WooCommerce admin sessions

Nobody on a platform side is linking your stores, because there is no platform: the site is yours and so is the database under it. That freedom moves the risk from a platform decision onto your own sessions.

What does watch is the payment gateway, the hosting and the security plugin sitting in front of the admin panel.

An agency holding twenty client sites holds twenty admin logins, and one browser carrying all of them is one stolen session away from all twenty. A stolen admin cookie needs no password to reach the checkout settings.

A profile per store keeps the cookies, the saved logins and the second step codes in folders that never meet.

Creating products through the admin panel at machine speed is read by a security plugin as a compromised account rather than as a busy owner. The plugin does not ask who you are before it locks the panel for an hour.

The count is kept per profile per day, warned before the end and turned red at it, with the counter named.

A store that went live this week starts at a fifth of the daily ceiling and reaches the full number on the seventh day.

The ramp is a fraction of the scenario ceiling, so there is one number to reason about rather than two.

Security plugins watch where an administrator signs in from, and an address the site has never seen brings a second check or a lockout. A team spread over three countries meets this every Monday morning.

Pinning a profile to one exit address makes the admin sessions look like the same person at the same desk, which is what they are.

There is no marketplace policy here, and the documents that decide are the payment gateway's terms and your hosting agreement. Your own privacy notice belongs on that list too, because the store collects the data itself.

Read them at the source, because a gateway can close a merchant account on its own terms. We point at them rather than paraphrase them.