Magento Store Health Check
Enter your store's address. We'll look at what your store shows the public and flag the things attackers look for first: missing patches, exposed files, a guessable admin address and weak HTTPS settings.
What this checks
Most Magento break-ins don't need anything clever. Bots scan for stores that are behind on patches or have left something open, then use known flaws. This check looks for the same signs, from the outside, without logging in or trying to break anything.
Patches
Magento's page files carry a timestamp from the last time the store's code was deployed. If that's before September 2025, the store can't have Adobe's fix for SessionReaper (CVE-2025-54236), which attackers have used to take over Magento stores. If it's more than six months old, the store has probably missed other patches too. A recent date doesn't prove every patch is in, but it shows someone is looking after the store.
Things that should never be public
- app/etc/env.php: your database password and encryption key.
- .git: your source code history.
- /setup/: the installation wizard.
Easy wins
- Hide the version at /magento_version and move the admin away from /admin.
- Redirect HTTP to HTTPS, add HSTS, and keep the certificate renewing.
- Hide server and PHP version numbers, and run a supported PHP version.
- Security headers and a Content Security Policy, which helps stop card-skimming scripts.
- A firewall or CDN such as Cloudflare in front of the store.
These checks come from experience: read what I learned when my own store was hacked.
A clean result means none of these common warning signs were visible from outside. It isn't a full security audit and can't see malware already inside a store.
Want someone to keep on top of this?
Store Watch runs this check for you every morning, watches your uptime and warns you when a new outside script appears, for £5 a month (or a free monthly report). Care plans add the fixing: patching, monitoring and development time, from £149 a month.