18/11/2024
Securing your is crucial to protect both your data and your customers’ information. Here are several best practices to ensure your site is secure:
# # # 1. **Keep Magento Up to Date**
- Always use the latest stable version of Magento. Security patches and updates are regularly released to fix vulnerabilities.
- Enable automatic security patch updates if possible, or regularly check the [Magento Security Center](https://magento.com/security) for updates.
# # # 2. **Use **
- Use complex, unique passwords for admin accounts, FTP access, database, and any other system access.
- Consider using a password manager to generate and store secure passwords.
- Enable two-factor authentication (2FA) for the admin panel.
# # # 3. **Limit Admin Access**
- Restrict admin access to specific IP addresses or ranges by configuring `.htaccess` or web server settings.
- Change the default Magento admin URL from `/admin` to something custom to make it harder for attackers to find.
# # # 4. **Implement with an Certificate**
- Ensure your entire site, especially login and checkout pages, are served over . This encrypts the communication between your site and visitors, protecting data from being intercepted.
# # # 5. **Use a Web Application Firewall (WAF)**
- Consider using a WAF to block malicious traffic before it reaches your site. Services like Cloudflare, Sucuri, or ModSecurity can help mitigate threats.
# # # 6. **Set Proper File Permissions**
- Ensure that your file and directory permissions are set properly. Generally, directories should be set to `755` and files to `644`. The `app/etc` folder should be more restricted, typically `700`.
# # # 7. **Disable Unnecessary Services and Features**
- Disable any Magento features, extensions, or services that you do not use. For example, if you're not using the Magento API, disable it to prevent potential vulnerabilities.
- Remove or disable default Magento modules that aren't needed (e.g., sample data).
# # # 8. **Backup Your Site Regularly**
- Perform regular backups of your site, both the files and the database. Store backups securely and make sure they are easily retrievable in case of an emergency.
# # # 9. **Monitor User Activity and Logs**
- Regularly review your admin and server logs for any suspicious activity.
- Consider implementing tools that track login attempts, failed logins, and other user activities.
# # # 10. **Use Magento Security Extensions**
- Install trusted security extensions to help protect your store, such as:
- **Magento 2 Security Suite** for firewall protection, malware scanning, and login attempts.
- **Amasty's Admin Actions Log** to monitor admin actions.
# # # 11. **Implement Content Security Policy (CSP)**
- Configure and implement a strict CSP header to protect against Cross-Site Scripting (XSS) and other injection-based attacks.
# # # 12. **Update Extensions and Themes**
- Ensure all third-party extensions and themes are up to date and come from reputable sources. Vulnerable extensions can be an easy attack vector.
- Regularly check for any known security issues with extensions you use.
# # # 13. **Secure the Server**
- Use a dedicated or VPS server for your Magento store instead of shared hosting.
- Regularly update your server software and ensure it’s configured securely.
- If you're using Apache, Nginx, or another web server, ensure they are configured to only allow necessary protocols and ports.
# # # 14. **Limit API Access**
- If you don’t need the Magento API, disable it.
- If you do use the API, ensure API keys are securely stored and rotated regularly.
By following these best practices, you can significantly reduce the chances of your Magento website being compromised and ensure a safer shopping experience for your customers.
Adobe Product Security Incident Response Team (PSIRT)
