Put your Magento store through its security MOT.

This is a recognised piece of malicious code, matched by signature. Someone has had access to your store. Card details entered on your site should be assumed to have been taken, and your bank and payment provider need to hear from you.

• Known malware signature detected: SVG onload skimmer (Magecart)
• Known malware signature detected: Visbot malware

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Customer names, order values and order numbers can be read by anyone, with no sign-in. That is a personal-data breach you would have to report, and it hands a competitor your daily takings.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

A key meant to stay on your server is being sent to every visitor's browser. Depending on which one, that can mean taking payments as you, reading customer data, or running up a bill on your account. Change it today — the old one is public.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

This is the padlock in the browser. Depending on the problem, customers may see a warning before they reach your store, or the connection may be weaker than it looks. Either way it affects whether people complete a purchase.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

This file holds your database password and the key that encrypts card and customer data. Anyone who downloads it can decrypt what is in your database and sign in as an administrator. Treat it as a break-in that has already happened.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Your whole codebase can be reconstructed from this, including custom work and anything that was ever committed by mistake — passwords, keys, internal notes. It also tells an attacker precisely which version of everything you run.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

An add-on on your store has had a security problem published against it. We can see the add-on is installed but not which version you have, so this is a question rather than a verdict: your developer runs one command to read the version, and either you are already past it or it is a single-add-on update.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Code written to be unreadable is how card skimmers hide. It is occasionally an extension being careless, so have someone identify it before drawing conclusions — but identify it today.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

There is a flaw in this version of Magento that lets somebody who is not logged in give themselves access they should not have. Adobe released the fix in August, attackers started using it within days, and it was added to the international list of actively-exploited flaws in September. We cannot see from outside whether your store has the update, so this needs answering by whoever maintains it — and if it has not, someone should also look at your admin accounts.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

There is a flaw in this version of Magento that lets someone take over a customer's session, and in some setups run their own code on your server. Adobe released an emergency fix for it. We cannot see from outside whether yours has been applied, so this needs answering by whoever maintains the store.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

There is a flaw in this version of Magento that lets someone run their own code on your server without logging in — the most serious kind there is. Adobe released an emergency fix on 7 September, and attackers were already using it days before that. We cannot see from outside whether yours has been applied. If it has not, treat the store as broken into until somebody has looked, because applying the fix now does not remove anyone who got in before it.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Stores on this version that were never patched had their encryption key stolen, which lets someone forge access to the admin API even after they patch. We cannot see your patch level from outside, so this is one to confirm with your developer.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Adobe supports each release separately, so being on the current line is not the same as being supported. A release past its end date receives no fixes for new flaws at all, however current the line looks.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Your storefront is built on a handful of well-known code libraries, and one of them looks like an old release that has had problems published against it. Whether yours is actually affected depends on whether it was patched without the version being changed, which is a five-minute check for your developer rather than something we can see.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Your store does not restrict which code is allowed to run on its pages. If anything ever injects a card skimmer — through an extension, a compromised supplier, or a stolen login — the browser will run it and nothing will stop it. This is also the control your payment provider asks about under PCI DSS.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

A customer's session can be captured on a shared network and used to act as them. Marking the cookie as secure means the browser refuses to send it insecurely.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Anyone can list every file uploaded to your store, including invoices, customer uploads and files nobody meant to publish.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

It lists every endpoint your store exposes, including ones added by your extensions. An attacker uses it to find the weak one without having to look.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Anyone can download a full description of every piece of data your store can be asked for, including anything your extensions added. It is a blueprint, and turning it off breaks nothing for customers.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Automated attacks try the default address constantly. Moving it stops none of them from succeeding on their own, but it removes your store from the list of easy targets and quietens the noise in your logs.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

You are watching for spoofed email rather than stopping it. Moving the policy up means a fake order confirmation sent as you gets rejected by the receiving mailbox instead of arriving.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Any script running on your store — including an injected one — can read the cookie that identifies a logged-in customer and use it to become them.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Your store uses HTTPS, but a browser that has never visited before can still be pushed to an insecure version on a shared or hostile network — a café, an airport, a hotel. Telling browsers to refuse that closes the gap.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Your store loads code from outside suppliers and would run a new version of it without question. If one of those suppliers is compromised — which is how several Magento stores were hit in 2025 — the replacement code runs on your checkout and nothing on your side notices.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Another site can embed yours invisibly and trick a visitor into clicking something they cannot see — adding to a basket, changing an account, authorising something. Refusing to be embedded costs nothing.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Another site can cause your customer's browser to make a request to your store carrying their session, which is how actions get performed without the customer intending them.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Without a record saying who is allowed to send as you, a scammer can email your customers a convincing fake order or refund notice from your address. It also makes your genuine order confirmations more likely to land in spam.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Every one of these can read anything a customer types, including card details on your checkout. Your card rules require you to keep this exact list, say in writing why each one is there, and be able to tell if any of them changes. Most stores are carrying tags from campaigns that finished years ago.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

When a visitor clicks through to another site, their browser tells it which page of yours they came from. Basket and checkout addresses sometimes carry tokens, and those travel with it.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

It tells anyone asking which web server and PHP version you run, so someone looking for a flaw in that exact version knows to try yours.

• Server header discloses software version
• X-Powered-By discloses PHP/runtime

Your developer needs the details. Open the developer view for the evidence and the exact commands.

The file that tells search engines what to skip is readable by anyone, and listing a path there advertises it to exactly the people you were hiding it from.

• Sitemap references a non-production host
• robots.txt discloses sensitive paths

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Anyone can read your exact Magento version from a public page, which tells them which published weaknesses to try first. It saves an attacker the work of guessing.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Without this instruction a browser may decide an uploaded file is a script and run it. It turns an ordinary file upload into a way in.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Magento puts each add-on's name in the web address of the files it loads, so anyone can read which ones you have installed. That is normal and cannot really be hidden — but it does mean someone can check your list against published problems without touching your store, so the add-ons need keeping up to date.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Background, and what the rest of this report is measured against. Magento Open Source, Adobe Commerce and Mage-OS get security fixes on different schedules from different people, so which one you are on decides who you are waiting on when something is found.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Background. Files your store serves publicly changed between releases, which lets us narrow the version without asking your server directly.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

This is background, and it shapes the advice elsewhere in this report — the way you restrict scripts differs between theme technologies.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

When a researcher finds something wrong with your store, they need somewhere to send it. Without a published contact, it goes to your support inbox and gets closed as spam, or it goes nowhere — and the people who do not give up tend to be the ones you would rather had.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

Anything embedded in your pages can ask for the camera, microphone or location. Declaring what is allowed keeps a third-party widget from asking your customers for things you would never ask for.

Your developer needs the details. Open the developer view for the evidence and the exact commands.

This is background. It decides which version of each fix in this report you are shown, so the commands match what you actually run.

Your developer needs the details. Open the developer view for the evidence and the exact commands.