{"id":6117,"date":"2017-08-28T12:41:07","date_gmt":"2017-08-28T11:41:07","guid":{"rendered":"https:\/\/magenticians.com\/?p=6117"},"modified":"2024-01-29T12:42:03","modified_gmt":"2024-01-29T11:42:03","slug":"improve-magento-2-security","status":"publish","type":"post","link":"https:\/\/magenticians.com\/improve-magento-2-security\/","title":{"rendered":"Tips to Improve Magento 2 Security"},"content":{"rendered":"Security plays an important role in the success of an online store. If you are running an ecommerce store then it is mandatory to secure your website and protect your customers\u2019 data.\r\n\r\nMagento 2 is one of the most popular ecommerce platforms and is widely used by online merchants around the world. Today, I am going to give you some great tips to help you improve the security of your Magento 2 store.\r\n\r\nHere\u2019s an overview of what we\u2019ll be learning today:\r\n<ul>\r\n \t<li><a href=\"#1\">Admin Name and Password<\/a><\/li>\r\n \t<li><a href=\"#2\">Use the Latest Version of Magento 2<\/a><\/li>\r\n \t<li><a href=\"#3\">Custom Admin URL<\/a><\/li>\r\n \t<li><a href=\"#4\">Two-Step Verification<\/a><\/li>\r\n \t<li><a href=\"#5\">Limit Admin Access<\/a><\/li>\r\n \t<li><a href=\"#6\">SSL Certificate<\/a><\/li>\r\n \t<li><a href=\"#7\">Create a Backup<\/a><\/li>\r\n \t<li><a href=\"#8\">Use Reliable Sources for Magento 2 Extensions<\/a><\/li>\r\n \t<li><a href=\"#9\">Enable Admin Login Captcha<\/a><\/li>\r\n \t<li><a href=\"#10\">Configure Action Log<\/a><\/li>\r\n \t<li><a href=\"#11\">Bonus Tip<\/a><\/li>\r\n<\/ul>\r\n<h2 id=\"1\">Admin Name and Password<\/h2>\r\nTo prevent unauthorized access to your account, it is highly recommended that you use a complex admin name and a strong password. This ensures that attackers cannot guess or simply use the default name to try and login to your account. Just use a combination of uppercase, lowercase, symbols, and numbers to create a strong password.\r\n<h2 id=\"2\">Use the Latest Version of Magento 2<\/h2>\r\nMake sure that you have updated your Magento 2 to the latest version to avoid any security lapses. Every Magento update improves security through patches and killing known vulnerabilities. For this simple reason, it is not easy to attack a Magento 2 store that is updated to the latest version and latest Magento 2 security patch. If your store is not using the latest version, update it now, and if you need a little guidance, here it is: <a href=\"https:\/\/magenticians.com\/update-magento-2-using-composer\/\" target=\"_blank\" rel=\"noopener noreferrer\">How to Update Magento 2 Using Composer<\/a>.\r\n<h2 id=\"3\">Custom Admin URL<\/h2>\r\nAnother practice to make Magento 2 store secure is to use a custom Admin URL. It is highly recommended to change your URL to a unique one for Magento 2 admin rather than using the default URL. If you don&#8217;t know how to do it, here\u2019s a guide to help you out: <a href=\"https:\/\/magenticians.com\/change-admin-url-magento-2-tutorial\/\" target=\"_blank\" rel=\"noopener noreferrer\">How to change Admin URL in Magento 2<\/a>.\r\n<h2 id=\"4\">Two-Step Verification<\/h2>\r\nTwo-step verification protects your account by requiring additional verification from the user when signing in to the Admin Panel. In this process, after signing in to the account, a security code is sent to the Admin\u2019s mobile number or email, which then the user has to verify to access the admin panel. It works as an additional security layer which makes difficult for attackers.\r\n<h2 id=\"5\">Limit Admin Access<\/h2>\r\nWant to ensure no one accesses your Admin panel from anywhere else? Just limit your store admin access to your IP Address, and this simple IP restriction will leave a lot of hackers scratching their head when they try to access your Magento 2 store.\r\n<h2 id=\"6\">SSL Certificate<\/h2>\r\nSSL (Secure Socket Layer) secures a website by establishing an encrypted link between a web server and the browser. All the data that passes between this link remains private. SSL is especially important for all websites that deal in online transactions.\r\n\r\nHence, adding <a href=\"https:\/\/magenticians.com\/enable-ssl-in-magento-2\/\" target=\"_blank\" rel=\"noopener noreferrer\">SSL certificate to your Magneto 2 store<\/a> helps protect the private information of your users like login credentials, credit card information, and other sensitive data. To add this layer of security, you have to purchase an SSL Certificate and then configure it your Magento 2 store to force the store pages to load on HTTPS.\r\n<h2 id=\"7\">Create a Backup<\/h2>\r\nIn the unfortunate case where your store is hacked, it&#8217;s important that you have a full backup of your store that restores your Magento 2 to working conditions. In a technologically advanced world where even the hackers are smart, you have to have backups of your Magento 2 store files as well as your Database. You can create backups by downloading all the files using FTP. You can get also get the database by going to PHPMyAdmin.\r\n<h2 id=\"8\">Use Reliable Sources for Magento 2 Extensions<\/h2>\r\nExtensions are essential for a Magento 2 store. Before installing any <a href=\"https:\/\/magenticians.com\/magento-2-top-free-extensions\/\" target=\"_blank\" rel=\"noopener noreferrer\">Magento 2 extension<\/a>, ensure that it has been developed by a reliable developer, the reviews are good, and that it has a good tracking record. To be on the safe side, always get extensions from a reliable and authorized third-party extension maker!\r\n<h2 id=\"9\">Enable Admin Login Captcha<\/h2>\r\nEnabling CAPTCHA prevents hackers and even bots from your Magento 2 store from attackers. You have to enable this awesome Magento 2 feature.\r\n\r\nGo to <strong>Stores \u2192 Configuration<\/strong> from the Admin Panel of your store and then click on <strong>Admin<\/strong> under the <strong>Advanced Tab<\/strong>.\r\n\r\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-6118\" src=\"https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/click-admin.png\" alt=\"click admin\" width=\"265\" height=\"303\" srcset=\"https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/click-admin.png 265w, https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/click-admin-262x300.png 262w\" sizes=\"(max-width: 265px) 100vw, 265px\" \/>\r\n\r\nNow unfold the <strong>CAPTCHA<\/strong> section and select<strong> Yes<\/strong> from <strong>Enable CAPTCHA in Admin<\/strong> drop-down menu. Then select <strong>Admin Forgot Password<\/strong> from the Forms option and set all the remaining values according to your need.\r\n\r\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-6120\" src=\"https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/Enable-CAPTCHA-2.png\" alt=\"Enable CAPTCHA 2\" width=\"918\" height=\"547\" srcset=\"https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/Enable-CAPTCHA-2.png 918w, https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/Enable-CAPTCHA-2-300x179.png 300w, https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/Enable-CAPTCHA-2-300x179@2x.png 600w\" sizes=\"(max-width: 918px) 100vw, 918px\" \/>\r\n\r\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-6119\" src=\"https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/Enable-CAPTCHA-1.png\" alt=\"Enable CAPTCHA 1\" width=\"881\" height=\"424\" srcset=\"https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/Enable-CAPTCHA-1.png 881w, https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/Enable-CAPTCHA-1-300x144.png 300w, https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/Enable-CAPTCHA-1-300x144@2x.png 600w\" sizes=\"(max-width: 881px) 100vw, 881px\" \/>\r\n\r\nAt last, just click on <strong>Save Config <\/strong>from the top of the page.\r\n\r\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-6121\" src=\"https:\/\/magenticians.com\/wp-content\/uploads\/2017\/08\/config-save.png\" alt=\"Click on save config\" width=\"115\" height=\"54\" \/>\r\n<h2 id=\"10\">Configure Action Log<\/h2>\r\nIf you use Magento 2 Enterprise Edition, one of its great features is the configuration of Action Log. The feature helps you track administrator activity and to view all the log history. Not only that, you can also check the source of all the activities in your admin panel and even view the IP of that resource. For community edition, you have to install a third-party extension to add this feature.\r\n<h2 id=\"11\">Bonus Tip<\/h2>\r\nWhen you talk about the security of a store, you can\u2019t ignore the security of your server. It is highly recommended that you host your Magento 2 store on a well-known managed Magento hosting solution. You can find many <a href=\"https:\/\/magenticians.com\/best-managed-magento-hosting-providers\/\" target=\"_blank\" rel=\"noopener noreferrer\">Managed Magento hosting<\/a> providers like Nexcess and Cloudways.\r\n\r\nCurrently <a href=\"https:\/\/www.cloudways.com\/en\/magento-managed-cloud-hosting.php?id=65658&amp;utm_source=affiliate&amp;utm_medium=referral&amp;utm_campaign=m2security&amp;CHAN=impsecurity\" target=\"_blank\" rel=\"noopener noreferrer\">Cloudways<\/a>, they are offering <strong>$25 FREE hosting credit<\/strong>\u00a0if you use the promo code <strong>MGT25<\/strong>. Currently Cloudways is offering best <a href=\"https:\/\/www.cloudways.com\/en\/promo-code.php\" target=\"_blank\" rel=\"noopener\">web host promo codes<\/a>.\r\n<h2>Wrapping Up<\/h2>\r\nIt\u2019s a no-brainer that security should be on the top of your list if you plan to succeed big and give your customers a safe place to shop with complete peace of mind. Use the given tips to overcome your Magento 2 store&#8217;s security\u00a0vulnerabilities and to make your Magento 2 store secure. If you think I have missed any useful tip to improve Magento 2 security, just leave a comment below and I\u2019ll add them here!","protected":false},"excerpt":{"rendered":"<p>Security plays an important role in the success of an online store. If you are running an ecommerce store then it is mandatory to secure your website and protect your customers\u2019 data. Magento 2 is one of the most popular ecommerce platforms and is widely used by online merchants around the world. Today, I am [&hellip;]<\/p>\n","protected":false},"author":1010,"featured_media":6122,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[106],"tags":[348,346,87,746,50,347],"_links":{"self":[{"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/posts\/6117"}],"collection":[{"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/users\/1010"}],"replies":[{"embeddable":true,"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/comments?post=6117"}],"version-history":[{"count":1,"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/posts\/6117\/revisions"}],"predecessor-version":[{"id":14511,"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/posts\/6117\/revisions\/14511"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/media\/6122"}],"wp:attachment":[{"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/media?parent=6117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/categories?post=6117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/magenticians.com\/wp-json\/wp\/v2\/tags?post=6117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}