Guides
The Magento Security Checklist Every Store Owner Should Run in 2026
October 23, 2026 - Alexandru-Manuel Carabus
Most Magento breaches are unpatched known vulnerabilities on stores nobody was maintaining, which is exactly what SessionReaper proved. Here is the practical, boring, effective security checklist every store owner should be able to answer yes to in 2026.
Most Magento stores that get breached are not victims of some exotic, previously-unknown attack. They are stores running a known vulnerability that had a patch available, on a site nobody was actively maintaining. The SessionReaper vulnerability made that painfully concrete in 2026: the stores that were breached were overwhelmingly the ones that had not applied a patch that already existed. We wrote about what that episode actually cost owners in the SessionReaper piece. This is the companion to it: the practical checklist every Magento store owner should be able to answer yes to, in plain language.
1. Patch within the window, every time
Adobe ships Magento security patches on a schedule, plus the occasional emergency out-of-band fix when something serious is being exploited. The single biggest factor in whether you get breached is how quickly you apply them. You need an actual process: watch the Adobe Security Bulletins, test each patch on a staging copy, and deploy critical ones within days, not next quarter. SessionReaper was being exploited in the wild while the fix was available. The stores that moved fast were fine. The stores that treated the patch as optional were the case studies. If you cannot say when your store was last patched, that is the first thing to fix.
2. Lock down the admin panel
The admin is the highest-value target on your store, so treat it that way. Move it off the default /admin path to a non-obvious URL. Turn on two-factor authentication, which Magento ships built in, for every admin user with no exceptions. Enforce strong, unique passwords. Restrict admin access by IP address where your team's setup allows it. And audit the admin user list every quarter: the account of a developer who left eight months ago is exactly the door an attacker wants open.
3. Keep the software inventory current
Run a supported Magento version (the 2.4.7 and 2.4.8 line in 2026), on a supported and patched PHP version, and keep every third-party extension on its latest release. Then go further and remove the extensions you do not actually use. Abandoned and outdated extensions are one of the most common ways stores get compromised, because they stop receiving security fixes while staying installed and reachable. An extension you are not using is not a convenience you are keeping, it is an attack surface you forgot about.
4. Harden the server and protect the secrets
TLS on everything, a current stable web server, and file permissions locked down so the web user cannot rewrite code it should only read. Get development tools, phpinfo pages, and test files off production entirely. Make sure the database is not reachable from the public internet. Keep secrets (API keys, database passwords, payment credentials) in environment configuration, never committed to git, and keep staging credentials fully separate from production. Disable directory listing so your file structure is not a public map.
5. Back up like you will actually need it
Automated daily backups of the database, the media, and the code, stored somewhere off the store's own server so a compromised server does not take the backups with it. Then do the step almost everyone skips: actually perform a test restore, on a schedule, and confirm the store comes back. A backup you have never restored is a hope, not a backup. Incidents of the SessionReaper class are exactly when people discover their backups were incomplete or unrestorable, at the worst possible moment to find out.
6. Monitor so you find out first
The goal is to learn about a problem from your own monitoring, not from your payment processor or a customer. Put file-integrity monitoring in place so you know the moment a core file changes unexpectedly. Register and run Adobe's Magento Security Scan. Put a web application firewall in front of the store. Watch your logs for admin logins from unusual locations and for the request patterns that precede an exploit. Detection is the difference between a contained incident and a breach that ran quietly for three months.
7. Write the incident plan before the incident
When something does go wrong, the last moment to figure out your response is during the emergency. Write it down in advance: who to call, where the backups live and how to restore them, how to take the store offline cleanly, and how to rotate every credential fast. During SessionReaper, the difference between a bad afternoon and a bad month was almost entirely whether that plan already existed. A maintenance partner who responds fast when something critical breaks is worth the most on exactly the day you hoped you would never need them.
The uncomfortable summary
None of this is exotic, and that is the point. The overwhelming majority of Magento breaches come down to unpatched known vulnerabilities on stores that nobody was maintaining, not clever zero-days. The checklist above is deliberately boring, because boring and consistent is what actually keeps a store safe. Owning a self-hosted Magento store means owning its security, and that is a feature rather than a burden: unlike a closed platform, you can genuinely do every item on this list yourself or with a partner. We put security in the wider context of ownership in the SessionReaper piece, set the maintenance cadence that keeps it current in the maintenance guide, and gave you three fast self-checks in three tests you can run before Monday.
If you cannot confidently answer yes to the patching, admin, and backup items above, that is where to start, and today is a better day than the day after an incident. Book a free strategy call with LIQUIDLAB and we will walk your store against this list, tell you which gaps are urgent and which can wait, and what it would take to close them. Security is cheapest to fix while nothing is on fire.