I'm about to start working on a Magento website and with the two security patches released yesterday (SUPEE-7405 & SUPEE-7616) I would like to ensure that all other security patches were installed before attempting them.

I can see from magereport.com that SUPEE 6788 (secrets leak) is not installed but 5344 (Shoplift), 5994 (admin disclosure), 6285 (XSS, RSS), 6482 (XSS) are all installed.

Magereport.com does not confirm if SUPEE-6285 or any of the patches prior to SUPEE-5344.

Is there any way to check on Magento exactly what patches have been installed? in the code or db perhaps?

  • Do you have an app/etc/applied.patches.list file on your Magento install ? This is a file that's automatically created when applying a patch and it should list which patches have been installed. Jan 21, 2016 at 10:55

1 Answer 1


When patches are applied a file named applied.patches.list is added in the app/etc/ directory.


Next to that the patch is nothing more than a diff file so you can see what it should change when you open it and check in the targeted file if it is indeed changed.



UPDATE for 8788

Patch SUPEE-8788, MageReport.com says no, but I say yes

  • You can also check for security issues and applied patches at magereport.com Jan 21, 2016 at 11:06
  • magereport wont show you patches installed 100%, you have to check your files yourself
    – MagenX
    Jan 21, 2016 at 11:48
  • @Klettseb strangly 5344 patch is not in app/etc/applied.patches.lis although magereport.com says it's installed
    – Holly
    Jan 21, 2016 at 14:14
  • there is any script to find out which patch install in our site if app/etc/applied.patches.list is not there Oct 26, 2016 at 6:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.