Take the 2-minute tour ×
Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It's 100% free, no registration required.

Since Magento uses the /downloader as a way to conveniently install programs via Magento Connect Manager it is apparent that this is also a security concern since it allows the possibility for bots or people to attempt to learn credentials for the installation.

Checking access logs to my website, I was alarmed at the amount of attempts to the www.mysite.com/downloader

As a work around I've gotten into the habit of renaming the downloader directory to downloader.offline but occasionally I forget. (Either to rename it back to install a program or after I'm done).

What is the recommended method to protect this link?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Just put a .htaccess (or if nginx/whatever a config) into the directory with Disallow from all in it to forbid any request on the directory.

If you wanted to allow a few IP addresses in (like your own), try something like this in your .htaccess

order deny,allow
deny from all
allow from

Where and are IP addresses you want to let through.

share|improve this answer
Would that prevent myself from accessing? –  sr_magento Mar 10 '14 at 12:34
Sure, no one can access it then. Is Magento connect in this path? Then you need to Allow from <ip> or use authorization –  Fabian Blechschmidt Mar 10 '14 at 13:14
Or better yet, don't use the downloader at all. –  Daniel Sloof Mar 10 '14 at 13:16
Of course! Magento connect doesn't allow reliable reproduction of the system's status and using a version control system. I recommend to use modman or better composer! –  Fabian Blechschmidt Mar 10 '14 at 13:18

Along with @daniel-sloof's recommendation I would say to ditch the Magento Connect installer altogether. I generally add it to .gitignore when setting up a new repository.

The reason being, as Fabian points out in his answer comments, that there is no way to ensure the replication of your production environment in source control without committing the packages from Connect. The feature you'll be losing here is the ability to update/upgrade packages from Connect - but if you really need that functionality you can always do it locally on your dev box and commit the results when you're satisfied that they work.


Delete the /downloader folder or remove it from your source control.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.