The Magento Security Checklist We Wish We Had Known from Day One

Why Magento Security Matters: The Real Consequences

Security breaches are not an abstract risk for eCommerce stores. They are a commercially devastating event that affects every dimension of the business simultaneously. Understanding the full scope of consequences is important context for every investment in security measures.

Start with a Security Audit

Before implementing new security measures, assess your current position. Security measures applied without understanding your current vulnerabilities may address the wrong risks or create a false sense of security. A structured audit establishes a baseline and prioritises what needs to be fixed first.

Magento's built-in Security Scan Tool

Adobe provides a free Magento Security Scan Tool that scans your store for known vulnerabilities, outdated patches, and configuration issues. It provides actionable recommendations and can be configured to run on a scheduled basis. This is the minimum baseline for any Magento security programme -- if you are not using it, start here.

Third-party security scanning

• Sansec eComscan: the most Magento-specific security scanner available. Specialises in detecting Magecart skimmers, malware, and hidden backdoors that generic scanners miss. Highly recommended for any Magento store processing payment data.
• Sucuri SiteCheck: free external website scanner. Good for detecting known malware, blacklist status, and website errors. Less deep than eComscan for Magento-specific threats.
• Qualys and Nessus: enterprise-grade vulnerability scanners for infrastructure-level assessment (server OS, network configuration, SSL/TLS configuration). More appropriate for enterprise Magento operations.

Manual penetration testing

Automated scanners find known vulnerabilities. Skilled penetration testers find unknown ones. An annual penetration test by a qualified security firm -- specifically one with Magento eCommerce experience -- identifies vulnerabilities that no automated tool would catch: logic flaws in custom code, API authentication weaknesses, business logic bypass vulnerabilities, and privilege escalation paths through custom extensions.

For Magento stores processing significant payment volume or storing substantial customer data, annual penetration testing is not optional -- it is a PCI DSS requirement under SAQ D and above.

What your audit should cover

• Current Magento version vs latest released version -- identify patch gap
• All installed extensions -- version currency and maintenance status
• Admin user account list -- active accounts, password age, 2FA status
• Admin URL -- is it still the default /admin?
• SSL certificate validity and HTTPS enforcement across all pages
• WAF presence and configuration
• Backup schedule and last successful restore test
• Server-level configuration -- PHP version, open ports, directory permissions
• File integrity baseline -- what files exist and what are their checksums?
• Monitoring and alerting -- are you notified of unusual activity?

The 10-Point Magento Security Checklist

These are the baseline security measures every Magento store needs. None of them are optional for a store in production processing real customer and payment data.

1. Apply security patches immediately

Magento releases security patches quarterly and as emergency releases for critical vulnerabilities. Apply all security patches within 7 days for critical patches (CVSS 9+) and within 30 days for standard patches. Subscribe to Adobe's Magento security alerts at account.magento.com to receive notification when patches are released. Test patches in staging before applying to production -- but do not let staging testing delay critical patch application beyond 7 days. Check your current version: composer show magento/product-community-edition

2. Use a security-first hosting provider

Choose a hosting provider with Magento-specific security experience. Essential requirements: SSL certificate included, hardware or cloud-based firewall, automated daily backups, DDoS protection, 24/7 security incident support. For managed Magento hosting, providers like Nexcess and Acloud include proactive security monitoring and patching support. Verify your provider's backup retention period -- 30 days minimum is the standard for meaningful recovery options.

3. Secure the admin panel

The Magento admin is the highest-value target for attackers. Change the default admin URL from /admin to a unique path in app/etc/env.php or via environment variable. Enable two-factor authentication (2FA) for all admin accounts -- not just your own: Stores > Configuration > Security > 2FA. Use strong, unique passwords for all admin accounts (minimum 16 characters, generated by a password manager). IP allowlist admin access where your team works from fixed IP addresses -- this is the most impactful admin security measure available.

4. Implement full-site SSL and HTTPS

HTTPS must be enforced across the entire Magento store -- not just the checkout. Configure in Stores > Configuration > General > Web > Base URLs (Secure): set Use Secure URLs on Storefront and Use Secure URLs in Admin both to Yes. Add HSTS (Strict-Transport-Security) header to prevent protocol downgrade attacks. Display security badges at checkout to address customer trust concerns at the payment step. Google uses HTTPS as a ranking signal -- HTTPS is both a security and SEO requirement.

5. Implement a comprehensive backup strategy

Backups are your recovery plan when every other security measure fails. Configure automated encrypted backups at multiple intervals: hourly database backups, daily full backups. Store backups in geographically separate locations -- your hosting provider's backup and an independent cloud storage provider (AWS S3, Google Cloud Storage). Maintain at least 30 days of rolling backup history. Test your restoration process quarterly -- a backup you have never tested restoring is a backup of unknown reliability.

6. Deploy a Web Application Firewall (WAF)

A WAF filters malicious traffic before it reaches your Magento application. Cloudflare WAF (Pro plan minimum) is the most widely used for Magento and provides protection against SQL injection, XSS, and Magecart injection attempts. Sucuri offers a Magento-specific WAF with malware scanning included. For enterprise operations, AWS WAF or Cloudflare Enterprise provide machine learning-based adaptive protection. Configure WAF rules specific to Magento's URL patterns and review WAF logs weekly for emerging threat patterns.

7. Monitor for security threats continuously

Security monitoring must be continuous -- breaches detected in minutes are contained. IBM's 2024 data shows the average breach takes 206 days to identify without active monitoring. Configure the Magento Security Scan Tool for regular automated scanning. Review server access logs for unusual patterns: repeated failed logins, IP addresses with abnormal request volumes, requests to admin URLs from unrecognised IPs. Set up real-time alerts for: admin login from new IP, file modification in core Magento directories, and unusual order volume spikes (potential fraud indicator).

8. Implement role-based access control (RBAC)

Limit admin access to only what each user genuinely needs. Magento's role-based access control allows granular permission assignment by store section, action type, and website scope. Create specific roles for: content editors (CMS only), customer service (orders and customers, no configuration), developers (full access, time-limited). Conduct quarterly access reviews -- remove accounts for former team members immediately upon departure, not at the next quarterly review. Enable 2FA for all users with any admin access, not just account administrators.

9. Protect against brute-force attacks

Brute-force attacks against Magento admin login are automated and persistent. Enable lockout after failed login attempts in Stores > Configuration > Advanced > Admin > Security: set Max Login Failures to Lockout Account to 5. Configure CAPTCHA for the admin login page: Stores > Configuration > Advanced > Admin > CAPTCHA. For the customer login and account creation forms, enable Google reCAPTCHA to prevent account creation fraud and credential stuffing against customer accounts.

10. Perform regular security audits

Security is a continuous process. Monthly internal review: check extension update status, review admin user list, verify backup integrity, check Magento Security Scan Tool results. Quarterly: conduct access reviews, review WAF logs for emerging patterns, test backup restoration, review server-level security configuration. Annually: engage a qualified security firm for external penetration testing. The cost of an annual penetration test is a fraction of the cost of a breach it might have prevented.

Advanced Security Enhancements

The 10-point checklist covers the baseline. These advanced measures separate stores that are adequately protected from stores that are genuinely hardened against sophisticated attacks.

File integrity monitoring (FIM)

File integrity monitoring compares the current state of your Magento file system against a known-good baseline, alerting when files are added, modified, or deleted. For Magento stores, this is the primary detection mechanism for Magecart skimmer injection -- malicious JavaScript inserted into checkout templates or payment processing files. A FIM solution that alerts within minutes of file modification dramatically reduces the window during which stolen payment data can be exfiltrated.

Tools: Sansec eComscan provides continuous file integrity monitoring with Magento-specific threat intelligence. OSSEC is an open-source FIM solution for self-managed environments. Cloudflare's Page Shield provides client-side script monitoring.

Content Security Policy (CSP)

A Content Security Policy is an HTTP header that instructs browsers which JavaScript sources are permitted to execute on your Magento store. A well-configured CSP prevents Magecart-style attacks from executing injected scripts even if they successfully reach the browser. Magento 2.3.5+ includes CSP framework support. Implement in Report-Only mode first to identify legitimate script sources, then switch to enforcement mode.

CSP significantly reduces the impact of a successful code injection -- the injected script cannot execute because the browser refuses it based on the policy. It is the closest thing to a technical guarantee against client-side payment skimming.

Principle of least privilege and just-in-time access

Beyond basic RBAC, implement just-in-time access for sensitive operations: temporary elevated permissions that expire after a defined time window or task completion. Admin access to production Magento should be an elevated state that requires re-authentication -- not a permanent permission that persists across sessions. Review all extensions for their required permissions -- extensions that request full admin API access when they only need catalogue access are a security risk.

Security Information and Event Management (SIEM)

For larger Magento operations, a SIEM system aggregates security events from multiple sources (web server logs, application logs, database logs, WAF logs, CDN logs) and applies correlation rules to identify attack patterns that individual log sources would miss. Tools like Splunk, Elastic SIEM, or Datadog Security Monitoring are used for enterprise Magento deployments. For smaller stores, a well-configured monitoring stack (Magento security scan + server log monitoring + WAF alerts) provides meaningful coverage without SIEM complexity.

Enhanced file and directory permissions

• Web server (Nginx/Apache) should run as a dedicated user with no write access to Magento core files
• Magento var/, pub/media/, and pub/static/ directories need write access; all other directories should be read-only for the web server user
• Disable PHP execution in pub/media/ -- this prevents uploaded image files from executing as PHP scripts
• Set file permissions to 644 and directory permissions to 755 for Magento core files
• Remove write permissions from app/etc/env.php in production -- this file contains database credentials

Cybersecurity awareness and training

Technical security measures protect against technical attacks. Social engineering attacks -- phishing emails targeting admin credentials, phone-based pretexting to gain access, supplier impersonation -- bypass technical controls entirely. Every team member with any access to Magento admin, hosting control panels, or related systems needs security awareness training covering phishing recognition, password hygiene, and incident reporting procedures. A team member who shares their credentials in response to a convincing phishing email is a security control failure that no WAF can prevent.

The Magecart Threat: Protecting Your Checkout

Magecart refers to a category of attack specifically targeting eCommerce checkout pages by injecting malicious JavaScript that silently copies payment card data as customers type it. Magecart attacks have compromised thousands of Magento stores, including high-profile retailers. The attack is particularly dangerous because it is invisible to the customer, invisible to the store owner without active monitoring, and can operate for months before detection.

How Magecart attacks reach Magento stores

• Unpatched Magento vulnerabilities: automated scanners identify Magento stores running versions with known vulnerabilities and inject skimmer code through those vulnerabilities
• Compromised admin credentials: stolen or brute-forced admin passwords allow direct access to Magento's template and configuration system -- where skimmer code can be inserted through the admin interface
• Compromised third-party scripts: JavaScript loaded from external CDNs or tag managers can be compromised at the source -- the skimmer appears to come from a legitimate domain
• Supply chain attacks on extensions: malicious code inserted into a popular Magento extension's update can deploy a skimmer across thousands of stores simultaneously

Magecart defence measures

• Keep Magento patched -- the most common entry point is known, unpatched vulnerabilities
• Enable file integrity monitoring (FIM) -- detect injected code within minutes of insertion
• Implement Content Security Policy (CSP) -- prevent unauthorised scripts from executing even if injected
• Use Subresource Integrity (SRI) hashes on all external JavaScript -- verify third-party scripts have not been modified
• Audit all third-party scripts on the checkout page -- remove any that are not strictly necessary
• Enable Cloudflare's Page Shield or equivalent -- monitors JavaScript loaded on your pages for changes
• Conduct regular malware scans with Sansec eComscan -- specifically designed to detect Magecart-style skimmers
• Monitor your checkout page's network requests for unexpected outbound connections to unknown domains

PCI DSS Compliance for Magento Stores

The Payment Card Industry Data Security Standard (PCI DSS) is the security standard that governs how merchants handle payment card data. Every Magento store that accepts card payments must comply with PCI DSS at the appropriate level for their transaction volume. Non-compliance following a breach can result in payment processing suspension, significant fines, and mandatory forensic investigation costs.

Reducing your PCI scope with a compliant payment gateway

The most effective way to simplify PCI compliance for Magento is to ensure that card data never touches your Magento server at all. Payment gateways including Stripe, Braintree, and Sage Pay use tokenisation and iframe-based checkout elements that collect card data directly within the payment provider's environment -- Magento never sees or stores the raw card number.

This approach reduces your PCI scope from SAQ D (the most extensive, applicable to merchants storing card data) to SAQ A or SAQ A-EP (applicable to merchants using third-party payment iframes). The compliance requirements are dramatically simpler and the audit burden significantly reduced.

PCI DSS requirements relevant to Magento stores

• Maintain a vulnerability management programme: apply security patches promptly, use antivirus/antimalware, develop secure code
• Implement strong access control: restrict cardholder data access to those with a business need, assign unique IDs to each user, restrict physical access to cardholder data
• Maintain an information security policy: a documented security policy covering all team members with any system access
• Regularly monitor and test networks: track and monitor all access to cardholder data and network resources, regularly test security systems
• Protect stored cardholder data: do not store sensitive authentication data after authorisation -- if you are storing card data, stop and use tokenisation
• Encrypt transmission of cardholder data: full-site HTTPS, TLS 1.2 minimum for all payment data transmission

Security Monitoring and Incident Response

The difference between a security incident that is contained and one that is catastrophic is often the speed of detection and response. IBM's 2024 data shows stores without active monitoring take an average of 206 days to identify a breach. Stores with active monitoring detect incidents in days, dramatically limiting the damage window.

What to monitor

• Admin login activity: alert on admin logins from new IP addresses, failed login attempts exceeding threshold, logins at unusual hours
• File system changes: any modification to core Magento files, addition of new PHP files in pub/media/, changes to checkout-related template files
• Server resource usage: CPU or memory spikes that do not correspond to traffic patterns -- often indicate cryptomining or DDoS preparation
• Database activity: large data exports, unusual query patterns, new admin user creation
• Outbound network connections: unexpected connections from your server to external IP addresses -- particularly from PHP processes
• Payment fraud patterns: unusually high order values, multiple cards on a single account, orders shipping to address mismatches

Incident response: what to do when something goes wrong

Have a written incident response plan before you need it. When a security incident is detected or suspected, the response sequence is:

• 1. Contain first: take the store offline or into maintenance mode immediately if active compromise is suspected. Lost revenue during containment is acceptable; continued data exfiltration is not.
• 2. Preserve evidence: take snapshots of server state, copy logs before they rotate, document exactly what was found and when. This evidence is required for forensic investigation and insurance claims.
• 3. Notify relevant parties: if payment card data may have been compromised, notify your payment processor and acquiring bank immediately. Under UK GDPR, notify the ICO within 72 hours if personal data was affected.
• 4. Investigate and remediate: identify the attack vector, remove the malicious code, patch the vulnerability, restore from a known-clean backup if necessary.
• 5. Verify and restore: only restore the store to production after independent verification that the compromise has been fully removed and the entry point closed.
• 6. Post-incident review: document what happened, what the response was, what worked, and what needs to change. Update security measures to prevent recurrence.

Incident response checklist (print and keep accessible)

• Contact details for: hosting provider security team, Magento developer, payment processor fraud team, ICO reporting portal
• Admin credentials stored securely offline (in case admin access is compromised)
• Latest backup location and restoration procedure documented
• Forensic image procedure for server state preservation
• Customer notification template prepared (for GDPR breach notification)
• Insurance policy details for cyber incident coverage

Frequently Asked Questions

Common questions about Magento security. Get in touch if yours is not here.

Conclusion: Security Is an Ongoing Commitment

The key lessons

Patches are not optional. 95% of breaches exploit known vulnerabilities with available patches. The question is not whether unpatched Magento stores are attacked -- they are, continuously, by automated tools that scan the internet for vulnerable installations. The answer is a patch management process that applies critical patches within 7 days and standard patches within 30 days.

2FA is non-negotiable. A single admin account without two-factor authentication is a bypass for every other security measure you have implemented. Stolen credentials are cheap to purchase on criminal marketplaces. 2FA means stolen credentials alone are insufficient to gain admin access. Enable it for every account without exception.

Monitoring detects what prevention misses. No prevention measure is perfect. A monitoring system that detects file changes, admin login anomalies, and unusual traffic patterns within minutes of occurrence limits damage dramatically compared to discovering a breach weeks later through customer fraud reports.

Security is not a one-time project. A Magento store that was well-secured 12 months ago may have drifted since -- new extensions installed without security review, admin accounts not removed when team members left, patches delayed and then forgotten. Security requires a recurring maintenance discipline, not a one-time implementation.

If you want an independent assessment of your Magento store's security posture -- identifying specific vulnerabilities and prioritising remediation by risk -- 5MS has been securing Magento stores since 2011 as an Adobe Solution Partner. Book a free audit and we will identify the specific gaps in your current security configuration.