It's possible to protect a website built with magento to the scan activity of some CMS detector, like Wappalyzer?


Not entirely, except if you remove or disguise all Magento features. But you can make it harder:

  • change admin URL, remove downloader directory (you should do that anyway to protect your store)
  • show "404 Not Found" status for forbidden directories like shell and var instead of "403 Forbidden" to not give away their presence. See Recommended method to protect /downloader?
  • change base directories for skin and media, because the typical image paths are easy to recognize
  • Don't build your theme skin upon any of the default base themes and remove those from skin/frontend, otherwise it is possible to recognize the default style sheets (see: Determine Magento version without access to code base)
  • Change the URL routes for pages like customer login, checkout or product reviews. There are extensions that help you with that, like https://github.com/klein0r/magento-language-routes

Doing all this just to disguise that you run on Magento is quite expensive, if you did not already build a theme from scratch with no default templates and styles, so you have to decide if it's really worth it.

  • Can I remove the /downloader folder? @fschmengler – stsnow Mar 11 '16 at 13:06
  • Yes, except if you want to use the Magento connect manager, but you should not do that on a production site anyway – Fabian Schmengler Mar 11 '16 at 13:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.