what are steps to do for Security hardening Magento websites [duplicate]

Question

I am doing the below steps to make website built with Magento is secured.

1. security patches update needs to be updated frequently
2. HTML escape in all Inputs
3. Create multiple user for different user (Dev, HTML, Testing, Live user) with different roles
4. HTTP cookies in .htaccess
5. X-Frame should be enabled in BO and apache configuration
6. BO admin path should be in a different domain or URL
7. Admin domain should be accessible only from specific IP's
8. If we add Load balancer then Session, cache, media storage should be added in centralized location, like s3 Bucket
9. If we add Load balancer then piece of code should be added in index.php for http termination Ref Link : Magento wrongly redirects https!

Do I need to do any more steps to make sure my Magento website is secured.

Thanks you your help in advance.

Answer 1

The question is a bit broad, but I'll add my thoughts:

I am doing the below steps to make website built with Magento is secured.

1. security patches update needs to be updated frequently

Good!

2. HTML escape in all Inputs

Not good! This can even be counterproductive if used instead of the correct "sanitize input, escape output" method.

What you should do (and maybe you meant it like that) is escape all output. Even here, pay attention to context, htmlescape is not always the right choice. See also: How to escape output data?

3. Create multiple user for different user (Dev, HTML, Testing, Live user) with different roles

Good

4. HTTP cookies in .htaccess

I don't understand that. Are you refering to the "HTTP only" cookie setting? If you don't need access to Cookies via JavaScript, that's a good choice.

5. X-Frame should be enabled in BO and apache configuration

Good. Other HTTP headers for better security are:

• X-Content-Type-Options
• Strict-Transport-Security
• Content-Security-Policy
• X-XSS-Protection

Read more about them: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers

6. BO admin path should be in a different domain or URL

Good, but if you put it on a different domain, also make sure that frontend-domain/admin does not redirect to that secret domain

7. Admin domain should be accessible only from specific IP's

Perfect, if that's possible for you.

8. If we add Load balancer then Session, cache, media storage should be added in centralized location, like s3 Bucket

Of course, but I don't see how it is security relevant.

9. If we add Load balancer then piece of code should be added in index.php for http termination Ref Link : Magento wrongly redirects https!

This is a dirty hack that should not be necessary. I recommend setting secure and unsecure base URL to "https" and create a redirect from http urls to https. Here's how to do it with load balancer and ssl termination: Redirect all http:// request to https://

Do I need to do any more steps to make sure my Magento website is secured.

Other standard procedures

• delete or protect downloader directory: Recommended method to protect /downloader?
• make sure, the var directory is not accessible from the web, as well as app/etc/local.xml
• same for .git composer.json, composer.lock - if they exist. They should better not be deployed to production.
• disable execution of PHP in media to disarm malicious uploads
• Keep PHP itself up to date
• Review security of third party extensions, regularly check them for security updates
• regularly run tools like the Magento Malware Scanner and magereport.com

There's much more you can and should do, especially when it comes to secure development practices. Do your research and remember: security is a process. You cannot "make the site secure" and then be done with it.

Update: I see, there's a duplicate with a more detailed answer Magento Security Punch list