Magento 2 Admin Security Hardening Checklist
Harden the Magento 2 admin: custom admin path, IP restriction, 2FA, lockout and session settings, user and role cleanup, API integrations and admin logs.
← Back to blog
Articles about Security
9 articles
Magento 2 Admin Two Factor Authentication: Setup and Fixes
Set up Magento 2 admin two factor authentication: providers, forcing a provider, CLI commands to reset users, local development, API tokens and common problems.
Magento 2 Code Review Checklist for Pull Requests
A practical Magento 2 code review checklist: DI and architecture, performance traps, security and escaping, database changes, frontend, tests and deploy impact.
Magento 2 GraphQL Customer Login, Tokens and Security
Customer authentication with Magento 2 GraphQL: login tokens, lifetime, logout, registration, password reset, safe token storage, expiry handling and reCAPTCHA.
Magento 2 Malware Cleanup Checklist for Store Owners
Defensive checklist for a hacked Magento 2 store: signs of compromise, finding injected code in files and database, clean rebuild, new credentials, hardening.
Magento 2 Nginx Configuration: A Production Setup
Set up nginx for Magento 2.4.8: using nginx.conf.sample, TLS in front of Varnish, FastCGI limits, real client IP, admin protection and rate limiting.
Magento 2 Security Patches: How to Stay Up to Date
How Magento 2 security patches work: patch releases, isolated hotfixes, the Quality Patches Tool, how to apply them with Composer and how fast you should move.
How to Audit Third Party Magento 2 Extensions
How to audit third party Magento 2 extensions: inventory, maintenance status, security red flags, plugins and observers that slow the store, and what to cut.
Magento 2 REST API Authentication: Admin, Customer, Integration
How Magento 2 REST API authentication works: admin and customer tokens, integrations, OAuth, bearer settings, 2FA, token lifetimes and safe defaults.