Essential cybersecurity for your store in Adobe Commerce

It is a Sunday night when the operations manager of a mid-sized online retailer receives a message from the payment provider. Unusual card testing activity has been detected on the store, and some transactions are being declined in bulk. By Monday morning the board is on a call, customer service has a queue of confused shoppers, and the legal team is asking what personal data was exposed. Nobody in the company can say with certainty which version of the platform is running, who has administrator access or when the last backup was tested. The store had not been attacked by a sophisticated adversary. It had been left, month after month, without the routine care that keeps an online store safe.

Cybersecurity has become a top priority for e-commerce businesses, especially when handling sensitive customer data and online transactions. Platforms such as Magento (Adobe Commerce) offer powerful capabilities for building secure and scalable online stores, but they need to be properly configured and managed to avoid vulnerabilities. A single security breach can compromise sensitive information and seriously damage a brand's reputation and trust.

The short answer

Securing an Adobe Commerce store depends on routine discipline more than on any single tool. Apply security patches as soon as they are released, install extensions only from trusted sources, enable two-factor authentication, change the default admin user and URL, enforce strong passwords, audit regularly, keep tested backups and update the server. Together these habits close the doors attackers use most often.

What this means for the C-level

Magento includes native security features such as two-factor authentication (2FA), data encryption and frequent updates. However, effective protection requires constant monitoring, patching and a proactive approach to threats. Administrators and developers must take an active role, implementing strong passwords, limiting access and properly validating third-party integrations. This article addresses the key aspects of Magento cybersecurity, highlighting best practices and useful recommendations to protect your online store. Investing in a solid security strategy ensures business continuity, customer data protection and brand credibility.

For an executive, the case for investing is financial as well as reputational. IBM's 2025 Cost of a Data Breach report put the global average cost of a breach at 4.44 million dollars, with breaches taking an average of 241 days to identify and contain, and with malicious activity behind 51 percent of incidents and human error behind a further 26 percent (CyberScoop, coverage of IBM's Cost of a Data Breach Report 2025). The human error share is the one that leadership can influence most directly, because it is made up of unpatched systems, shared passwords and unreviewed access, which are the same topics covered below. A modest budget for routine security work is small next to the cost of a single serious incident.

Three questions help leadership assess the situation without technical jargon. Who is accountable for the security of the store, internally and at the agency or hosting provider? How quickly does the company apply a security patch once it is released, and who approves the maintenance window? When was the last time a backup was restored on a test environment to prove that it works? If any of the three answers is vague, the company has found its first priority. Next, we will see some basic measures that can be applied to improve the security of our online store. For some of these, you will be able to apply them yourself, and in others, you will need the assistance of a Magento expert. For a view of how the platform exposes data to other systems, see How to create a simple web API, since every integration is also a door that needs a lock. Let us start.

Applying security patches

Security patches are constantly being released by Magento itself, covering the latest vulnerability discoveries. Being up to date with these patches can be perhaps our greatest ally. Contact your server administrator to guide you through the process of applying these patches. Not being updated with these security patches makes our site an easy target for attackers.

Adobe's own security recommendations say the same. They advise staying on the latest release, including security patches, hotfixes and extensions, note that security updates typically ship quarterly with hotfixes possible for major threats, and recommend subscribing to the Adobe Security Notification Service so that the company hears about new bulletins immediately (Adobe Commerce documentation, Secure your Commerce site and infrastructure). The practical lesson is to turn patching into a routine with an owner, a calendar and a test environment, instead of an emergency. Read also E-commerce cyber risks and how to prevent them.

Install extensions only from trusted sources

One of the main recommendations Magento makes is to install extensions from trusted sources, either from your vendor or found on Magento Marketplace. Extensions to be found here have first gone through a due process of code review and programming standards. Adobe's technical review for Marketplace extensions includes a malware scan, a code sniffer that checks coding standards, a plagiarism check, automated installation tests and manual quality assurance (Adobe Commerce Marketplace, Technical review guidelines).

The problem with unregistered third-party applications in Magento Marketplace is that they have not been verified and may have sections of malicious code that perform actions outside our consent, such as sending sensitive information or opening portholes for unauthorized access. This is why, if you are still going to include an unregistered module, it is necessary that it is reviewed by an expert in Magento to certify that there is nothing out of place. From a governance point of view, limit the number of extensions and vendors, keep an inventory of what is installed and who maintains it, and remove what is no longer used, since every extension is code that must be kept up to date.

Challenges that detect automated attackers

These challenges can be automatic so that they do not require action by the person accessing the site, but they may require the identification of images or patterns. They are currently prevalent and used with a high degree of effectiveness in detecting attackers. Adobe's guidance names the tool explicitly, since it recommends enabling reCAPTCHA against brute force attacks on the Admin. On the storefront, the same type of challenge on login, registration and checkout forms helps against the card testing and fake account creation that retailers frequently suffer.

2-factor security

Two-Factor Authentication (2FA), in its terminology, adds a layer of security to user authentication so that, apart from the regular username and password, it is necessary for the person to provide additional credentials.

This step can be a token already known by the person or a code sent by mail or message to the person when they want to log in. In Adobe Commerce, the store administrator chooses which 2FA methods are required for the Admin, and Adobe's documentation lists Google Authenticator, Duo Security, Authy and U2F devices such as YubiKey as supported providers. It also clarifies that this protection applies to the Admin and not to customer accounts (Adobe Commerce documentation, Two-factor authentication). Adobe's best practices go further and recommend enabling 2FA for SSH connections too.

Change Magento admin user and URL

To make it difficult for attackers to enter our store, it is recommended to change the default login values of our admin user, as well as the URL to join the Backoffice for a custom one, adding a layer of concealment on our site. Adobe agrees on the URL, as it recommends a non-default admin address, avoiding admin or backend, together with advanced settings such as limits on login attempts and session length, and the principle of least privilege for roles and accounts (Adobe Commerce documentation, Secure your Commerce site and infrastructure). You can request this action from our service provider. If you have doubts about this process, do not hesitate to contact us.

Related reading includes Migration and Version Upgrade to Magento 2.4, since running a supported version is the foundation of every other measure.

Use strong passwords

One of the considerable straightforward ways to prevent unauthorized access to your account is to have strong passwords that are difficult to crack. Some factors to include in the creation of your password are a length of at least eight characters, numeric characters, special characters such as $, # and %, and a mix of upper and lower case letters. The store administrator can set the complexity required for a password, so having a minimum level of complexity for our customers will help ensure that their accounts are not vulnerable to attack. Adobe also notes that passwords should be changed at least every 90 days under the PCI DSS standard, and the company should add the controls on the Admin side mentioned above.

Perform security audits

These audits are an excellent way to identify the current state of our server. Adobe offers the Commerce Security Scan service, which checks a site for known risks and malware, and its best practices also recommend auditing servers and repositories for leftovers such as accessible logs, version control directories, database dumps and PHP info files that attackers love to find. If you would like us to perform an audit of your site, contact us, and we will be pleased to support and help you and your customers with the security of your online store.

Back up data regularly

A simple action that can save us a lot of headaches, backing up our information allows us to recover our systems with a minor loss of data in the case of incidents and can also restore our systems in a shorter time, saving us from a natural catastrophe. These backups are recommended to be stored outside the primary server in an external environment, and it is recommended to back up both files and databases. In the case of Magento, an excellent idea is to back up our catalog with the latest changes applied. Adobe's guidance adds that on-premises projects should back up and be able to roll back the file system, media and database, and that exporting the configuration makes redeployment easier.

Read also Financing and Discount for Magento Commerce Implementation. A backup that has never been restored is only a hope, so schedule a restore test at least twice a year and record how long it takes. That duration is your real recovery time, and it is the figure the board should hear.

Upgrade the server

Similarly, as Magento releases updates, these are released for the server where our site is hosted. Server verification should be performed periodically, ensuring that the installed components and applications are in the latest version. Again, these updates include the latest improvements and security measures, so we should not ignore them. Commonly, these are not performed, exposing our site. Adobe also recommends launching the entire site on HTTPS and using a web application firewall to detect suspicious traffic patterns, which are infrastructure measures that belong in the same maintenance calendar. For the administration side, our guide How to customize the Magento Admin site (part 1) shows how the back office is organised, which helps when reviewing roles and permissions.

Who is responsible for what

Security in an online store is a shared responsibility, and the arrangement is rarely written down. The hosting provider looks after the physical and network layers, the agency or development partner looks after the code, the extensions and the deployments, and the company itself looks after its users, its passwords, its content and its decisions about which risks to accept. When something fails, each party can truthfully say that the problem was in someone else's layer. A simple responsibility matrix, with one line for each measure in this article and a named person next to it, ends the ambiguity.

It is also worth agreeing on the response before an incident happens. Who decides to take the store offline, who talks to the payment provider, who informs customers and regulators, and who has the authority to restore a backup? Companies that have rehearsed these answers on paper lose hours instead of days when something goes wrong. The rehearsal costs one meeting, and it turns the technical measures above into an organizational capability that the board can trust.

Monday morning, what to do first

You do not need a large project to improve your position this week. On Monday, ask your technical team or agency for five facts, the exact platform version and the date of the last security patch, the list of administrator accounts with the last login of each, the list of installed extensions with their source, whether two-factor authentication and reCAPTCHA are active on the Admin, and the date and result of the last backup restore test. Written answers matter, because a vague verbal answer often hides a gap.

During the week, remove the accounts and extensions that nobody can justify, make two-factor authentication mandatory for all administrators, schedule the pending patches in a maintenance window, and change the default admin URL if it has not been changed. Subscribe a responsible person to Adobe's security notifications. By Friday you should have a short remediation plan with owners and dates, a quarterly calendar for patches and a first restore test planned. Review it every quarter in the same meeting where you review sales, because for an online store the two are not separate topics.

Security is first

These are some actions that can be taken to improve the security of your online store. This is ongoing work, so you should always be aware of improvements that can be implemented in case of possible new attacks. Magento offers merchants the flexibility to strengthen their security through reliable integrations, access controls and automated monitoring systems. By keeping up with updates and implementing best practices, businesses can reduce risk and build customer confidence.

Ultimately, prioritizing cybersecurity in Magento ensures that your online store remains resilient, reliable and poised for growth. A secure environment is not just a protective measure, but a competitive advantage in e-commerce. Following these recommendations will help you and your customers make secure transactions on the Internet, ensuring that neither sensitive information nor data are affected.

How ICX helps

ICX approaches security as part of the design of the digital business and not as an afterthought. Our consultants review the platform version, access model, extensions, integrations, infrastructure and backup strategy of your Adobe Commerce store, prioritize the findings by risk and help your team close them, from the first audit to ongoing maintenance. You can read more about our work in cybersecurity for CRM and digital platforms. Let us talk and see how, get expert advice from ICX on Adobe Commerce security or request a diagnostic with an ICX consultant.

Frequently asked questions

How often should I apply Adobe Commerce security patches?

As soon as they are released and tested. Adobe typically ships security updates quarterly, with hotfixes for major threats, so a quarterly calendar plus a fast track for urgent bulletins is a sensible policy.

Is it safe to install extensions from outside the Marketplace?

It carries more risk, because the code has not gone through Adobe's review. If you do it, have a Magento expert review the module before installation and keep it updated.

Does two-factor authentication protect my customers?

Adobe's 2FA protects Admin users, not customer accounts. For customers, use strong password rules, bot challenges and monitoring of unusual login or checkout behavior.

Why change the admin URL?

A non-default address makes it harder for automated attacks to find the login page. It is a layer of concealment that complements, and never replaces, 2FA and strong passwords.

Where should backups be stored?

Outside the main server, in an external environment, and they should include both files and the database. Test restoring them regularly.

Can ICX audit my store?

Yes. We perform security reviews of Adobe Commerce stores and help implement the remediation plan.

The retailer in our opening scene could have avoided that Monday call with a calendar, an owner and a handful of habits, and the stores that treat security as routine care, as unremarkable as locking the door at night, are the ones whose boards never need to hold that meeting.