Black Friday is 27 November this year, and most e-shops have known that since summer. The problem usually sits somewhere else. When the first wave of orders arrives, the things postponed during the year show up: slow pages, an unpatched plugin, a disk that is almost full, or a payment gateway that fails at the moment you need it most.
We have three weeks left before the sale. That is enough for everything that matters, and it is no longer enough for a large rebuild. That is why the steps below are split by date.
By 13 November: the basics
First, be clear about what the e-shop runs on and who is responsible for what. Then work through these points:
- Updates. The core system (WordPress, WooCommerce, Odoo, or a custom build), plugins, themes, and the PHP version. Unpatched plugins are the most common way into an e-shop. See also our article on critical PHP vulnerabilities (PHP2Shell).
- Backups and a restore test. A backup you have never restored is only an assumption. Restore it in a test environment and measure how long it takes. More in Backups and ransomware protection.
- Capacity. Free disk space, database size, memory limits, and the hosting limit on concurrent connections.
- Certificates and domains. SSL certificate expiry, domain expiry, and DNS records. It sounds trivial, and an expired certificate on Black Friday happens every year.
By 20 November: speed, load, and security
Speed
Measure the e-shop on a phone, not only on a computer. Most purchases during a sale happen on a phone. Look at image size, cache settings, unused plugins, and external scripts that fire dozens of requests. Removing three things nobody uses is often enough to make the page noticeably faster.
Load test
The homepage is only the start. Walk the whole purchase path: search, filter, cart, coupon, payment, and the order confirmation. Simulate several times your normal traffic. Tools such as k6 exist for this, and a well set script can do a meaningful test too. Test on a copy, not on the live e-shop in the middle of the day.
Security
Bot and fraud activity rises during sales. Check:
- Access. The list of administrator accounts, two-factor sign-in, and strong passwords. Remove accounts that belonged to former suppliers.
- Bot protection. Limits on login attempts and on adding items to the cart, or a web application firewall (WAF).
- Payments. Card data should never pass through your server. A payment gateway has to process the payment.
- Email. SPF, DKIM, and DMARC set correctly. During Black Friday customers receive a lot of fake email in the name of e-shops, and you want yours to be trusted.
The week before the sale: freeze changes
From 23 November, do not deploy new features or large design changes. Every new thing is a risk, and there will be time for improvements after the sale. Test one last time:
- every coupon and discount rule,
- stock and price synchronisation,
- confirmation emails and invoices,
- delivery and payment methods on phone and computer.
Prepare customer support as well. Write answers in advance for the questions you hear most (delivery, returns, order status). A well set AI assistant on the site can answer routine questions and free you up while you deal with real problems.
On the day: monitoring and a plan B
- Turn on availability monitoring and alerts to a phone, not only to email.
- Decide who is on the phone that day and who can act on the server.
- Keep the hosting and payment gateway contacts at hand.
- Prepare a plan B: a maintenance page, a way to switch off heavy features for a while (search, for example), and a procedure to restore the latest backup.
After the sale
After Black Friday, go through the logs and the statistics. When was the peak? Which page was slowest? What could have been automated? Write it down. You will need it for the Christmas season and again next year.
If something still goes wrong despite the preparation, see the first 24 hours after a website or e-shop is hacked.
Quick checklist
| Area | Done? |
|---|---|
| CMS, plugin, and PHP updates | ☐ |
| Backup and a tested restore | ☐ |
| Server and disk capacity | ☐ |
| SSL certificate and domain | ☐ |
| Mobile speed test | ☐ |
| Load test of the purchase path | ☐ |
| Administrator accounts and 2FA | ☐ |
| Bot protection | ☐ |
| SPF, DKIM, DMARC | ☐ |
| Change freeze from 23 November | ☐ |
| Monitoring and someone on the phone | ☐ |
| Plan B | ☐ |
How we can help
We handle e-shop development and care, servers, and security together. If you want, we will look at your e-shop and tell you what we would fix first. Write to us.
Sources
- Sale calendar: in 2026 Black Friday falls on Friday 27 November.