What to check before you launch an online store.

An online store is a website that takes money, and that changes what has to be right on the first day.

The usual checks for any new website still apply, and this list covers only what a store adds. The legal points are general information from the ACCC, the ATO and business.gov.au. They are not legal or tax advice, and the rules change, so confirm them with your accountant or lawyer.

Payments and card security

The Payment Card Industry Data Security Standard, or PCI DSS, is the card industry’s set of rules for protecting card details. It applies to any organisation that stores, processes or transmits cardholder data, and merchants are named among them.

A store can hand the card step to a payment provider, either by sending the customer to the provider’s page or by embedding the provider’s form in the checkout. That keeps card numbers off your website, but it does not remove every obligation. Since April 2025, a merchant who embeds a provider’s payment form and wants to use the shortest PCI DSS self-assessment has had to confirm that their own page is protected against malicious scripts. The PCI Security Standards Council says this can be done with the merchant’s own controls or with confirmation from the provider.

• Ask your developer, in writing, whether card details ever pass through your website.
• Ask your bank or payment provider which PCI DSS self-assessment questionnaire applies to your setup.
• Remove any card surcharge from the checkout. The ACCC says businesses can no longer charge a surcharge for paying by Visa, Mastercard, American Express or eftpos card from 1 October 2026.

How prices are shown

The ACCC’s rule is that a business must show the total price as a single figure. That figure is the lowest amount a customer could pay, including taxes and any fee that is unavoidable or pre-selected. For a store selling to the public, that means GST is in the displayed price whenever you charge it.

• Delivery. A charge the customer can avoid does not have to be in the displayed price. The ACCC’s example is a store that also offers free click and collect. If paid delivery is the only way to receive an order, ask your adviser how the price should be shown.
• Fees added late. The ACCC calls it drip pricing when fees are added during checkout. Tell customers at the start which fees apply.
• Pre-ticked extras. An extra the store adds unless the customer removes it belongs in the total price.
• Sale prices. A “was” price is misleading if the item was not sold at that price for a reasonable period right before the sale.
• Mismatches. If the product page and the checkout show different prices, even by mistake, the business must sell at the lower one or stop selling the item until the price is corrected.

Refunds and returns

The usual consumer rights apply online. Products come with automatic consumer guarantees, and nothing a business says can take them away. Read your returns page against these points from the ACCC:

• It cannot say “no refunds”, or “no refunds on sale items”, or that refunds stop after a set number of days.
• You do not have to refund a customer who has changed their mind. If you offer a change of mind policy, you must follow it.
• When a product has a major problem, the customer chooses between a refund and a replacement.
• A refund goes back the way the customer paid, unless you both agree otherwise.
• You cannot send the customer to the manufacturer. The business that sold the product is responsible for resolving the problem.

business.gov.au adds that terms and conditions should be clear, accurate and easy to find. The ACCC tells shoppers to look for a phone number, a physical address and an ABN before they buy, so show all three.

GST and invoices

The ATO requires a business to register for GST once its GST turnover reaches $75,000, and to do so within 21 days. A new business that expects to reach that figure in its first year must register from the start.

If you are registered, a customer who asks for a tax invoice must be given one within 28 days, unless the sale was $82.50 or less including GST. For a sale under $1,000 it has to show, among other things, that it is a tax invoice, your business name and ABN, the date, what was sold and the GST amount.

• Check the store’s tax settings with your accountant before the first sale, including any products that are GST-free.
• Open the order confirmation the store sends and compare it with the ATO’s list.

Shipping, stock and delivery times

The ACCC says a business must not accept payment if it knows, or should know, that it cannot supply the product by the promised date or within a reasonable time. So the stock count and the delivery estimate on the site need to be true.

• Check that stock levels in the store match the shelf, and that a sale reduces the count.
• Decide what happens at zero: the product is hidden, marked out of stock, or sold on back order with an honest date.
• Test shipping costs for a near postcode, a remote one and your heaviest item.
• If a supplier ships for you, tell customers where stock comes from and how long delivery is likely to take. The ACCC asks this of businesses that use dropshipping.

Order emails

A store sends several emails for each sale: order confirmation, payment receipt, shipping notice and, sometimes, a refund notice. Trigger each one, read it on a phone, and check the sender address and the reply address. Make sure the new order notice reaches the person who packs the order.

If these emails land in spam, check the domain’s records with our free email domain check. SPF, DKIM and DMARC, explained without the jargon covers what the results mean.

Place real test orders

1. Place an order in the payment provider’s test mode.
2. Switch to live mode and buy a low-priced item with a real card, on a phone.
3. Check the money, the emails, the stock count and the entry in your accounts.
4. Pack and ship it.
5. Refund it, and confirm the refund reaches the card.
6. Try the cases that go wrong: a declined card, an out of stock item, an expired discount code.

Where to go next

If you would like a store built, or connected to your accounting and stock systems, see Websites and System Integrations.