In our Magento installation we do not use Magento Connect, we add extensions manually and use git for version-controlling our installation and its extensions. We've blocked all access to Connect via .htaccess, but it would be nice to fully remove it.

Would there be side-effects to removing the entire downloader/ folder, aside from a broken System menu link (which of course can be removed)?

  • Why don't you disable access to Magento connect to all users except the Admin super users? – brentwpeterson Jul 29 '14 at 15:38
  • we recently had a security breach; it's too early to say that Connect has a vulnerability, but at the moment we believe it was a component of the exploit--so fully removing is preferably to operationally disabling. – STW Jul 29 '14 at 15:56
  • 1
    Magento Connect was not the cause of your breach. Dont blame Magento for something you might have missed. – mbalparda Jul 29 '14 at 16:06
  • @mbalparda - oh. Good. – STW Jul 29 '14 at 16:11

We have removed the folder downloader in our frondends server and everything work perfect.

My recommendation for you is first to rename the folder to a random name, wait for a 1 week to make sure that nothing else is broken and after that remove the folder.


  • Thanks for the input, glad to hear it's been done without issue – STW Jul 29 '14 at 16:12

Please note that Connect is a part of the core Magento package. Removing or updating core package is considered a Bad Thing, as whatever you do will get undone once you upgrade, potentially with unwanted side-effects.

So no, there's no good way to fully remove Connect, unless you're willing to render your installation upgradability questionable.

  • Assuming it can be removed by deleting the downloader folder then it can be restored with a single git revert, which is an easy extra step for us to perform during upgrade – STW Jul 29 '14 at 15:55
  • 1
    You still have broken links in backend. – Pronto Jul 29 '14 at 16:10
  • Which is acceptable--my main concern is that the rest of the system continues to function as normal – STW Jul 29 '14 at 16:11
  • 1
    Also several command line tools fail after that, mage script most notably. – Pronto Jul 29 '14 at 16:17
  • Good to know; that bash script is effectively just a CLI interface to Connect though, right? So if I were to remove Connect I should remove that as well. – STW Jul 29 '14 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.