Magebean Logo Magebean
← Back to assessment profiles

Magento security guide

Magento 2 Security Best Practices

Securing Magento 2 requires more than applying patches after a vulnerability is announced. Teams need repeatable controls across Admin access, extensions, custom code, configuration, deployment, monitoring, and incident readiness.

This guide organizes recommendations from official Adobe Commerce guidance into a practical checklist for Magento agencies, developers, and merchants. The final section shows how Magebean can automate the checks that are observable from a Magento project.

Magento 2 security checklist

The exact implementation depends on your edition, hosting model, payment flow, and operational responsibilities. Treat these areas as a review framework rather than a substitute for platform-specific guidance.

Protect Admin and privileged access

Reduce the chance that stolen or guessed credentials lead to a full store compromise.

Examples:

  • Require two-factor authentication
  • Use a non-default Admin URL
  • Limit login attempts and session lifetime
  • Apply least privilege to Admin roles
  • Remove inactive users and access

Keep Magento, patches, and dependencies current

Maintain supported software and a defined process for reviewing and deploying security updates.

Examples:

  • Track Adobe security bulletins
  • Apply security patches and hotfixes
  • Update Commerce services and extensions
  • Review Composer vulnerabilities
  • Remove unsupported or abandoned packages

Control extensions and custom code

Third-party modules and customizations expand the attack surface and should follow the same security expectations as the core application.

Examples:

  • Source extensions from trusted vendors
  • Review code before release
  • Limit unnecessary modules and vendors
  • Test authorization and input handling
  • Check for unsafe file, SQL, command, and template patterns

Protect secrets and sensitive configuration

Keep credentials and security-sensitive settings out of source control, public files, logs, and unmanaged Admin changes.

Examples:

  • Restrict app/etc/env.php permissions
  • Keep secrets out of Git history
  • Lock critical configuration values
  • Rotate exposed credentials
  • Sanitize logs and support artifacts

Harden files, permissions, and deployment

Production deployments should be deterministic and should minimize writable or publicly exposed application paths.

Examples:

  • Avoid world-writable files and directories
  • Remove development leftovers and database dumps
  • Block public access to logs and repository metadata
  • Test changes before Production
  • Use controlled build and deployment workflows

Secure transport and browser-facing controls

Protect customer and administrator traffic while reducing common storefront and checkout attack paths.

Examples:

  • Serve the site over HTTPS
  • Use secure cookie settings
  • Configure security headers and CSP
  • Use a WAF where appropriate
  • Review scripts loaded on checkout and payment pages

Monitor the store and prepare for incidents

Security controls degrade over time, so teams need monitoring, ownership, evidence, and a response process.

Examples:

  • Run recurring security scans
  • Monitor logs and suspicious changes
  • Subscribe to security notifications
  • Maintain tested backups
  • Document incident contacts and response steps

Automate observable checks with Magebean

Magebean can automate project-level checks for many configuration, permission, dependency, code, deployment, and logging practices. Organizational and infrastructure controls still require manual review.

Examples:

  • Run the basic profile from the Magento root
  • Review Critical and High findings first
  • Map findings to the relevant baseline rule
  • Fix or document accepted risk
  • Re-run the scan after changes

Sample command

./magebean.phar scan --path=/var/www/magento --profile=basic

# Or from the Magento project root
./magebean.phar scan --path=. --profile=basic

Example output

Magebean Security Scan
Profile: Basic
Target: /var/www/magento

Findings:
  [HIGH] Sensitive configuration permissions require attention
  [HIGH] Vulnerable dependency detected
  [MEDIUM] Production security setting is not aligned with baseline
  [MEDIUM] Publicly exposed development artifact detected

Use automation as part of the review

A scan helps make repeatable technical checks visible, but it cannot prove that every operational or infrastructure practice is working.

  1. Run the basic profile against the Magento project.
  2. Validate findings in the context of the actual environment.
  3. Prioritize issues by impact and exposure.
  4. Complete manual checks for access, hosting, WAF, backups, and incident readiness.
  5. Re-run Magebean after remediation and retain the result as evidence.

Important note

Magebean does not replace Adobe guidance, a penetration test, or a complete security assessment. Some recommendations are edition-specific, cloud-specific, infrastructure-level, or dependent on manual evidence.

Good fit for

  • Magento agencies establishing a review standard
  • Developers preparing a release
  • Merchants reviewing production hardening
  • Maintenance teams building recurring checks
  • Teams translating Adobe guidance into actions
  • Technical leads documenting security posture

Turn best practices into a repeatable workflow

A checklist is most useful when it becomes part of normal development, release, and maintenance work rather than a one-time exercise.

Use the official guidance for the complete platform context, then use Magebean to automate the project-level checks that can be evaluated consistently.

Official references

This guide summarizes and organizes official guidance. Review the source documentation for platform-specific details and updates.