Platform
Magento and dependency posture
- Confirm supported Magento/PHP versions and relevant security updates
- Review Composer dependencies and abandoned packages
- Inventory extensions and remove unnecessary modules
- Review custom modules for risky patterns and direct core modifications
Access
Reduce unnecessary privilege
- Use strong individual admin accounts and appropriate authentication controls
- Remove dormant users and credentials
- Restrict SSH/database/admin access where practical
- Separate deployment/service credentials and rotate exposed secrets
Infrastructure
Protect the environment around the application
- Keep Linux/web/PHP/database services maintained
- Review file permissions and writable paths
- Use TLS and appropriate CDN/WAF controls
- Limit exposed services and administrative endpoints
- Verify backup isolation and restore capability
Detection
Know when something changes unexpectedly
Logs, file integrity, WAF/CDN events, server metrics and application monitoring should make suspicious changes and operational failures easier to investigate. A backup that has never been restored is not yet a proven recovery plan.
Frequently asked questions
Questions we are often asked
Is this checklist a penetration test?
No. It is a practical operational review. Formal penetration testing is a separate specialist activity.
What should we do after finding malware?
Contain the incident, preserve useful evidence, identify persistence and likely entry routes, clean the environment, remediate the cause and validate before returning to normal operation.
Are backups enough protection?
No, but reliable isolated backups are a critical part of recovery from both security and operational failures.
Related expertise
Continue exploring
Need help applying this to your platform?
We can review your current environment and turn the guidance into a prioritised technical plan.