The question is a bit broad, but I'll add my thoughts: > I am doing the below steps to make website built with Magento is > secured. > > 1. security patches update needs to be updated frequently Good! > 2. HTML escape in all Inputs Not good! This can even be counterproductive if used *instead* of the correct "sanitize input, escape output" method. What you should do (and maybe you meant it like that) is escape all **output**. Even here, pay attention to context, `htmlescape` is not always the right choice. See also: https://magento.stackexchange.com/questions/569/how-to-escape-output-data/54768#54768 > 3. Create multiple user for different user (Dev, HTML, Testing, Live user) with different roles Good > 4. HTTP cookies in .htaccess I don't understand that. Are you refering to the "HTTP only" cookie setting? If you don't need access to Cookies via JavaScript, that's a good choice. > 5. X-Frame should be enabled in BO and apache configuration Good. Other HTTP headers for better security are: - `X-Content-Type-Options` - `Strict-Transport-Security` - `Content-Security-Policy` - `X-XSS-Protection` Read more about them: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers > 6. BO admin path should be in a different domain or URL Good, but if you put it on a different domain, also make sure that `frontend-domain/admin` does not redirect to that secret domain > 7. Admin domain should be accessible only from specific IP's Perfect, if that's possible for you. > 8. If we add Load balancer then Session, cache, media storage should be added in centralized location, like s3 Bucket Of course, but I don't see how it is security relevant. > 9. If we add Load balancer then piece of code should be added in index.php for http termination Ref Link : > https://magento.stackexchange.com/questions/14558/magento-wrongly-redirects-https This is a dirty hack that should not be necessary. I recommend setting secure and unsecure base URL to "https" and create a redirect from http urls to https. Here's how to do it with load balancer and ssl termination: https://magento.stackexchange.com/questions/107083/redirect-all-http-request-to-https/107086#107086 > > Do I need to do any more steps to make sure my Magento website is > secured. > ### Other standard procedures - delete or protect `downloader` directory: https://magento.stackexchange.com/questions/16504/recommended-method-to-protect-downloader/98322?s=2|1.7138#98322 - make sure, the `var` directory is not accessible from the web, as well as `app/etc/local.xml` - same for `.git` `composer.json`, `composer.lock` - if they exist. They should better not be deployed to production. - disable execution of PHP in `media` to disarm malicious uploads - Keep PHP itself up to date - Review security of third party extensions, regularly check them for security updates - regularly run tools like the [Magento Malware Scanner](https://github.com/gwillem/magento-malware-scanner) and magereport.com There's much more you can and should do, especially when it comes to secure development practices. Do your research and remember: security is a process. You cannot "make the site secure" and then be done with it. **Update:** I see, there's a duplicate with a more detailed answer https://magento.stackexchange.com/questions/61052/magento-security-punch-list