We are doing our scheduled PCI scan and for some odd reason, this year they aren't letting the magentostore.com/downloader url slide. It's being marked as an automatic failure due to the plain text form.

They are saying this URL should be HTTPS.

I looked at some of the biggest sites using MagentoCE and Eneterprise, and they too use an HTTP url for the Magento Connect /downloader/ url.

Any help on this matter is greatly appreciated.

Regards, Samuel

  • 2
    If you don't use magento connect just delete the download folder. Aug 28, 2014 at 20:20
  • Seriously? That's it? We don't use it at all. This won't hurt how we manually import files through cpanel or ftp? I see some theme functions got imported into the plugins section of Magento connect. Though we uploaded theme via cpanel.
    – snieves
    Aug 28, 2014 at 20:22
  • 2
    You use FTP!?! Hopefully with encryption, if not, change it. And yes, that's all. If the directory doesn't exist, apache does its normal 404 :-) Aug 28, 2014 at 20:49
  • @FabianBlechschmidt please post it as an answer so that it can be accepted and we have one more answered question :)
    – Simon
    Aug 29, 2014 at 6:09

1 Answer 1


If you don't use magento connect just delete the download folder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.