M Magekwik Scanner
Security audit · passive

Critical. Act now — the store is exposed.

https://magekwik.com/

1 Critical
0 High
6 Medium
5 Low
4 Info

Start here — fix these first

  1. 01 critical Appears exposed to SessionReaper (CVE-2025-54236) if unpatched
  2. 02 medium Content-Security-Policy is report-only (not enforced)
  3. 03 medium Full REST API schema publicly disclosed
  4. 04 medium GraphQL introspection enabled
  5. 05 medium Strict-Transport-Security not set

16 findings · scanned in 64,835 ms · engine 1.0.0 · intelligence vault 2026.08.2

Compliance & exposure lens

PCI DSS 4.0.1 · UK GDPR / PECR

How these findings map to your obligations. 5 indicators of a gap to investigate. These are indicators from an external scan, not a compliance certification.

PCI DSS 4.0.1

  • gap 6.4.3 Payment-page scripts are managed and authorised

    The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.

    • Content-Security-Policy is report-only (not enforced)
  • n/a 11.6.1 Unauthorised change detection on payment pages

    A one-off external scan cannot verify ongoing change detection — this requires continuous, scheduled monitoring of the payment page.

  • gap 6.3.3 Known vulnerabilities are patched

    The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.

    • Appears exposed to SessionReaper (CVE-2025-54236) if unpatched
    • Older critical CVEs on this branch — verify your patch level
  • gap 4.2.1 Strong cryptography for data in transit

    The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.

    • Strict-Transport-Security not set
  • gap 2.2.1 Secure configuration; no unnecessary exposure

    The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.

    • Full REST API schema publicly disclosed
    • SOAP WSDL service list publicly accessible

UK GDPR / PECR

  • gap GDPR Art. 32 Security of processing (personal data)

    The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.

    • Appears exposed to SessionReaper (CVE-2025-54236) if unpatched
    • Older critical CVEs on this branch — verify your patch level
  • n/a PECR reg. 6 Consent before non-essential cookies

    We render the landing page and flag any tracker that fires before consent; none was caught here, but a passive load cannot audit every template, so we do not certify consent compliance either way.

PCI 11.6.1 needs continuous change detection. Watch this payment page for injected scripts and header changes — daily, with an alert on any change.

Monitor this payment page

Critical 1

Evidence
form_key
present
mage_init
present
page_wrapper
present
section_data
present
mage_translate
present
magento_header
X-Magento-Tags
requirejs_mage
present
x-magento-init
present
inferred_branch
2.4
magento_modules
present
static_frontend
present
inferred_edition
Open Source
static_version_path
present
magento_version_endpoint
Magento/2.4 (Community)
observed: https://magekwik.com/
How to fix it

Apply Adobe's APSB25-88 emergency hotfix (VULN-32437) immediately, then rebuild. Actively exploited — treat as urgent, not routine.

  1. 1

    Apply the APSB25-88 isolated hotfix (VULN-32437) for your release line — it closes this without a full upgrade — then rebuild.

    bin/magento setup:upgrade && bin/magento cache:flush
  2. 2

    If there is any sign of exploitation, assume session/admin compromise: invalidate all sessions and rotate admin credentials and integration tokens.

    bin/magento admin:user:unlock; # then flush the session store to force re-authentication
  3. 3

    Optional: move to a patched release on your line. Use your edition's metapackage and the exact fixed version from the advisory.

    composer require magento/product-community-edition:<fixed-version> --no-update && composer update
Read more ↗

Medium 6

Evidence
Content-Security-Policy
absent
Content-Security-Policy-Report-Only
font-src www.paypalobjects.com fonts.gstatic.com use.typekit.net *.typekit.net *.gstatic.com *.cdn-apple.com *.stripe.com *.stripecdn.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.l…
observed: https://magekwik.com/
How to fix it

Switch Magento_Csp from report-only to enforced (restrict) mode for the storefront.

  1. 1

    Enforce the storefront CSP (0 = restrict/enforced).

    bin/magento config:set system/csp/mode/storefront/report_only 0
  2. 2

    Whitelist legitimate inline scripts/domains via csp_whitelist.xml first to avoid breaking the storefront, then flush.

    bin/magento cache:flush config full_page
Read more ↗
Evidence
bytes
130593
endpoint
/rest/all/schema?services=all
observed: https://magekwik.com/rest/all/schema?services=all
How to fix it

Restrict schema/API discovery in production.

  1. 1

    Block the schema endpoint at the edge (legitimate clients do not need it).

    location ~* ^/rest/(all|default)/schema { deny all; return 404; }
  2. 2

    Rate-limit /rest and require authentication for non-guest resources.

Read more ↗
Evidence
query
{__schema{queryType{name} types{name}}}
endpoint
/graphql
observed: https://magekwik.com/graphql?query=%7B__schema%7BqueryType%7Bname%7D%20types%7Bname%7D%7D%7D
{"data":{"__schema":{"queryType":{"name":"Query"},"types":[{"name":"Query"},{"name":"String"},{"name":"ID"},{"name":"Boolean"},{"name":"Int"},{"name":"Float"},{"name":"Mutation"},{"name":"FilterTypeIn
How to fix it

Disable GraphQL introspection in production.

  1. 1

    Set the deployment mode to production (disables introspection by default).

    bin/magento deploy:mode:set production
  2. 2

    If a custom middleware/plugin toggles it, ensure introspection is gated to non-production only, then flush cache.

    bin/magento cache:flush
Read more ↗
Evidence
form_key
present
mage_init
present
older_cves
CVE-2024-34102, CVE-2022-24086
page_wrapper
present
section_data
present
mage_translate
present
magento_header
X-Magento-Tags
requirejs_mage
present
x-magento-init
present
inferred_branch
2.4
magento_modules
present
static_frontend
present
inferred_edition
Open Source
static_version_path
present
magento_version_endpoint
Magento/2.4 (Community)
observed: https://magekwik.com/
How to fix it

Confirm the store is on the latest patch for its release line.

  1. 1

    Check the running version against the latest patch for your line.

    bin/magento --version
  2. 2

    If behind, apply the latest security patches (isolated hotfixes exist for each of these), then rebuild.

    composer update && bin/magento setup:upgrade && bin/magento cache:flush
Read more ↗
Evidence
count
1
domain
magekwik.com
spf_ips
77.72.2.154
How to fix it

Keep the mail-sending IPs separate from the web origin, and firewall the origin to your CDN.

  1. 1

    Restrict the origin to accept HTTP only from your CDN/WAF IP ranges (e.g. Cloudflare Authenticated Origin Pulls or an IP allowlist).

  2. 2

    Send mail from a dedicated relay/IP that is not the web origin, so SPF never discloses the origin address.

Evidence
Strict-Transport-Security
absent
observed: https://magekwik.com/
How to fix it

Emit HSTS from the web server with a >=1 year max-age and includeSubDomains.

  1. 1

    nginx: add to the server block, then reload.

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
  2. 2

    Confirm store base URLs are https and Web > Secure > Use in Storefront/Admin = Yes.

    bin/magento config:set web/secure/use_in_frontend 1
Read more ↗

Low 5

Evidence
dmarc
v=DMARC1; p=none; rua=mailto:support@magekwik.com; ruf=mailto:support@magekwik.com; sp=none; adkim=r; aspf=r; pct=100
How to fix it

Publish a DMARC policy and tighten it once aligned.

  1. 1

    Start in monitor mode to collect reports:

    _dmarc  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain"
  2. 2

    Once SPF/DKIM pass for all legitimate mail, enforce it:

    _dmarc  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain"
Read more ↗
Evidence
Referrer-Policy
absent
observed: https://magekwik.com/
How to fix it

Set a strict referrer policy.

  1. 1

    nginx: add to the server block.

    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
Evidence
endpoint
/soap/default?wsdl_list=1
observed: https://magekwik.com/index.php/soap/default?wsdl_list=1
How to fix it

Disable SOAP if unused, or restrict the endpoint.

  1. 1

    Block the SOAP endpoint at the edge.

    location ~* ^/(index.php/)?soap { deny all; return 404; }
Evidence
form_key
present
mage_init
present
page_wrapper
present
section_data
present
mage_translate
present
magento_header
X-Magento-Tags
requirejs_mage
present
x-magento-init
present
magento_modules
present
static_frontend
present
static_version_path
present
magento_version_endpoint
Magento/2.4 (Community)
observed: https://magekwik.com/magento_version
How to fix it

Block /magento_version at the web server.

  1. 1

    nginx: return 404 for the endpoint.

    location = /magento_version { return 404; }
Evidence
disallowed
/admin/
observed: https://magekwik.com/robots.txt
How to fix it

Do not name sensitive paths in robots.txt; protect them instead.

  1. 1

    Remove admin/backup/staging entries from robots.txt.

  2. 2

    Enforce real access control (auth / IP allowlist) on those paths.

Info 4

Evidence
form_key
present
mage_init
present
page_wrapper
present
section_data
present
mage_translate
present
magento_header
X-Magento-Tags
requirejs_mage
present
x-magento-init
present
magento_modules
present
static_frontend
present
static_version_path
present
magento_version_endpoint
Magento/2.4 (Community)
observed: https://magekwik.com/
Evidence
stack
Luma
signal
page-wrapper
observed: https://magekwik.com/
Evidence
matrix_status
supported
inferred_branch
2.4
observed: https://magekwik.com/
How to fix it

Stay current on the supported line.

  1. 1

    Check your exact version and the latest available patch for the line.

    composer show magento/product-community-edition
  2. 2

    Apply the latest patch for your line.

    composer update magento/product-community-edition
Read more ↗
Evidence
Permissions-Policy
absent
observed: https://magekwik.com/
How to fix it

Declare a least-privilege Permissions-Policy.

  1. 1

    nginx: restrict sensitive features.

    add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;

Full audit

47 checks performed

35 secure · 9 at risk · 3 to verify

Version & CVEs

  • Magento version disclosure low
  • CosmicSting (CVE-2024-34102) verify
  • TrojanOrder (CVE-2022-24086) verify
  • SUPEE security patches Secure
  • Supported release / end-of-life Secure

Exposed files

  • app/etc/env.php Secure
  • app/etc/local.xml (Magento 1) Secure
  • .env file Secure
  • .git repository Secure
  • .svn metadata Secure
  • composer.lock Secure
  • composer.lock SBOM (exact versions + modules) Secure
  • app/etc/config.php Secure
  • Setup / upgrade application Secure
  • Legacy downloader Secure
  • phpinfo() page Secure
  • var/log exposure Secure
  • RELEASE_NOTES.txt Secure
  • pub/errors config Secure
  • Media directory listing Secure

Malware & skimmers

  • Known malware signatures (Visbot / Gurulnc) Secure
  • Known-bad script domains Secure
  • Obfuscated JavaScript Secure
  • Leaked keys in JavaScript Secure

Data exposure

  • Public order RSS feed Secure
  • Public stock RSS feed Secure
  • REST API schema disclosure medium
  • SOAP WSDL disclosure low
  • GraphQL introspection medium
  • robots.txt / sitemap disclosure low

Transport & headers

  • Content-Security-Policy medium
  • Strict-Transport-Security (HSTS) medium
  • Clickjacking (X-Frame-Options) Secure
  • X-Content-Type-Options Secure
  • Referrer-Policy low
  • Permissions-Policy Secure
  • Cookie Secure flag Secure
  • Cookie HttpOnly flag Secure
  • Cookie SameSite Secure
  • TLS certificate & protocol Secure
  • Server software disclosure Secure

Access surface

  • Default admin path Secure
  • Exposed admin tools (Magmi, Adminer) Secure
  • Frontend stack detection Secure

Email & exposure

  • SPF record verify
  • DMARC (spoofing / deliverability) low
  • Subdomain exposure (Certificate Transparency) Secure

To verify = a CVE that affects your branch if unpatched. We can't confirm your patch level remotely — check it against the referenced advisory.

Passive · non-destructive · GET/HEAD only. Inferred findings are clearly marked.