Ecommerce platforms: operational checks before choosing

For ecommerce platforms, treat the choice as a sequence of operational gates, not a league table. Start with the route already in use, then follow the branch that matches the unresolved issue: records, evidence, tax, legal duties or operating responsibility. A route stays in contention only where its evidence supports the same test applied to the others.

If the records already exist in your current process

If the seller already holds the records needed to pass relevant gates, retain the manual route rather than treating a platform as an automatic improvement.

It remains a candidate under the same tests as the three named services. Where an existing file's format is unverified, record that as an unresolved point.

Every table entry is a statement about supplier documentation, not observed performance in a live shop. A desk review therefore cannot establish that a configured store works as described. Keep a cell marked unknown until a configured test, or a named document, supplies evidence for that gate. Apply the same UK ecommerce rule map to each route.

• Rule of thumb: Keep the manual route if its records pass the same gates.

If maintenance responsibility is the deciding gate

If maintenance responsibility is the deciding gate, compare who runs each service and who handles the supporting work. Shopify and Square keep their platforms running; WooCommerce core leaves hosting, patching, extensions and maintenance to the merchant.

WooCommerce core leaves the merchant to arrange hosting, TLS, backups, themes and extensions, and handle patching. Shopify and Square keep their platforms running, while the merchant remains responsible for catalogue, orders and settings. A manual workflow relies on the seller to maintain its own records and processes. For a separate cost breakdown, see the whole-life cost guide.

Square's published help pages offer lighter catalogue and exit tooling than Shopify's described product and order exports; this compares available documentation, not live-store results. Check the formats, setup work and support required for each route, and identify who will handle them before choosing.

• Rule of thumb: Check who owns the work before choosing a route.

If export evidence is the deciding gate

If published export evidence is the deciding test, Shopify Basic passes the documentation gates: its help pages describe product exports and separate order exports, including captured transactions.

Square Online Free documents order and fulfilment handling, while its published catalogue and exit tooling is lighter. WooCommerce core 11.1.0 documents a core product CSV tool but no packaged exit bundle.

Before signing up, confirm how product, order and customer records can leave, including the available format. Compare that with the records the seller needs to retain; switching effort often sits in the exit route. The manual option keeps records in place, although its existing file formats remain unverified.

• Rule of thumb: Require evidence for the records you need to take with you.

If VAT or checkout duties are the blocker

If VAT settings decide whether a route can proceed, require the person filing returns to check them.

Consumer-facing displayed prices must include VAT whichever route calculates them; tax software handles arithmetic, not the duty to account for VAT. The VAT gate passes only after that return-filer has reviewed the selected platform's settings.

HMRC's registration estimator on GOV.UK helps a business see what registering could mean. For distance sales, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 require pre-contract information, a cancellation route and confirmation. GOV.UK online selling guidance lists acknowledgement points the checkout must produce.

• Rule of thumb: Do not pass the VAT gate until the return-filer checks the settings.

If customer data, product safety or accessibility is unresolved

If trackers or customer records are part of the proposed setup, assess each purpose and data flow before selecting a route. Consent for analytics, pixels and chat widgets added over time needs a purpose-specific assessment. ICO guidance on PECR covers consent for these technologies.

Order, account and tracker data also engages UK data protection law, including the UK GDPR and Data Protection Act 2018, which the ICO regulates. For each flow, record who is controller and who is processor; these roles need to be identified regardless of the platform chosen.

Product safety duties depend on the product and the seller's role. In Great Britain, the General Product Safety Regulations 2005 apply where no more specific product-safety regime does. OPSS publishes safety alerts, reports and recalls for unsafe products; a withdrawal must reach open orders and customer records.

The accessibility duties link concerns an anticipatory duty under the Equality Act 2010: service providers may need to make reasonable adjustments for disabled customers. WCAG 2.2 is a technical benchmark, not proof of legal compliance. Test the chosen theme rather than relying on a supplier claim; the relevant platform themes or templates remain untested.

Before buying, check these four points:

• Rule of thumb: A gate passes only when a named document or test supports it; unknown is legitimate.

If the contract or payment path is still unclear

If terms or money movement cannot yet be described precisely, pause and read the contract rather than relying on a sales page.

Shopify's terms make the merchant responsible for its store, goods and customer relationship. Square and WooCommerce divide responsibility differently, so their governing terms, not sales claims, determine the deal.

Where a platform holds customer money for onward transfer, that may be a regulated payment service under the Payment Services Regulations 2017 and fall within the FCA's perimeter. Get specialist legal advice on the exact flow, not an account manager's assurance. For WooCommerce, name the configured gateway, such as Stripe or PayPal, and trace authorisation, capture, refund and settlement; gateway terms matter. See the payment gateway options.

NCSC supplier assurance questions suit any candidate that would hold customer data. The planning template covers data roles, service levels and exit, where switching costs usually hide. Write down each duty before signing rather than inferring it from the platform's sales description.

• Rule of thumb: Trace the contract and every stage of the payment before committing.

If no route clears every gate

If no platform passes every required gate, do not invent an overall winner: applying the same tests produces no single winner because each route passes some gates and remains on hold at others. Choose only after deciding which gaps can be tested and who owns each unresolved task.

For a seller seeking documented exports with little setup work, Shopify Basic may suit; Square Online Free suits card-led sellers who prefer its integrated card processing. WooCommerce core suits sellers seeking control who can manage development and ongoing technical work. These are conditional fits, not a ranked result.

A desk review without a test account cannot prove that a platform works: documented capability and a working configuration are different claims. A blank cell stays unknown until a configured test supplies evidence. Check the customer contracting party and cancellation terms, then who authorises, captures and refunds money, then controller and processor roles for every planned tracker.

Keep the manual process where it passes the same gates: a new platform is not automatically an improvement, and free software is not automatically a fit once hosting and operating responsibilities are considered. If the manual route fails a gate, identify the missing evidence or work before switching rather than assuming another route will resolve it.

• Rule of thumb: Select the route that passes your gates, not the one that sounds best.