AI setups for Kootenay small businesses. Prices are published, and the work is built to make you easier to find and easier to choose.
