The question is a bit broad, but I'll add my thoughts:
I am doing the below steps to make website built with Magento is
- security patches update needs to be updated frequently
- HTML escape in all Inputs
Not good! This can even be counterproductive if used instead of the correct "sanitize input, escape output" method.
What you should do (and maybe you meant it like that) is escape all output. Even here, pay attention to context,
htmlescape is not always the right choice. See also: How to escape output data?
- Create multiple user for different user (Dev, HTML, Testing, Live user) with different roles
- HTTP cookies in .htaccess
- X-Frame should be enabled in BO and apache configuration
Good. Other HTTP headers for better security are:
Read more about them: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
- BO admin path should be in a different domain or URL
Good, but if you put it on a different domain, also make sure that
frontend-domain/admin does not redirect to that secret domain
- Admin domain should be accessible only from specific IP's
Perfect, if that's possible for you.
- If we add Load balancer then Session, cache, media storage should be added in centralized location, like s3 Bucket
Of course, but I don't see how it is security relevant.
- If we add Load balancer then piece of code should be added in index.php for http termination Ref Link :
Magento wrongly redirects https!
This is a dirty hack that should not be necessary. I recommend setting secure and unsecure base URL to "https" and create a redirect from http urls to https. Here's how to do it with load balancer and ssl termination: Redirect all http:// request to https://
Do I need to do any more steps to make sure my Magento website is
Other standard procedures
- delete or protect
downloader directory: Recommended method to protect /downloader?
- make sure, the
var directory is not accessible from the web, as well as
- same for
composer.lock - if they exist. They should better not be deployed to production.
- disable execution of PHP in
media to disarm malicious uploads
- Keep PHP itself up to date
- Review security of third party extensions, regularly check them for security updates
- regularly run tools like the Magento Malware Scanner and magereport.com
There's much more you can and should do, especially when it comes to secure development practices. Do your research and remember: security is a process. You cannot "make the site secure" and then be done with it.
Update: I see, there's a duplicate with a more detailed answer Magento Security Punch list