{"id":13009,"date":"2026-10-07T17:42:40","date_gmt":"2026-10-08T00:42:40","guid":{"rendered":"https:\/\/www.numinix.com\/blog\/?p=13009"},"modified":"2026-10-07T17:42:42","modified_gmt":"2026-10-08T00:42:42","slug":"magento-security-audit-checklist","status":"publish","type":"post","link":"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/","title":{"rendered":"Magento Security Audit Checklist: 20 Things to Check Before You Get Hacked"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Magento and Adobe Commerce stores are attractive targets. They handle payment details, customer accounts, and order data, and they run on a large ecosystem of extensions that vary widely in quality. Attackers know this, and automated scanners probe thousands of stores every day looking for outdated versions, exposed files, and weak admin logins.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The good news is that most successful attacks exploit problems that a routine audit would have caught. This checklist walks through 20 areas to review, grouped by where they sit in your store. You can work through it yourself, hand it to your developer, or use it to check the work of whoever currently maintains your site.<\/p>\n\n\n\n<style>\n.nx-cta{--nx-navy:#0b2a4a;--nx-blue:#1a73d9;--nx-blue-dark:#14589f;--nx-sky:#bfe3fa;--nx-pale:#e6f4fd;--nx-line:#a9d3f0;box-sizing:border-box;max-width:720px;margin:2.5rem auto;border-radius:8px;overflow:hidden;font-family:inherit;line-height:1.5;border:1px solid var(--nx-line);text-align:center}\n.nx-cta *,.nx-cta *::before,.nx-cta *::after{box-sizing:border-box}\n.nx-cta .nx-top{background:var(--nx-sky);color:var(--nx-navy);padding:34px 32px 32px;text-align:center}\n.nx-cta h3.nx-h{margin:0 auto 10px;padding:0;color:var(--nx-navy);font-size:1.65rem;line-height:1.2;font-weight:700;max-width:520px;text-align:center}\n.nx-cta p.nx-p{margin:0 auto 24px;padding:0;color:#1d3f63;font-size:1.02rem;max-width:520px;text-align:center}\n.nx-cta a.nx-btn{display:inline-block;min-width:260px;padding:14px 26px;background:var(--nx-blue);color:#fff!important;font-weight:700;font-size:1rem;text-align:center;text-decoration:none!important;border-radius:6px;border:2px solid var(--nx-blue);transition:background .15s ease,border-color .15s ease}\n.nx-cta a.nx-btn:hover{background:var(--nx-blue-dark);border-color:var(--nx-blue-dark)}\n.nx-cta a.nx-btn:focus-visible,.nx-cta a.nx-tile:focus-visible{outline:3px solid var(--nx-blue);outline-offset:2px}\n.nx-cta .nx-bottom{display:grid;grid-template-columns:1fr 1fr;background:var(--nx-pale)}\n.nx-cta a.nx-tile{display:block;padding:22px 24px;text-align:center;color:var(--nx-navy)!important;text-decoration:none!important;transition:background .15s ease}\n.nx-cta a.nx-tile+a.nx-tile{border-left:1px solid var(--nx-line)}\n.nx-cta a.nx-tile:hover{background:#d3ecfb}\n.nx-cta .nx-tt{display:block;font-weight:700;font-size:1.05rem;color:var(--nx-navy);text-align:center}\n.nx-cta .nx-td{display:block;font-size:.92rem;color:#3d5a78;margin-top:3px;text-align:center}\n.nx-cta .nx-tl{display:inline-block;margin-top:10px;font-weight:700;font-size:.95rem;color:var(--nx-blue-dark);border-bottom:2px solid var(--nx-blue)}\n@media (max-width:560px){.nx-cta .nx-top{padding:26px 20px}.nx-cta h3.nx-h{font-size:1.4rem}.nx-cta a.nx-btn{display:block;min-width:0}.nx-cta .nx-bottom{grid-template-columns:1fr}.nx-cta a.nx-tile{padding:18px 20px}.nx-cta a.nx-tile+a.nx-tile{border-left:0;border-top:1px solid var(--nx-line)}}\n@media (prefers-reduced-motion:reduce){.nx-cta a.nx-btn,.nx-cta a.nx-tile{transition:none}}\n<\/style>\n<section class=\"nx-cta\" aria-labelledby=\"nx-cta-title\"><div class=\"nx-top\"><div id=\"ez-toc-container\" class=\"ez-toc-v2_0_88 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#Let_our_Magento_team_audit_your_store\" >Let our Magento team audit your store<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#How_to_use_this_checklist\" >How to use this checklist<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#Part_1_Versions_and_patching\" >Part 1: Versions and patching<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#1_Confirm_your_Magento_version_and_patch_level\" >1. Confirm your Magento version and patch level<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#2_Apply_security_patches_quickly\" >2. Apply security patches quickly<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#3_Check_PHP_and_server_software_versions\" >3. Check PHP and server software versions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#4_Make_sure_supporting_services_are_not_exposed\" >4. Make sure supporting services are not exposed<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#Part_2_Admin_access_and_accounts\" >Part 2: Admin access and accounts<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#5_Change_the_default_admin_URL\" >5. Change the default admin URL<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#6_Enforce_two-factor_authentication\" >6. Enforce two-factor authentication<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#7_Audit_admin_users_and_roles\" >7. Audit admin users and roles<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#8_Review_API_integrations_and_tokens\" >8. Review API integrations and tokens<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#Part_3_Server_and_file_system\" >Part 3: Server and file system<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#9_Check_file_permissions_and_ownership\" >9. Check file permissions and ownership<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#10_Look_for_exposed_sensitive_files\" >10. Look for exposed sensitive files<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#11_Run_in_production_mode\" >11. Run in production mode<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#12_Enforce_HTTPS_and_security_headers\" >12. Enforce HTTPS and security headers<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#Part_4_Extensions_and_code\" >Part 4: Extensions and code<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#13_Build_an_extension_inventory\" >13. Build an extension inventory<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#14_Check_third-party_code_for_known_vulnerabilities\" >14. Check third-party code for known vulnerabilities<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#15_Look_for_modified_or_unexpected_files\" >15. Look for modified or unexpected files<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#Part_5_Payment_pages_and_customer_data\" >Part 5: Payment pages and customer data<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#16_Review_scripts_on_checkout_and_payment_pages\" >16. Review scripts on checkout and payment pages<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#17_Search_the_database_for_injected_code\" >17. Search the database for injected code<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#18_Protect_customer_accounts\" >18. Protect customer accounts<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-26\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#Part_6_Monitoring_and_recovery\" >Part 6: Monitoring and recovery<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-27\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#19_Put_a_web_application_firewall_in_front_of_the_store\" >19. Put a web application firewall in front of the store<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-28\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#20_Verify_logging_alerts_and_tested_backups\" >20. Verify logging, alerts, and tested backups<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-29\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#How_to_prioritize_what_you_find\" >How to prioritize what you find<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-30\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#How_often_should_you_audit\" >How often should you audit?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-31\" href=\"#\" data-href=\"https:\/\/www.numinix.com\/blog\/magento-security-audit-checklist\/#When_to_bring_in_a_professional\" >When to bring in a professional<\/a><\/li><\/ul><\/nav><\/div>\n<h3 class=\"nx-h\" id=\"nx-cta-title\"><span class=\"ez-toc-section\" id=\"Let_our_Magento_team_audit_your_store\"><\/span>Let our Magento team audit your store<span class=\"ez-toc-section-end\"><\/span><\/h3><p class=\"nx-p\">We review your code, extensions, server, and admin access, then give you a written report and fix what we find.<\/p><a class=\"nx-btn\" href=\"https:\/\/www.numinix.com\/security-audit-for-magento-1290\">Book a Magento security audit<\/a><\/div><div class=\"nx-bottom\"><a class=\"nx-tile\" href=\"https:\/\/www.numinix.com\/platform_magento\"><span class=\"nx-tt\">Magento development and support<\/span><span class=\"nx-td\">Upgrades, patching, and custom work.<\/span><span class=\"nx-tl\">See Magento services<\/span><\/a><a class=\"nx-tile\" href=\"https:\/\/www.numinix.com\/ecommerce_consulting_services\"><span class=\"nx-tt\">Ecommerce consulting<\/span><span class=\"nx-td\">Plan your platform and security with an expert.<\/span><span class=\"nx-tl\">Talk to a consultant<\/span><\/a><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_use_this_checklist\"><\/span>How to use this checklist<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Go through the items in order, and note each one as pass, fail, or unknown. Treat &#8220;unknown&#8221; as a fail until you can confirm it. Do the work on a staging copy first where a change could affect checkout, and take a full backup of files and database before you touch anything on production.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Part_1_Versions_and_patching\"><\/span>Part 1: Versions and patching<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_Confirm_your_Magento_version_and_patch_level\"><\/span>1. Confirm your Magento version and patch level<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Start by finding out exactly what you are running. Check the version in the admin footer or with <code>bin\/magento --version<\/code>, then compare it with the current supported releases listed by Adobe. Versions that no longer receive security updates cannot be made safe by other measures alone, and that includes Magento 1, which has been unsupported for years.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Apply_security_patches_quickly\"><\/span>2. Apply security patches quickly<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Adobe publishes security bulletins and patches, and some of them fix vulnerabilities that attackers begin exploiting within days. The CosmicSting vulnerability (CVE-2024-34102) in 2024 is a well-known example of a critical flaw that was widely targeted soon after disclosure. Check that every available security patch for your version is installed, and set a rule for how fast critical patches get applied.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"3_Check_PHP_and_server_software_versions\"><\/span>3. Check PHP and server software versions<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Your PHP version must be one that your Magento release supports and that still receives security fixes. Do the same for your web server, operating system, and database. An old PHP version is a common finding in audits, because upgrading it can break older extensions and so it keeps getting postponed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"4_Make_sure_supporting_services_are_not_exposed\"><\/span>4. Make sure supporting services are not exposed<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">MySQL, Redis, OpenSearch or Elasticsearch, and RabbitMQ should never answer requests from the open internet. Check which ports are reachable from outside your network, and restrict these services to localhost or a private network. Exposed search and cache servers have repeatedly led to data leaks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Part_2_Admin_access_and_accounts\"><\/span>Part 2: Admin access and accounts<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"5_Change_the_default_admin_URL\"><\/span>5. Change the default admin URL<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Moving the admin away from <code>\/admin<\/code> will not stop a determined attacker, but it removes you from the easiest automated attacks. Confirm that the admin path is custom and that it is not mentioned anywhere public, such as in a robots.txt file.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"6_Enforce_two-factor_authentication\"><\/span>6. Enforce two-factor authentication<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Two-factor authentication is built into current Magento releases, and it should be on for every admin account without exceptions. Check that no user has been excluded and that backup codes are stored securely. Stolen or guessed admin passwords are one of the most common ways attackers get in.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"7_Audit_admin_users_and_roles\"><\/span>7. Audit admin users and roles<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Open the admin user list and look for accounts you do not recognize, former staff and contractors who still have access, and shared logins. Review roles so that each person has only the permissions their job requires. A support agent rarely needs access to system configuration or to install extensions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"8_Review_API_integrations_and_tokens\"><\/span>8. Review API integrations and tokens<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">List every integration, API token, and OAuth connection. Remove the ones tied to tools you no longer use, and rotate keys for any that were shared with agencies or freelancers. Each token with broad permissions is effectively another admin password that people tend to forget about.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Part_3_Server_and_file_system\"><\/span>Part 3: Server and file system<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"9_Check_file_permissions_and_ownership\"><\/span>9. Check file permissions and ownership<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Writable code directories are a gift to attackers. In production, application code should be read-only for the web server user, with write access limited to the directories that truly need it, such as <code>var<\/code>, <code>pub\/media<\/code>, and <code>generated<\/code>. Look for files that are world-writable, and confirm the web server does not run as a privileged user.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"10_Look_for_exposed_sensitive_files\"><\/span>10. Look for exposed sensitive files<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Search for files that should never be reachable by browser: <code>app\/etc\/env.php<\/code>, <code>.git<\/code> folders, database dumps, old backups, <code>phpinfo()<\/code> pages, and log files under <code>var<\/code>. Request them from outside the server to confirm they return an error, and remove anything that does not belong in the web root.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"11_Run_in_production_mode\"><\/span>11. Run in production mode<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A store left in developer or default mode can display detailed errors and file paths to visitors. Confirm the deploy mode with <code>bin\/magento deploy:mode:show<\/code> and make sure error display is off. Error messages should be logged, not shown to customers.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"12_Enforce_HTTPS_and_security_headers\"><\/span>12. Enforce HTTPS and security headers<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Every page should load over HTTPS with a valid, current certificate, and HTTP requests should redirect. Add HSTS, and review headers such as X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Magento&#8217;s secure cookie settings should also be enabled so that session cookies are not sent over plain connections.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Part_4_Extensions_and_code\"><\/span>Part 4: Extensions and code<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"13_Build_an_extension_inventory\"><\/span>13. Build an extension inventory<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">List every installed extension, its version, its vendor, and the date it was last updated. Many stores discover modules nobody remembers installing. Disable and remove any that are unused, because unused code is still attack surface.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"14_Check_third-party_code_for_known_vulnerabilities\"><\/span>14. Check third-party code for known vulnerabilities<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Compare your inventory against vendor release notes and public vulnerability databases. Pay special attention to abandoned extensions, which will never receive a fix, and to anything installed from a source other than the official marketplace or a trusted vendor. Where you rely on Composer, run an audit on your dependencies as well.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"15_Look_for_modified_or_unexpected_files\"><\/span>15. Look for modified or unexpected files<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Compare your core files and vendor directory against a clean install of the same version, and review recently changed files in the codebase. Webshells often hide in places like <code>pub\/media<\/code>, with innocent-looking names or double extensions. A file integrity monitoring tool makes this check continuous instead of occasional.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Part_5_Payment_pages_and_customer_data\"><\/span>Part 5: Payment pages and customer data<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"16_Review_scripts_on_checkout_and_payment_pages\"><\/span>16. Review scripts on checkout and payment pages<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Card-skimming attacks, often called Magecart attacks, work by injecting JavaScript into the checkout page. Inventory every script that loads on payment pages and confirm that each one is authorized and necessary. PCI DSS 4.0.1 includes requirements for managing payment page scripts and detecting unauthorized changes, so this check also supports compliance. A strict Content Security Policy is a strong control here.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"17_Search_the_database_for_injected_code\"><\/span>17. Search the database for injected code<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers frequently hide malicious JavaScript in the database rather than in files, so a file scan alone will miss it. Check CMS blocks and pages, the design configuration for custom head or footer HTML, and tracking-script fields in the system configuration. Look for obfuscated code, unfamiliar external domains, and anything referencing payment form fields.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"18_Protect_customer_accounts\"><\/span>18. Protect customer accounts<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Turn on CAPTCHA for login, registration, password reset, and contact forms. Apply rate limits and lockouts for repeated failed logins, and require strong passwords. Credential-stuffing attacks reuse passwords leaked from other sites, and they can succeed even when Magento itself is fully patched.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Part_6_Monitoring_and_recovery\"><\/span>Part 6: Monitoring and recovery<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"19_Put_a_web_application_firewall_in_front_of_the_store\"><\/span>19. Put a web application firewall in front of the store<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A WAF filters out common attack traffic, blocks malicious bots, and can buy you time when a new vulnerability is announced before you have patched it. Confirm that your firewall rules cover the admin, the REST and GraphQL APIs, and the checkout. A WAF supplements patching and does not replace it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"20_Verify_logging_alerts_and_tested_backups\"><\/span>20. Verify logging, alerts, and tested backups<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You cannot respond to what you cannot see. Confirm that admin actions, failed logins, and server errors are logged and that someone receives alerts for unusual activity, such as a new admin user or a changed file. Then test your backups: restore one to a separate environment and check that the store works. A backup that has never been restored is only a hope.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_prioritize_what_you_find\"><\/span>How to prioritize what you find<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Not every failed item carries the same urgency. Use this order as a guide:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Fix immediately:<\/strong> unsupported Magento or PHP versions, missing critical security patches, exposed database or search services, signs of compromise, and admin accounts without two-factor authentication.<\/li>\n\n\n\n<li><strong>Fix this month:<\/strong> extension cleanup, permission problems, exposed backup or log files, and missing security headers.<\/li>\n\n\n\n<li><strong>Schedule ongoing:<\/strong> monitoring, dependency reviews, quarterly user audits, and restore tests for backups.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you find signs that the store has already been compromised, such as unknown admin users, modified files, or strange scripts in the checkout, do not simply delete them. Take the affected area offline if you can, preserve logs, change all credentials, and bring in someone experienced with Magento malware cleanup. Removing the visible code without closing the original entry point usually leads to reinfection.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_often_should_you_audit\"><\/span>How often should you audit?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A full audit once a year is a reasonable minimum, with a lighter review each quarter and an immediate check after any major upgrade, new extension, change of hosting, or change of developer. Anything that adds code or access to your store can change your risk profile, so audits should follow changes, not only the calendar.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"When_to_bring_in_a_professional\"><\/span>When to bring in a professional<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Some of these checks are quick, while others require tools and experience that most merchants and small teams do not have in-house. Database scanning, file comparison against clean releases, server hardening, and Content Security Policy configuration are all areas where mistakes can break checkout or leave real gaps. A specialist can also tell you which findings matter for your store and which are noise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A professional audit should give you a written report with prioritized findings, clear remediation steps, and a plan for ongoing patching and monitoring. If you would rather not do this yourself, <a href=\"https:\/\/www.numinix.com\" target=\"_blank\" rel=\"noopener\">Numinix can audit your Magento store<\/a> and handle the fixes, whether you need a one-time review, an upgrade, or ongoing security maintenance.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Magento security rarely comes down to one dramatic mistake. It comes down to a long list of small gaps that nobody was responsible for checking: a missed patch, an old admin account, an extension nobody updated, a script nobody reviewed. A regular audit closes those gaps before someone else finds them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use this checklist as a starting point, keep a record of what you check each time, and treat every failed item as a task with an owner and a deadline. If you need help with any of it, you can hire the Numinix team to take the whole audit off your hands.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Magento and Adobe Commerce stores are attractive targets. They handle payment details, customer accounts, and order data, and they run on a large ecosystem of extensions that vary widely in quality. Attackers know this, and automated scanners probe thousands of stores every day looking for outdated versions, exposed files, and weak admin logins. The good&#8230;<\/p>\n","protected":false},"author":271,"featured_media":4549,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_lmt_disableupdate":"","_lmt_disable":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-13009","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-miscellaneous"],"modified_by":"Nurul Afsar","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/www.numinix.com\/wordpress\/wp-content\/uploads\/2019\/08\/Magento-web-development.jpeg","_links":{"self":[{"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/posts\/13009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/users\/271"}],"replies":[{"embeddable":true,"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/comments?post=13009"}],"version-history":[{"count":0,"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/posts\/13009\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/media\/4549"}],"wp:attachment":[{"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/media?parent=13009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/categories?post=13009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.numinix.com\/blog\/wp-json\/wp\/v2\/tags?post=13009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}