0

I checked my site in Magento SECURITY SCAN and found these result.

  1. Magento Brute Force
  2. Magento SUPEE 5994
  3. Magento SUPEE 6285
  4. SSL TLS

I tried to solve these but not getting success. What I can do on these issues.

I am doing these check because I am getting lot of spam with account creation in-spite of I have configured captcha in registration page.

enter image description here

1 Answer 1

0

I am doing these check because I am getting lot of spam with account creation in-spite of I have configured captcha in registration page.

that's nothing to do with the security stuff ( but you should get that sorted)

for account creation spam try this: Spam customer registrations, CAPTCHA not stopping it, Max field rule being bypassed

Magento Brute Force

that means that anyone can get on your admin logins, so a bot can just keep guessing admin users and passwords until they get it (don't have a user called "admin"). If you restrict you admin login pages via ip address that will protect you from that.

More info: https://support.hypernode.com/knowledgebase/how-to-protect-your-magento-store-against-brute-force/

Magento SUPEE 5994

Thats an old patch, Released May 14th, 2015 weird that thats getting flagged and not more recent one:

Magento SUPEE 6285

again an old patch, Released July 7th, 2015

SSL TLS

You need to update your ssl setting on your server to not support TLS 1.0 (you might have to ask your hosting to do this)

Try scanning with https://www.magereport.com to see if they pick up other patches not installed

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.