Skip to main content
Magento

Return to Answer

replaced http://magento.stackexchange.com/ with https://magento.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

What you should do (and maybe you meant it like that) is escape all output. Even here, pay attention to context, htmlescape is not always the right choice. See also: How to escape output data?How to escape output data?

  1. If we add Load balancer then piece of code should be added in index.php for http termination Ref Link : Magento wrongly redirects https!Magento wrongly redirects https!

This is a dirty hack that should not be necessary. I recommend setting secure and unsecure base URL to "https" and create a redirect from http urls to https. Here's how to do it with load balancer and ssl termination: Redirect all http:// request to https://Redirect all http:// request to https://

Update: I see, there's a duplicate with a more detailed answer Magento Security Punch listMagento Security Punch list

What you should do (and maybe you meant it like that) is escape all output. Even here, pay attention to context, htmlescape is not always the right choice. See also: How to escape output data?

  1. If we add Load balancer then piece of code should be added in index.php for http termination Ref Link : Magento wrongly redirects https!

This is a dirty hack that should not be necessary. I recommend setting secure and unsecure base URL to "https" and create a redirect from http urls to https. Here's how to do it with load balancer and ssl termination: Redirect all http:// request to https://

Update: I see, there's a duplicate with a more detailed answer Magento Security Punch list

What you should do (and maybe you meant it like that) is escape all output. Even here, pay attention to context, htmlescape is not always the right choice. See also: How to escape output data?

  1. If we add Load balancer then piece of code should be added in index.php for http termination Ref Link : Magento wrongly redirects https!

This is a dirty hack that should not be necessary. I recommend setting secure and unsecure base URL to "https" and create a redirect from http urls to https. Here's how to do it with load balancer and ssl termination: Redirect all http:// request to https://

Update: I see, there's a duplicate with a more detailed answer Magento Security Punch list

Source Link
Fabian Schmengler
Fabian Schmengler
  • 66.1k
  • 25
  • 188
  • 422

The question is a bit broad, but I'll add my thoughts:

I am doing the below steps to make website built with Magento is secured.

  1. security patches update needs to be updated frequently

Good!

  1. HTML escape in all Inputs

Not good! This can even be counterproductive if used instead of the correct "sanitize input, escape output" method.

What you should do (and maybe you meant it like that) is escape all output. Even here, pay attention to context, htmlescape is not always the right choice. See also: How to escape output data?

  1. Create multiple user for different user (Dev, HTML, Testing, Live user) with different roles

Good

  1. HTTP cookies in .htaccess

I don't understand that. Are you refering to the "HTTP only" cookie setting? If you don't need access to Cookies via JavaScript, that's a good choice.

  1. X-Frame should be enabled in BO and apache configuration

Good. Other HTTP headers for better security are:

  • X-Content-Type-Options
  • Strict-Transport-Security
  • Content-Security-Policy
  • X-XSS-Protection

Read more about them: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers

  1. BO admin path should be in a different domain or URL

Good, but if you put it on a different domain, also make sure that frontend-domain/admin does not redirect to that secret domain

  1. Admin domain should be accessible only from specific IP's

Perfect, if that's possible for you.

  1. If we add Load balancer then Session, cache, media storage should be added in centralized location, like s3 Bucket

Of course, but I don't see how it is security relevant.

  1. If we add Load balancer then piece of code should be added in index.php for http termination Ref Link : Magento wrongly redirects https!

This is a dirty hack that should not be necessary. I recommend setting secure and unsecure base URL to "https" and create a redirect from http urls to https. Here's how to do it with load balancer and ssl termination: Redirect all http:// request to https://

Do I need to do any more steps to make sure my Magento website is secured.

Other standard procedures

There's much more you can and should do, especially when it comes to secure development practices. Do your research and remember: security is a process. You cannot "make the site secure" and then be done with it.

Update: I see, there's a duplicate with a more detailed answer Magento Security Punch list