I just setup Magmi, wanting to use it for making importing stuff easier. However, I was pretty dazzled when I visited magento magmi/web/magmi.php and realized I didn't ask for any login credentials.

Can someone please explain me how this can be safe?



I'd suggest using htpassword. It's probably the easiest way. You can generate the files here: http://www.web2generators.com/apache-tools/htpasswd-generator

Place the generated .htpassword outside of the public site directory (so one up from where you installed Magento) and in your Magmi folder place a .htaccess file with the following content

AuthUserFile /home/website/.htpasswd <-- or whatever path
AuthType Basic
AuthName "My restricted Area"
Require valid-user
  • Thanks! But is it seriously not supposed to be password protected by default? Sep 10 '15 at 11:50
  • @user2806026 nope, not that I know of. You'd be amazed how many shops have magmi exposed
    – Sander Mangel
    Sep 10 '15 at 11:51
  • I've just installed magmi 0.7.22 and have been asked for a username and password.
    – Edward
    Jan 14 '16 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.