Magento 2 Security: 25 rules you must apply NOW

Patches, firewall, 2FA, security headers, admin access restrictions, log auditing.

Published 2026-07-15 • Category: Security • Reading time: 10 min

Why now

In 2026 Magento remains one of the most frequently attacked CMSes: 32% of all recorded webshell incidents in 2025 were on Magento stores. The cause — code customisation and slow patch application.

25 critical rules

1. Latest Composer patch installed within 30 days of release
2. 2FA enabled for every admin account (Magento_TwoFactorAuth)
3. Admin URL changed from /admin
4. Rate limit on /customer/account/login (10 requests/min)
5. IP whitelist for /admin (Nginx geo block)
6. Content Security Policy with strict-dynamic
7. HSTS with max-age ≥ 1 year
8. X-Frame-Options: SAMEORIGIN
9. Referrer-Policy: strict-origin-when-cross-origin
10. HTTPS everywhere, automatic HTTP redirect
11. Permissions-Policy for camera/mic/geo
12. Filesystem: 755 for directories, 644 for files
13. app/etc/env.php — 400, web user only
14. No Composer dev-dependencies in prod
15. The magento MySQL user holds GRANTs only to its own DB
16. Monthly backup verification (restore drill)
17. Logs retained > 90 days
18. Admin login monitoring (Slack alert)
19. Disable SOAP API if unused
20. Disable REST API GET endpoints for sensitive resources
21. Magecart protection patch (Yireo_Checkout or Mageplaza_Security)
22. Regular malware scan (Sucuri, MageReport)
23. Antivirus on server files
24. Auto-block IPs after 10× 404 in 10 s (fail2ban rule)
25. Monthly pen-test in a production-like environment

What to do during an incident

1. Block /admin by IP
2. Review recent deploys and merges
3. Scan for webshells (clamav + manual search for the eval(base64_ pattern)
4. Invalidate every admin session
5. Rotate: DB password, API keys, OAuth tokens
6. Notify customers if there’s any sign of data exposure