4

It's possible to protect a website built with magento to the scan activity of some CMS detector, like Wappalyzer?

Improve this question
0

1 Answer 1

Reset to default
5

Not entirely, except if you remove or disguise all Magento features. But you can make it harder:

  • change admin URL, remove downloader directory (you should do that anyway to protect your store)
  • show "404 Not Found" status for forbidden directories like shell and var instead of "403 Forbidden" to not give away their presence. See Recommended method to protect /downloader?
  • change base directories for skin and media, because the typical image paths are easy to recognize
  • Don't build your theme skin upon any of the default base themes and remove those from skin/frontend, otherwise it is possible to recognize the default style sheets (see: Determine Magento version without access to code base)
  • Change the URL routes for pages like customer login, checkout or product reviews. There are extensions that help you with that, like https://github.com/klein0r/magento-language-routes

Doing all this just to disguise that you run on Magento is quite expensive, if you did not already build a theme from scratch with no default templates and styles, so you have to decide if it's really worth it.

Improve this answer
2
  • Can I remove the /downloader folder? @fschmengler
    – stsnow
    Commented Mar 11, 2016 at 13:06
  • Yes, except if you want to use the Magento connect manager, but you should not do that on a production site anyway
    – Fabian Schmengler
    Commented Mar 11, 2016 at 13:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.