Checklist · 2026-07-03

Magento 2 Hardening Checklist (40 Steps, Copy-Paste)

Hardening is the difference between a store that shrugs off an attack and one that gets popped. This is a practical, copy-paste Magento 2 hardening checklist grouped into ten areas — work top to bottom, and you'll close the gaps behind almost every real-world compromise.

Want to know where you stand first? Run a free MageArgus scan — it checks your version, headers, exposed files and more in under a minute.

By the numbers

Most breached stores were missing a patch that had been available for months — Sansec / MageArgus incident data
2FA + a custom admin path stops the overwhelming majority of admin brute-force — Adobe Commerce security guidance

1. Patching & versions

Run a supported release; never an EOL branch (2.3 and older).
Apply security patches within days of release — subscribe to Adobe APSB bulletins.
Check your level: bin/magento --version. See the current CVE list.

2. Admin access

Custom admin frontName (not /admin).
Two-factor auth enforced for every admin user.
IP allow-list the admin where possible; strong, unique passwords.

Details in the admin hardening guide.

3. File & folder permissions

No world-writable files; app/etc/env.php readable only by the app user:

find var pub/static generated -type d -exec chmod 770 {} \;
find var pub/static generated -type f -exec chmod 660 {} \;
chmod 600 app/etc/env.php

Block PHP execution in pub/media and pub/static.

4. Transport & headers

HTTPS everywhere with HSTS.
Security headers: CSP, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy.
Secure, HttpOnly, SameSite cookies.

See security headers explained.

5. Content Security Policy

Move CSP from report-only to an enforced script-src allow-list to block skimmers on checkout — how to enforce Magento CSP.

6. Extensions & code

Audit third-party modules; remove what you don't use.
Track extension CVEs; update promptly.
Never leave sample data, dev tools or phpinfo in production.

7. Secrets & integrations

Rotate the encryption key, admin passwords and API tokens periodically and after any incident.
Least-privilege integration tokens; delete unused ones.

8. Backups & recovery

Automated, off-site, tested backups (files + database).
Documented restore procedure; know your RTO.

9. Monitoring

File-integrity monitoring on core, templates and pub/media.
Alert on new admin users and integration tokens.
Scheduled malware scans — see how often to scan.

10. Incident readiness

Know who to call and where your backups are before you need them.
Have the recovery plan bookmarked.

Frequently asked questions

How long does hardening take?

The high-impact items — patch, 2FA, custom admin path, permissions, HTTPS/HSTS and an enforced CSP — can be done in a day. Backups, monitoring and CSP tuning are ongoing.

Do I need every item?

Prioritise patching, admin hardening and CSP first — those close the paths behind most real compromises. Then work through the rest.