In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of the plugin, there will be at least 2 or 3 additional tabs. debugging information, advertising, promotional offers, 3rd party content, and so on.

All of the contents of these tabs are in direct contact with the developer servers. loaded in frames, scripts, trackers, sniffers. Updated in real time. Some of these scripts are loaded from their partners servers, 3rd party.

Once you open that additional tab, all the information from your current admin session will be available to anyone. Clicking on any link can be even worse.

Magento constantly releases patches, fixing remote code execution, privileges escalation, injections, etc

Many shops have 50+ of different extensions loaded with additional garbage.

so the questions are:


Why the extension developers load all this nonsense into the admin backend, not letting me know about it and without my consent? No way to disable or remove this crap. Do they understand the consequences and take responsibility for the security of information?


Why doesn't Magento prohibit loading all these which does not apply to extension settings? As a general rule, Magento partners must follow basic security rules?

  • Yes, This is done mostly by Big Magento Patners only for their Adversting Purposes. But we can easily remove these unwanted scraps by editing their module codes directly. But magento must Restrict their patners from these type of things on modules. – Ask Bytes Aug 7 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.