5

is there a way to check whether Magento store is secured or not just by entering the URL of the store

7

There are a number of tools that can be used, however security is very much a complex matter, you can wrap it in many layers of security measures but if the password to the server is still "password" you have a pretty major security risk going on there.

http://mga.project.steverobbins.name/

That tool will do a quick audit and see if any sensitive areas are easily reachable (admin for example). It will try to detect modules that are installed as well (not always successful from my experience of playing with it).

https://shoplift.byte.nl/ as mentioned above is another useful tool, although so far I've seen a few false positives.

If you are concerned about security the best advice would be to contract a PCI-DSS Compliance Auditor to review the full site and architecture, they will give you a very detailed (we recently had one done and it was in the 40+ pages worth of report) that details every aspect that they can potentially review. It may be overkill for your needs - particularly if your not actually handling sensitive information in the context of PCI Compliance but if you are compliant with it then you should be able to be comfortable in saying your site is secure.

  • looks like mga.project just checks response code against file name in url, not the actual file existence, lol, it gave me 200 OK , just because i had redirect with $args. this was nearly a heart attack... – user2857 May 9 '15 at 12:44
  • this is what i got 200 OK - website.com/customer/account/login/?cfm=none/app/etc/local.xml – user2857 May 9 '15 at 12:49
  • Hi John! Would you like to send me the false positives so I can improve the algo? Thanks! -- willem@byte.nl – Willem May 9 '15 at 16:37
  • @ john I am not able to use the code available on github – Pratik bhatt May 11 '15 at 4:15
1

If you are looking to see if you website is secure from the known recent vulnerability(the "shoplift" bug which is solved by the security patches) you can use https://shoplift.byte.nl/ to check for that you just need to put your stores URLS. For general security if you register you website with Google webmaster they apparently inform you if you they noticed a security issue. Another option is using website scanners(i have never used them so don't know how effective they are). You can find a lot through a search engine

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.