\n \n
\n Disclaimer:<\/strong> The information provided on this page is for general guidance purposes only. While we aim to share accurate and up-to-date recommendations, all implementations are carried out at your own risk. We are not liable for any issues, damages, or losses that may arise from applying the information provided.\n <\/p>\n\n \n If you prefer professional assistance or want to ensure everything is implemented correctly and securely, our team is available to help. Feel free to explore our services or get in touch for expert support.\n <\/p>\n\n<\/div>\n\n\n\n
<\/span>Who Is This Guide For?<\/strong><\/span><\/h2>\n\n\n\n\nZenCart store owners managing their own hosting environment<\/li>\n\n\n\n Developers maintaining ZenCart stores for clients<\/li>\n\n\n\n Anyone who has recently migrated to ZenCart or is setting up a new store<\/li>\n\n\n\n Store owners who haven’t reviewed their security setup in 12+ months<\/li>\n<\/ul>\n\n\n\n<\/span>Security Checklist at a Glance<\/strong><\/span><\/h2>\n\n\n\nUse the table below as a quick reference. We’ll cover each step in detail throughout this guide.<\/p>\n\n\n\n
Note: We highly recommend getting a ZenCart developer like Numinix.<\/p>\n\n\n\nSecurity Step<\/strong><\/td>Priority<\/strong><\/td>Difficulty<\/strong><\/td>DIY or Dev?<\/strong><\/td><\/tr><\/thead>Keep ZenCart Updated<\/a><\/td> Critical<\/strong><\/td>Easy<\/td> Dev Recommended<\/td><\/tr> Change Admin Directory Path<\/td> Critical<\/strong><\/td>Medium<\/td> Dev Recommended<\/td><\/tr> Enable SSL <\/a>\/ HTTPS<\/td> Critical<\/strong><\/td>Medium<\/td> Dev Recommended<\/td><\/tr> Use Strong Passwords & 2FA<\/td> High<\/td> Easy<\/td> DIY<\/td><\/tr> Set File Permissions Correctly<\/td> High<\/td> Medium<\/td> Dev Recommended<\/td><\/tr> Disable Directory Listing<\/td> High<\/td> Easy<\/td> DIY \/ Dev<\/td><\/tr> Install a Web Application Firewall<\/td> High<\/td> Medium<\/td> Dev Recommended<\/td><\/tr> Regular Backups<\/a><\/td> High<\/td> Easy<\/td> Dev<\/td><\/tr> Remove Unused Plugins & Themes<\/td> Medium<\/td> Easy<\/td> DIY<\/td><\/tr> Monitor for Suspicious Activity<\/td> Medium<\/td> Medium<\/td> DIY \/ Dev<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<\/span>Step 1: Keep ZenCart and Everything Around It Updated<\/strong><\/span><\/h2>\n\n\n\nUpdate ZenCart Core, PHP, and Your Hosting Environment<\/strong><\/p>\n\n\n\nOutdated software is the number one cause of ecommerce store hacks. Always run the latest stable release.<\/p>\n\n\n\n
ZenCart releases regular updates that patch known security vulnerabilities. Running an outdated version is like leaving your front door unlocked. Attackers actively scan for stores on older versions and exploit known weaknesses.<\/p>\n\n\n\n
What you need to keep updated:<\/p>\n\n\n\n
\nZenCart core. Always install security patches as soon as they are released.<\/li>\n\n\n\n PHP version. ZenCart 2.x requires PHP 8.1 or higher. Older PHP versions are no longer receiving security patches.<\/li>\n\n\n\n MySQL and MariaDB. Your database software should also be kept current.<\/li>\n\n\n\n Your hosting server OS and control panel (such as cPanel or Plesk)<\/li>\n<\/ul>\n\n\n\nPro Tip<\/strong>: Before any update, always take a full backup of your files and database. This gives you a safe restore point if anything goes wrong during the upgrade process.<\/p>\n\n\n\n<\/span>Step 2: Change the Default Admin Directory Path<\/strong><\/span><\/h2>\n\n\n\nRename Your \/admin Folder<\/strong><\/p>\n\n\n\nZenCart’s default admin folder is publicly known. Renaming it is one of the simplest and most effective security measures you can take<\/p>\n\n\n\n
By default, ZenCart uses \/admin as the backend URL path. Automated bots constantly crawl the web targeting this exact path, attempting brute-force logins. Renaming this folder to something unique makes your store dramatically harder to attack.<\/p>\n\n\n\n
How to do it:<\/p>\n\n\n\n
\nRename the \/admin folder on your server to something unique and hard to guess, for example \/store-manage-x7q<\/li>\n\n\n\n Update the renamed folder name in your configure.php file<\/li>\n\n\n\n Update any internal links or bookmarks you use to access the admin panel<\/li>\n<\/ol>\n\n\n\nBy default, ZenCart uses \/admin as the backend URL path. Automated bots constantly crawl the web targeting this exact path, attempting brute-force logins. Renaming this folder to something unique makes your store dramatically harder to attack.<\/p>\n\n\n\n
How to do it:<\/p>\n\n\n\n
\nRename the \/admin folder on your server to something unique and hard to guess, for example \/store-manage-x7q<\/li>\n\n\n\n Update the renamed folder name in your configure.php file<\/li>\n\n\n\n Update any internal links or bookmarks you use to access the admin panel<\/li>\n<\/ol>\n\n\n\nImportant<\/strong><\/p>\n\n\n\n\nKeep your new admin folder name confidential. Do not share it publicly or include it in any public-facing documentation.<\/li>\n\n\n\n This step is strongly recommended to be carried out by a developer if you are not comfortable editing server files.<\/li>\n<\/ul>\n\n\n\n<\/span>Step 3: Enable SSL and Force HTTPS Across Your Entire Store<\/strong><\/span><\/h2>\n\n\n\nSecure All Traffic with an SSL Certificate<\/strong><\/p>\n\n\n\nSSL encrypts data between your store and your customers. Without it, sensitive information can be intercepted in transit.<\/p>\n\n\n\n
SSL (Secure Sockets Layer) certificates encrypt the connection between your visitors’ browsers and your server. This is absolutely non-negotiable for any store that accepts payments or collects personal information. Without SSL, customer data \u2014 including payment details \u2014 can be intercepted by attackers.<\/p>\n\n\n\n
Beyond security, SSL also affects your search engine rankings. Google actively penalises sites that do not use HTTPS, meaning an insecure store will struggle to rank in search results.<\/p>\n\n\n\n
What to do:<\/p>\n\n\n\n
\nInstall an SSL certificate on your hosting account. Many hosts offer free Let’s Encrypt SSL.<\/li>\n\n\n\n Configure ZenCart to use HTTPS for both the storefront and admin panel<\/li>\n\n\n\n Set up a 301 redirect so all HTTP traffic is automatically redirected to HTTPS<\/li>\n\n\n\n Verify your SSL is working correctly using a tool like SSL Labs at ssllabs.com\/ssltest<\/li>\n<\/ul>\n\n\n\n<\/span>Step 4: Use Strong Passwords and Enable Two-Factor Authentication<\/strong><\/span><\/h2>\n\n\n\nStrengthen Admin Login Security<\/strong><\/p>\n\n\n\nWeak passwords are a leading cause of store breaches. A strong password combined with 2FA makes your admin panel far more resilient.<\/p>\n\n\n\n
Your admin account is the most sensitive access point in your entire store. A compromised admin login gives an attacker full control over your products, orders, and customer data. Strong credentials are your first and most important line of defence.<\/p>\n\n\n\n
Password best practices:<\/p>\n\n\n\n