Magento Security Guide for Enterprise Stores

In short: This pillar page walks through why Magento attracts attackers, who owns Magento security across an enterprise build, the non-negotiable foundations, where PCI DSS and payment obligations sit, and how to build a layered, tested defence. Each section links to a deeper guide, so by the end you’ll know exactly where your exposure lies and what to fix first.

Why Magento stores are a target

Magento’s popularity, handling of payment data and open, extensible architecture make it a consistently attractive target, and attackers know exactly how to find vulnerable stores. Automated bots continuously scan the web for Magento stores running outdated versions or exposed admin panels, because they’re a reliable, well-documented way in.

The threat isn’t abstract. In 2024, the CosmicSting vulnerability (CVE-2024-34102) left an estimated 75% of Adobe Commerce and Magento stores exposed, and attackers used it to plant payment skimmers on thousands of sites. In late 2025, the critical SessionReaper vulnerability (CVE-2025-54236) prompted an emergency Adobe patch and, weeks later, a large share of stores still hadn’t applied it. The pattern repeats with every major disclosure: a flaw is published, attackers weaponise it within days, and the stores that haven’t been patched get hit.

The most damaging attacks are the quiet ones. E-skimming (also called Magecart) injects malicious JavaScript into a store’s checkout to steal card details in real time, completely bypassing server-side defences, and it can run undetected for weeks. If you suspect your store may already be compromised, our guide on how to tell if your Magento store has been hacked covers the warning signs and what you should do.

Read about the most significant Magento vulnerabilities in our guide.

Who is responsible for Magento security?

This is the single most important thing to understand: on Magento, security is mostly your responsibility, far more than on a hosted SaaS platform. The PCI DSS standard and underlying security obligations are the same for every platform, but who carries the burden of meeting them differs sharply.

• Fully hosted SaaS (Shopify, BigCommerce): The platform is PCI DSS Level 1 compliant as standard, applies patches automatically and absorbs most of the security burden. Less control, less responsibility.
• Magento Open Source (self-hosted): Neither the platform nor the server is PCI certified out of the box. Patching, hardening, monitoring, scanning and compliance are entirely yours.
• Adobe Commerce Cloud (managed): Adobe covers infrastructure-level controls and publishes a shared-responsibility model, but application-level controls, patch currency, customisations and your compliance filing remain yours.

This trade-off – control in exchange for responsibility – is the defining characteristic of Magento security, and it’s why the platform rewards stores that invest in doing it properly. We compare the platforms in detail in Magento vs Shopify vs BigCommerce: which is most secure?.

The foundations of a secure Magento store

Most Magento security breaches don’t exploit unique, never-seen-before attacks; they exploit known weaknesses on stores that were never checked. These foundations close off the overwhelming majority of that risk. The systematic way to find where you stand across all of them is a Magento vulnerability assessment.

Patch management

Running a supported version and applying Adobe’s security patches promptly is the highest-value security activity, because most breaches exploit flaws that were already fixed by a patch the store never installed. Subscribe to Adobe Security Bulletins, test patches in staging and apply critical patches to a documented SLA. Stores still on the end-of-life Magento 1 platform can’t do this at all, which is a serious risk covered in our recent post, “Is Magento 1 still safe?”

Extensions and custom code

Every third-party extension is an inherited risk. Maintain a complete inventory with versions, keep extensions current and from reputable sources, remove anything abandoned or unused and review custom code for security flaws. A single vulnerable extension can expose the entire store.

Admin and access control

The admin panel forms the keys to the kingdom. Enforce two-factor authentication on every admin account, move the admin to a non-default URL, use strong, unique passwords, enforce least-privilege access and remove dormant accounts. A single weak admin login can mean full store takeover.

Configuration and hardening

Enforce TLS 1.2 or higher everywhere, configure security headers (including a Content Security Policy), restrict file permissions, rotate secret and encryption keys, and remove developer and installation files from production. These are low-effort fixes that close off a lot of automated attacks.

Infrastructure and hosting

Put a web application firewall (WAF) in front of the store, enable DDoS protection, keep the server OS patched and run automated backups that you’ve actually tested by restoring them. Your hosting choice and configuration are part of your security posture, not separate from it.

Payment security and PCI compliance

If your store takes card payments, PCI DSS compliance isn’t optional, and since March 2025 the rules got significantly stricter. PCI DSS v4.0 is now fully enforced, including 51 previously future-dated requirements that became mandatory on 31 March 2025.

Two of those requirements matter most for Magento, because they target the e-skimming attacks common to the platform: Requirement 6.4.3 (maintain a full inventory of every script on your payment pages, each justified) and Requirement 11.6.1 (detect and alert unauthorised changes to those scripts and headers). The stakes are real and well documented, as the two largest UK ecommerce data-protection fines, British Airways (£20m) and Ticketmaster (£1.25m), were both payment-page script attacks.

Your compliance burden depends heavily on your checkout architecture. Keeping cardholder data off your server (via your payment provider’s tokenisation) typically puts you on a lighter Self-Assessment Questionnaire (SAQ). Our full guide to PCI compliance for Magento stores explains the requirements, SAQ types and where to start.

The key principle: your real security level is set by your weakest layer, not your strongest. A perfectly patched store with no monitoring is blind; a heavily monitored store that never patches is just watching itself get breached. Our guide to layered security for Magento covers how the layers fit together, and how a WAF and monitoring work in practice.

Testing and validation

You can assume your defences work, or you can test them. The difference is everything. Two complementary activities do this.

 

A vulnerability assessment finds and catalogues weaknesses across your store – the broad, systematic sweep. A penetration test goes further, with a skilled tester actively trying to exploit those weaknesses the way a real attacker would. Assessments tell you what’s wrong; pen tests prove what’s exploitable. Most stores should run assessments and scans regularly, with a penetration test at least annually and after major changes.

If you’re budgeting for testing, our guide to how much Magento penetration testing costs gives honest UK figures and explains what separates a genuine manual test from an automated scan with a polished report.

What an ongoing Magento security programme looks like

The stores that stay secure treat security as a continuous cycle, not a project with an end date. A sound programme runs on a cadence:

• Continuously: WAF active, monitoring and alerting running, file-integrity and payment-page checks live.
• Monthly: Apply security patches; review admin access.
• Quarterly: Internal and external vulnerability scans (an ASV scan is required for PCI); review your control documentation.
• Annually (and after major changes): A full penetration test; renew your PCI SAQ.

Mapping your store against this cadence is exactly what our enterprise Magento security assessment checklist is built for. It’s a free, 50+ point self-assessment across every area in this guide.

How BRIGHT helps with Magento Security 

BRIGHT specialises in Magento and Adobe Commerce security and compliance. Our Magento security specialists run the same framework described in this guide as the basis for a full security review.

If you want to know exactly where your store stands, a Magento security audit gives you a prioritised, expert assessment and a clear remediation plan. 

Key takeaways

• Magento security spans five areas: patching, access control, configuration/infrastructure, payment/PCI compliance and monitoring/testing.
• On Magento, most security responsibility sits with the merchant, unlike fully hosted SaaS platforms, so it must be actively managed.
• Most breaches exploit known, already-patched flaws, which makes prompt patching the single highest-value activity.
• PCI DSS v4.0 is fully enforced; payment-page script controls (6.4.3 and 11.6.1) are now critical for Magento.
• Security is a continuous cycle – prevent, detect and validate – not an annual checkbox. Your weakest layer sets your real security level.

Frequently asked questions about Magento Security

Is Magento secure?

Yes, Magento can be highly secure, and many of the world’s largest stores run on it. But unlike hosted SaaS platforms, that security isn’t automatic: it depends on patching, hardening, monitoring and testing that the merchant is responsible for. Properly maintained, Magento is enterprise-grade; neglected, it’s exposed.

How do I secure a Magento store?

Start with the foundations: run a supported version and patch promptly, keep extensions current, enforce two-factor authentication on admin accounts, harden your configuration and TLS, add a WAF and secure your payment pages. Then add monitoring to detect problems and regular testing to validate your defences. A vulnerability assessment is the best way to find your current gaps.

Is Adobe Commerce more secure than Magento Open Source?

Adobe Commerce (especially on Adobe Commerce Cloud) shifts some security burden, particularly infrastructure-level controls, onto Adobe under a shared-responsibility model, which reduces your workload. But application-level security, patching and compliance remain your responsibility on both. The platform gives you a stronger managed baseline on Cloud; it doesn’t remove your obligations.

How often should I check my Magento store’s security?

Run vulnerability scans at least quarterly, apply security patches as they’re released and conduct a full penetration test at least annually and after any major change. Continuous monitoring should run in between. For PCI compliance, quarterly ASV scans and annual testing are required.

Does Magento handle PCI compliance for me?

No. Neither Magento Open Source nor Adobe Commerce is PCI certified out of the box; achieving and maintaining compliance is the merchant’s responsibility. The platform can be configured to meet the standard, but the controls, scanning and self-assessment are yours to manage.