As more businesses switch to online options Magento is a popular Content Management System (CMS) of choice for eCommerce websites. That being said, with the online industry becoming more interconnected than ever before also comes the increase of risks in terms of website security.
As of recently, Magento1 has become outdated and no longer supported. Adobe’s goal is to move all users away to Magento2 instead, which has 2FA and a non-standard login URL enabled by default, being generally more secure.
Migrating is very costly for an average business, however, so this article will hopefully shed some light on how you can still protect your site regardless of which version of Magento is currently being used.
Common Types of Attacks on Magento
Infected sites have become increasingly more common throughout the last few decades, and as more plugins, themes, and third-party software is integrated, the more exploitable things become. Some of the most prominent kinds of attacks with Magento are the following:
- CC skimmers
- Ransomware
- SEO spam
- Phishing campaigns
- DDoS
- Brute Force Attacks
It’s also not uncommon for attackers to engage in “card testing” attacks. This is when attackers will make a small “test purchase” on a website to see if stolen cards are still active and working. Although inconvenient, adding a CAPTCHA to your checkout page as well as disabling guest / unauthenticated transactions is recommended to prevent such abuse.
Tips for Best Security Practices
Protecting your Magento site can seem a bit overwhelming given the multitude of layers and features that go into creating a website. Performing an initial scan for vulnerabilities with SiteCheck or MageReport will be very helpful, however. You’ll also want to ensure all patches are installed regularly.
The login section is the most important thing to do for your online business, as most hackers cant predict the default admin login URL and usernames. Altering these two things is a great start to avoid any Brute Force attacks.
Adding an extra layer of security with 2FA, strong generated passwords, and limited login attempts will also ensure anyone attempting to log in has less of a chance of being successful. You can also add IPs to a whitelist if you’re utilizing a Web Application Firewall, restricting any public access to the login panel. (The firewall is also useful in regards to hardening the site with virtual patching, in case any updates are delayed.)
Inserting a CAPTCHA to any contact forms and login sections will also ensure any spam from bots doesn’t seep through.
With all of these recommendations in mind so far, you can never be too cautious when it comes to things breaking the site’s functionality. Making sure backups are regularly stored within a certain time frame will ensure if anything goes wrong you at least have a copy before restoring from.
With that in mind, making sure you use the Principle of Least Privilege when it comes to users, plugins, extensions, and themes will not only avoid any issues of slow load times but also fewer chances of being more vulnerable to infection.
One of the last things to mention is ensuring your website is PCI-DSS compliant. Installing an SSL certificate protecting user data in transit is also crucial in this regard. Most site visitors won’t go near an online store if it’s using HTTP instead of HTTPS for the safety of their sensitive information.
Conclusion
With all of these kinds of attacks and precautions in mind, it’s become dire for any eCommerce site to understand the risks in terms of their brand and reputation. For the average website owner, this may seem a bit paralyzing as their time, like everyone’s, is valuable. In the case, you’re unable to manage all of these security measures yourself, don’t fret. There are website security services to help alleviate the stress.
Victor Santoyo
Ashley Sand
Luke Leal
Bruno Zanelato
Northon Torga
Krasimir Konov