Turn Magento security best practices into repeatable controls

Control area 01

Protect Admin and privileged access

Reduce the chance that stolen or guessed credentials lead to a full store compromise.

• Require two-factor authentication
• Use a non-default Admin URL
• Limit login attempts and session lifetime
• Apply least privilege to Admin roles
• Remove inactive users and access

Control area 02

Keep Magento, patches, and dependencies current

Maintain supported software and a defined process for reviewing and deploying security updates.

• Track Adobe security bulletins
• Apply security patches and hotfixes
• Update Commerce services and extensions
• Review Composer vulnerabilities
• Remove unsupported or abandoned packages

Control area 03

Control extensions and custom code

Third-party modules and customizations expand the attack surface and should follow the same security expectations as the core application.

• Source extensions from trusted vendors
• Review code before release
• Limit unnecessary modules and vendors
• Test authorization and input handling
• Check for unsafe file, SQL, command, and template patterns

Control area 04

Protect secrets and sensitive configuration

Keep credentials and security-sensitive settings out of source control, public files, logs, and unmanaged Admin changes.

• Restrict app/etc/env.php permissions
• Keep secrets out of Git history
• Lock critical configuration values
• Rotate exposed credentials
• Sanitize logs and support artifacts

Control area 05

Harden files, permissions, and deployment

Production deployments should be deterministic and should minimize writable or publicly exposed application paths.

• Avoid world-writable files and directories
• Remove development leftovers and database dumps
• Block public access to logs and repository metadata
• Test changes before Production
• Use controlled build and deployment workflows

Control area 06

Secure transport and browser-facing controls

Protect customer and administrator traffic while reducing common storefront and checkout attack paths.

• Serve the site over HTTPS
• Use secure cookie settings
• Configure security headers and CSP
• Use a WAF where appropriate
• Review scripts loaded on checkout and payment pages

Control area 07

Monitor the store and prepare for incidents

Security controls degrade over time, so teams need monitoring, ownership, evidence, and a response process.

• Run recurring security scans
• Monitor logs and suspicious changes
• Subscribe to security notifications
• Maintain tested backups
• Document incident contacts and response steps

Control area 08

Automate observable checks with Magebean

Magebean can automate project-level checks for many configuration, permission, dependency, code, deployment, and logging practices. Organizational and infrastructure controls still require manual review.

• Run the basic profile from the Magento root
• Review Critical and High findings first
• Map findings to the relevant baseline rule
• Fix or document accepted risk
• Re-run the scan after changes

From guidance to maintenance

Use automation as part of the review

A scan helps make repeatable technical checks visible, but it cannot prove that every operational or infrastructure practice is working.

1. 1

   Run the basic profile against the Magento project.

2. 2

   Validate findings in the context of the actual environment.

3. 3

   Prioritize issues by impact and exposure.

4. 4

   Complete manual checks for access, hosting, WAF, backups, and incident readiness.

5. 5

   Re-run Magebean after remediation and retain the result as evidence.

Command line automation

Automate repeatable Adobe Commerce security checks

Run the Magebean basic profile to verify observable Magento hardening, configuration, dependency, permission, deployment, and logging controls.

Use the CLI result alongside edition-specific Adobe guidance and the manual operational evidence required by your environment.

$ php magebean.phar --path=/var/www/magento --profile=basic

Profile: Magento Security Best Practices
Baseline: Magento Production

Automated verification complete

21 checks completed
17 passed
3 need attention
1 high-priority findings

Official references

Use current Adobe Commerce documentation as the source of truth for edition-specific, hosting-specific, and platform-specific implementation details.

• Adobe Commerce: Secure your Commerce site and infrastructure
• Adobe Commerce: Deployment best practices
• Adobe Commerce: Security
• Adobe Commerce: Respond to a security incident