Skip to content
MAGEKWIKScanner

Magento 2 & Adobe Commerce security

Scan your Magento store for known vulnerabilities

A free, passive audit: a clear grade, every issue ranked by risk, and the exact command to fix each one — without ever touching your store.

Checking your store…

Confirming it’s Magento, then starting the scan.

3 stores scanned 35 issues surfaced

Detects CosmicSting, TrojanOrder, Magecart skimmers, exposed config, and 40+ more — all passive.

Free No signup Passive & read-only

What you get

A real report, not a scare

A

A grade you can trust

One glance tells you where you stand — weighted so a single confirmed critical means F. Not a vanity badge.

B

Every issue, ranked

Version & CVE exposure, exposed files, skimmer/malware, TLS, headers, RSS leaks — prioritised by real risk.

C

The exact fix

Each finding ships copy-paste composer / patch / nginx commands. We tell you precisely what to run.

Methodology

What we check

More than forty checks across six areas — every one passive and read-only. We only issue GET/HEAD requests; we never log in, submit forms, or change anything.

Version & CVE exposure

Inferred version, end-of-life status, CosmicSting & TrojanOrder.

Exposed files & config

env.php, local.xml, .git/.svn, composer.lock, logs, backups.

Malware & skimmers

Magecart heuristics, named signatures (Visbot, Gurulnc), bad domains.

Data exposure

Public order RSS feeds, REST/SOAP schema, secret keys in JS.

Transport & headers

TLS & certificate, HSTS, CSP, X-Frame-Options, cookie flags.

Access surface

Default admin path, GraphQL introspection, Magmi/Adminer, media listing.

See a real report

Sample scan

At risk. Several serious issues need fixing.

https://cladco.co.uk/

1 Critical
0 High
5 Medium
1 Low
4 Info

Start here — fix these first

  1. 01 critical Appears exposed to SessionReaper (CVE-2025-54236) if unpatched
  2. 02 medium Content-Security-Policy is report-only (not enforced)
  3. 03 medium Cookies set without the Secure flag
  4. 04 medium GraphQL introspection enabled
  5. 05 medium Non-production subdomains exposed in Certificate Transparency logs

11 findings · scanned in 20,793 ms · engine 1.0.0 · intelligence vault 2026.08.2

Compliance & exposure lens

PCI DSS 4.0.1 · UK GDPR / PECR

How these findings map to your obligations. 3 indicators of a gap to investigate. These are indicators from an external scan, not a compliance certification.

PCI DSS 4.0.1

  • gap 6.4.3 Payment-page scripts are managed and authorised

    The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.

    • Content-Security-Policy is report-only (not enforced)
  • n/a 11.6.1 Unauthorised change detection on payment pages

    A one-off external scan cannot verify ongoing change detection — this requires continuous, scheduled monitoring of the payment page.

  • gap 6.3.3 Known vulnerabilities are patched

    The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.

    • Appears exposed to SessionReaper (CVE-2025-54236) if unpatched
    • Older critical CVEs on this branch — verify your patch level
  • ok 4.2.1 Strong cryptography for data in transit

    The checks observable from outside passed. This is not a certification.

  • ok 2.2.1 Secure configuration; no unnecessary exposure

    The checks observable from outside passed. This is not a certification.

UK GDPR / PECR

  • gap GDPR Art. 32 Security of processing (personal data)

    The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.

    • Appears exposed to SessionReaper (CVE-2025-54236) if unpatched
    • Older critical CVEs on this branch — verify your patch level
  • n/a PECR reg. 6 Consent before non-essential cookies

    We render the landing page and flag any tracker that fires before consent; none was caught here, but a passive load cannot audit every template, so we do not certify consent compliance either way.

PCI 11.6.1 needs continuous change detection. Watch this payment page for injected scripts and header changes — daily, with an alert on any change.

Monitor this payment page

Critical 1

Evidence
form_key
present
mage_init
present
page_wrapper
present
section_data
present
frontend_hyva
present
checkout_config
present
inferred_branch
2.x
static_frontend
present
static_version_path
present
observed: https://cladco.co.uk/
How to fix it

Apply Adobe's APSB25-88 emergency hotfix (VULN-32437) immediately, then rebuild. Actively exploited — treat as urgent, not routine.

  1. 1

    Apply the APSB25-88 isolated hotfix (VULN-32437) for your release line — it closes this without a full upgrade — then rebuild.

    bin/magento setup:upgrade && bin/magento cache:flush
  2. 2

    If there is any sign of exploitation, assume session/admin compromise: invalidate all sessions and rotate admin credentials and integration tokens.

    bin/magento admin:user:unlock; # then flush the session store to force re-authentication
  3. 3

    Optional: move to a patched release on your line. Use your edition's metapackage and the exact fixed version from the advisory.

    composer require magento/product-<your-edition>-edition:<fixed-version> --no-update && composer update
Read more ↗

Medium 5

Evidence
Content-Security-Policy
absent
Content-Security-Policy-Report-Only
font-src www.paypalobjects.com fonts.gstatic.com use.typekit.net *.typekit.net *.gstatic.com *.cdn-apple.com fonts.googleapis.com *.googleapis.com data: *.stripe.com *.stripecdn.com klarna.com *.kl…
observed: https://cladco.co.uk/
How to fix it

Switch Magento_Csp from report-only to enforced (restrict) mode for the storefront.

  1. 1

    Enforce the storefront CSP (0 = restrict/enforced).

    bin/magento config:set system/csp/mode/storefront/report_only 0
  2. 2

    Whitelist legitimate inline scripts/domains via csp_whitelist.xml first to avoid breaking the storefront, then flush.

    bin/magento cache:flush config full_page
Read more ↗
Evidence
affected_cookies
wp_ga4_user_id, wp_ga4_customerGroup
observed: https://cladco.co.uk/
How to fix it

Set Secure on the affected cookies.

  1. 1

    Magento cookie flags: set web/cookie configuration and ensure the store is served exclusively over HTTPS.

    bin/magento config:set web/cookie/cookie_httponly 1
  2. 2

    Enforce Secure + SameSite at the edge for cookies the app does not manage.

    proxy_cookie_flags ~ secure samesite=lax;
Evidence
query
{__schema{queryType{name} types{name}}}
endpoint
/graphql
observed: https://cladco.co.uk/graphql?query=%7B__schema%7BqueryType%7Bname%7D%20types%7Bname%7D%7D%7D
{"data":{"__schema":{"queryType":{"name":"Query"},"types":[{"name":"Query"},{"name":"String"},{"name":"Float"},{"name":"Boolean"},{"name":"Int"},{"name":"ID"},{"name":"Mutation"},{"name":"FilterTypeIn
How to fix it

Disable GraphQL introspection in production.

  1. 1

    Set the deployment mode to production (disables introspection by default).

    bin/magento deploy:mode:set production
  2. 2

    If a custom middleware/plugin toggles it, ensure introspection is gated to non-production only, then flush cache.

    bin/magento cache:flush
Read more ↗
Evidence
source
crt.sh (Certificate Transparency)
total_flagged
2
risky_subdomains
test.apps.cladco.co.uk, test.cladco.co.uk
How to fix it

Lock down or take offline every non-production host.

  1. 1

    Confirm which of these resolve and respond, then put them behind auth / an IP allowlist, or take them offline.

  2. 2

    Never run production data on an unprotected staging host; scrub PII from non-prod databases.

  3. 3

    Front non-prod with the same WAF/CDN as production so they are not a soft target.

Read more ↗
Evidence
form_key
present
mage_init
present
older_cves
CVE-2024-34102, CVE-2022-24086
page_wrapper
present
section_data
present
frontend_hyva
present
checkout_config
present
inferred_branch
2.x
static_frontend
present
static_version_path
present
observed: https://cladco.co.uk/
How to fix it

Confirm the store is on the latest patch for its release line.

  1. 1

    Check the running version against the latest patch for your line.

    bin/magento --version
  2. 2

    If behind, apply the latest security patches (isolated hotfixes exist for each of these), then rebuild.

    composer update && bin/magento setup:upgrade && bin/magento cache:flush
Read more ↗

Low 1

Evidence
Referrer-Policy
absent
observed: https://cladco.co.uk/
How to fix it

Set a strict referrer policy.

  1. 1

    nginx: add to the server block.

    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Info 4

Evidence
form_key
present
mage_init
present
page_wrapper
present
section_data
present
frontend_hyva
present
checkout_config
present
static_frontend
present
static_version_path
present
observed: https://cladco.co.uk/
Evidence
Permissions-Policy
absent
observed: https://cladco.co.uk/
How to fix it

Declare a least-privilege Permissions-Policy.

  1. 1

    nginx: restrict sensitive features.

    add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
Evidence
source
gwillem/magento-version-identification; Adobe Commerce 2.4.4 release notes
implies
2.4.3 or older
discriminator
TinyMCE 4 admin bundle
observed: https://cladco.co.uk/static/adminhtml/Magento/backend/en_US/tiny_mce_4/tinymce.min.js
Evidence
source
gwillem/magento-version-identification; Adobe Commerce 2.4.4 release notes
implies
2.4.4 or newer
discriminator
TinyMCE 5 admin bundle
observed: https://cladco.co.uk/static/adminhtml/Magento/backend/en_US/tiny_mce_5/tinymce.min.js

Full audit

47 checks performed

26 secure · 4 at risk · 3 to verify · 14 inconclusive

Version & CVEs

  • Magento version disclosure Secure
  • CosmicSting (CVE-2024-34102) verify
  • TrojanOrder (CVE-2022-24086) verify
  • SUPEE security patches Secure
  • Supported release / end-of-life Secure

Exposed files

  • app/etc/env.php Inconclusive
  • app/etc/local.xml (Magento 1) Inconclusive
  • .env file Inconclusive
  • .git repository Inconclusive
  • .svn metadata Inconclusive
  • composer.lock Inconclusive
  • composer.lock SBOM (exact versions + modules) Inconclusive
  • app/etc/config.php Inconclusive
  • Setup / upgrade application Inconclusive
  • Legacy downloader Inconclusive
  • phpinfo() page Inconclusive
  • var/log exposure Inconclusive
  • RELEASE_NOTES.txt Inconclusive
  • pub/errors config Inconclusive
  • Media directory listing Secure

Malware & skimmers

  • Known malware signatures (Visbot / Gurulnc) Secure
  • Known-bad script domains Secure
  • Obfuscated JavaScript Secure
  • Leaked keys in JavaScript Secure

Data exposure

  • Public order RSS feed Secure
  • Public stock RSS feed Secure
  • REST API schema disclosure Secure
  • SOAP WSDL disclosure Secure
  • GraphQL introspection medium
  • robots.txt / sitemap disclosure Secure

Transport & headers

  • Content-Security-Policy medium
  • Strict-Transport-Security (HSTS) Secure
  • Clickjacking (X-Frame-Options) Secure
  • X-Content-Type-Options Secure
  • Referrer-Policy low
  • Permissions-Policy Secure
  • Cookie Secure flag medium
  • Cookie HttpOnly flag Secure
  • Cookie SameSite Secure
  • TLS certificate & protocol Secure
  • Server software disclosure Secure

Access surface

  • Default admin path Secure
  • Exposed admin tools (Magmi, Adminer) Secure
  • Frontend stack detection Secure

Email & exposure

  • SPF record Secure
  • DMARC (spoofing / deliverability) Secure
  • Subdomain exposure (Certificate Transparency) verify

To verify = a CVE that affects your branch if unpatched. We can't confirm your patch level remotely — check it against the referenced advisory.