The question is a bit broad, but I'll add my thoughts:
I am doing the below steps to make website built with Magento is secured.
- security patches update needs to be updated frequently
Good!
- HTML escape in all Inputs
Not good! This can even be counterproductive if used instead of the correct "sanitize input, escape output" method.
What you should do (and maybe you meant it like that) is escape all output. Even here, pay attention to context, htmlescape
is not always the right choice. See also: How to escape output data?
- Create multiple user for different user (Dev, HTML, Testing, Live user) with different roles
Good
- HTTP cookies in .htaccess
I don't understand that. Are you refering to the "HTTP only" cookie setting? If you don't need access to Cookies via JavaScript, that's a good choice.
- X-Frame should be enabled in BO and apache configuration
Good. Other HTTP headers for better security are:
X-Content-Type-Options
Strict-Transport-Security
Content-Security-Policy
X-XSS-Protection
Read more about them: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
- BO admin path should be in a different domain or URL
Good, but if you put it on a different domain, also make sure that frontend-domain/admin
does not redirect to that secret domain
- Admin domain should be accessible only from specific IP's
Perfect, if that's possible for you.
- If we add Load balancer then Session, cache, media storage should be added in centralized location, like s3 Bucket
Of course, but I don't see how it is security relevant.
- If we add Load balancer then piece of code should be added in index.php for http termination Ref Link : Magento wrongly redirects https!
This is a dirty hack that should not be necessary. I recommend setting secure and unsecure base URL to "https" and create a redirect from http urls to https. Here's how to do it with load balancer and ssl termination: Redirect all http:// request to https://
Do I need to do any more steps to make sure my Magento website is secured.
Other standard procedures
- delete or protect
downloader
directory: http://magento.stackexchange.com/questions/16504/recommended-method-to-protect-downloader/98322?s=2|1.7138#98322 - make sure, the
var
directory is not accessible from the web, as well asapp/etc/local.xml
- same for
.git
composer.json
,composer.lock
- if they exist. They should better not be deployed to production. - disable execution of PHP in
media
to disarm malicious uploads - Keep PHP itself up to date
- Review security of third party extensions, regularly check them for security updates
- regularly run tools like the Magento Malware Scanner and magereport.com
There's much more you can and should do, especially when it comes to secure development practices. Do your research and remember: security is a process. You cannot "make the site secure" and then be done with it.
Update: I see, there's a duplicate with a more detailed answer Magento Security Punch list