How to start an online store: what changes once money is involved

What the guides put first

Forbes Advisor’s guide, verified on 23 September 2026, is built as nine steps: define what you will sell, choose where to sell, choose a fulfillment method, define your audience, set up your business, pick a sales platform, build the store, adjust for SEO, GEO and AEO, and open the virtual doors. The first step already points ahead. Forbes says what you sell will affect the platform you use, taxes, licensing in some situations and whether you have to manage inventory and shipping. It sorts products into physical (dropshipping included), subscriptions, services and digital.

For where to sell, Forbes compares four ways, set out in the first figure below. On delivery it names three methods. Dropshipping, it says, removes the need to pay for inventory up front, store stock and ship it yourself, and the drawback is less control over the product and the customer experience. A fulfillment service, with Amazon FBA as its example, charges a fee for picking, packing, shipping and storage. Doing it yourself means, in Forbes’s words for many new stores, boxes taking over at least one room in your home.

The guides come from different kinds of publisher. Forbes is an editor and its page carries boxes from commercial partners, so we used only its facts. Stripe sells payments, GoDaddy sells domains and site builders, and Salesforce sells software, so what each says about its own product is attributed to it here. We left platform prices and comparisons out on purpose: this page follows what changes once money comes in.

Before the first order: business form and licences

Forbes names three common structures: sole proprietorship, LLC and S-corporation. It says a sole proprietorship “rarely requires any official paperwork”, while an S-corporation needs form 2553 filed with the IRS. GoDaddy describes a sole proprietorship as an unincorporated business with a single owner who pays personal income tax on its profits, and says an LLC limits your personal liability. On the question people ask most, Forbes is direct: an LLC is not required to start an online store, but it can give you legal protections and privacy. SCORE, in an article dated 7 June 2019, does not call an LLC required either; it lists it among the questions to put to an attorney, an accountant and an insurance agent before you start, together with product liability insurance (it says you probably need it if you sell any product) and whether your state wants your business name registered and a business licence.

Licences are where the pages are least exact. Forbes says online stores also often need a license, that each state, county and municipality has different rules, and that even when you call your state or local government you might get different answers from different people. If you do not get a clear answer, it says to consult a lawyer. GoDaddy gives the same shape in one line: license requirements depend on what you sell and where your business is located. SCORE adds a separate document for stores that buy from manufacturers: a resale license is what gets a wholesale discount, and without one you pay full price.

Policies are the other thing to settle before opening. Forbes says every online store needs policy pages, that some are legally required and vary with your location and the type of product, and that shipping, return and refund policies are the usual ones. SCORE calls a solid return policy a must, and gives a case where the product decides the policy: a returned breast pump cannot legally be resold, so accepting returns on it has a cost.

Sales tax across state lines

Forbes tells the story in order. Online businesses first needed a physical presence in a state before they were subject to its sales tax. States then began to require collection whatever the seller’s location. And the Supreme Court decided South Dakota v. Wayfair, Inc., where, Forbes says, the Court ruled that customer location and sales volume would be the test. The Court’s own text, as published by Cornell’s Legal Information Institute, gives the dates: argued on 17 April 2018 and decided on 21 June 2018. Its holding is that the physical presence rule of Quill is unsound and incorrect, so the earlier decisions in Quill Corp. v. North Dakota and National Bellas Hess v. Department of Revenue of Illinois are overruled.

The same text shows what a threshold looked like in that case. South Dakota’s law applied only to sellers that, in a year, deliver more than a set dollar amount of goods or services into the state or engage in 200 or more separate transactions there. That is one state’s law, quoted as the Court describes it. Forbes says each state has a different threshold for what it calls tax nexus, and recommends a platform that includes automated sales tax compliance for new stores. It adds that third-party marketplaces handle some details such as sales tax collection, but that you have to play by each marketplace’s rules, which in many cases include letting the marketplace decide outcomes on refunds and returns. GoDaddy describes its store settings as letting you enter tax rates by hand or have them calculated from the customer’s ZIP code, which is a description of a feature, not a statement of what you owe. We did not read the thresholds of any state other than South Dakota, or any rates.

The sources disagree, and the reason is a date. SCORE’s article, dated 7 June 2019, says that “In most cases” you only need to collect sales tax from customers in the state where you have a physical location, and that the government and the Supreme Court are looking into the issue. The Court had decided the case on 21 June 2018, almost a year before that article. Forbes, verified in September 2026, and the decision itself say otherwise. The date at the head of a page is the date it was written, and not necessarily the date its facts were last true.

The shipping promise

The FTC’s business page on prompt delivery says the Mail or Telephone Order Merchandise Rule applies to orders placed by phone, fax or the Internet. By law, it says, you must have a reasonable basis for stating that a product can be shipped within a certain time. If your advertising does not clearly and prominently state a shipment period, you must have a reasonable basis for believing you can ship within 30 days.

The page then sets out what happens when you cannot, laid out in the second figure. You notify the customer, give a revised shipment date and explain the right to cancel and get a full and prompt refund. A definite delay of up to 30 days can be treated as agreed if the customer is silent; a longer or indefinite delay, and any second or later delay, needs the customer’s consent, written, electronic or verbal, and without it the money is refunded promptly. You may also cancel an order you cannot fill in good time, with prompt notice and a prompt refund. The page says the notice can go by e-mail, fax or phone and that keeping a record of it is a good idea.

It also says you can change your shipment promises up to the point the customer places the order, if you reasonably believe you can ship by the new date, and that the updated information overrides the earlier promises. The FTC page is old: it estimates what consumers spent online in 2008, and we used it only for the rule, which it describes in the present tense. The Forbes, Stripe, SCORE, GoDaddy and Salesforce pages we read do not mention the rule or its 30-day period; we searched their text for both. Forbes does say shipping policies are among the common policy pages, and GoDaddy describes free, flat-rate and weight-based shipping settings, but neither connects them to a legal time limit.

Taking cards: who serves the payment page

Forbes explains the plumbing in one sentence: you need a payment processor to accept payments, and those processors use payment gateways to encrypt and manage the data. Among the criteria for choosing a platform it lists security and compliance, such as PCI-DSS, which it says credit card companies require. That is the only mention of PCI among the five guides we read, and it is one line long. SCORE says most credit card processing companies charge a per-transaction fee and then a percentage based on the cost of the items sold. Stripe says some processors, itself among them, charge only transaction fees, with no monthly fee at sign-up.

The detail is at the PCI Security Standards Council. In a blog post of 28 February 2025 about the questionnaire called SAQ A, under PCI DSS v4.0.1, the Council says a merchant must confirm that its site is not susceptible to attacks from scripts. That criterion, it says, applies only to e-commerce merchants whose webpage includes the provider’s embedded payment page or form, for example in an inline frame. It does not apply to a merchant whose page redirects the customer to the provider, by an HTTP 30x redirect, a meta tag or JavaScript, or to one that fully outsources payment, for example by emailing a link to the provider’s site. The third figure sets these cases side by side.

The Council says the confirmation can come from techniques such as, but not limited to, those detailed in requirements 6.4.3 and 11.6.1, or from a confirmation by a compliant provider that its solution protects the payment page from script attacks. It tells merchants to work closely with their provider and to check with their acquirer or the payment brands whether SAQ A is the right questionnaire for them. An older FAQ, written for an earlier version of the standard, says that if any element of a payment page originates from the merchant’s website, the implementation is not eligible for SAQ A, and that hosted pages and pages in an iframe resist the transparent theft of card data as it is entered, while Direct Post and JavaScript forms do not, and it adds that an attack against a redirect or an iframe is viable but, in the payment brands’ experience, is detected before significant volumes of card data are lost. The pages we read do not say which questionnaire a given store needs, so we do not say either.

What it costs, what it earns, and what we did not read

On cost the sources split. Forbes says most domain names will only cost $5 to $20 per year, though prices vary with the registrar, a price it states and we did not measure. Asked whether you can start for free, it answers yes, but that it is generally not a good idea, because a custom domain, payment processor fees, LLC fees and hosting plans with larger product limits add costs. Stripe describes a zero-budget start: a subdomain from whichever service hosts the store instead of a custom domain, a payment processor with only transaction fees, and dropshipping, print on demand or affiliate links to a brand’s store for a commission. It says each trades larger profit margins for lower risk, and that a brand-new store with a subdomain and no reviews can look suspicious.

SCORE lists what to cost per product: the wholesale price, dropshipping fees, shipping, packing material, card fees, the time to pack and the costs of the site. It warns that the middleman companies in dropshipping need to make money too, so the price of each product rises. Forbes, by contrast, calls dropshipping one of the easiest online businesses to start because it needs no inventory or shipping, and that is the contrast to hold on to: Stripe says dropshipping, print on demand and affiliate links trade larger profit margins for lower risk, and SCORE says the middleman companies raise the price of each product; the pages we read give no earnings figure. For the last step, Forbes suggests taking a short break after you publish and coming back in about an hour to check that everything worked.

This page is written about the United States. The pages we read do not cover value-added tax or European data rules, the tax thresholds of states other than South Dakota, or tax rates. We did not read platform price pages, so there is no plan comparison here. The pages we read do not say how long it takes to open a store in total or how much one earns, so we give no figure for either. We tested nothing and opened no store; every statement above belongs to the source named beside it.