Security is not a one-off task but an ongoing responsibility, and an ecommerce store handling customer data and payments is a natural target. This checklist covers the essentials of keeping a Magento store secure, from the store itself to the infrastructure it runs on.

Some of these items are the merchant's responsibility, and some are handled for you on managed hosting — knowing which is which is part of a good security posture.

Keep Magento Patched and Up to Date

Security patches exist because vulnerabilities are found over time. Applying Magento security updates promptly is the single most important thing you can do, because attackers actively scan for stores running known-vulnerable versions.

Secure Admin Access

The admin panel is the keys to the store, so it deserves the most protection:

• Enable two-factor authentication for every admin user.
• Use strong, unique passwords and avoid shared logins.
• Give each person their own account with only the permissions they need.
• Remove accounts when people no longer need access.

Use HTTPS Everywhere

Every page, not just checkout, should be served over HTTPS so that data between the customer and the store is encrypted. Modern stores are expected to run fully over HTTPS, and browsers flag those that do not.

Be Careful with Extensions

Third-party extensions are a common source of vulnerabilities. Install only what you need, from reputable sources, keep it updated, and remove extensions you no longer use. Every extension is code running inside your store, so treat it with the same care as core updates.

Maintain Reliable Backups

Backups are a security control as well as an operational one: if a store is ever compromised, a clean backup is what lets you recover. Follow good Magento backup best practices so you always have a known-good restore point.

Monitor and Limit Exposure

Keep an eye on your store for unusual activity, and reduce its attack surface where you can. At the infrastructure level, isolating a store from unrelated sites limits the impact of any single compromise — one of the benefits of dedicated, isolated hosting.

Know What Your Host Handles

Much of security lives in the infrastructure: server hardening, network configuration, patching the underlying platform and isolating environments. On managed hosting, these are the provider's responsibility, which reduces what you have to manage yourself.

Security and MyShopCarts

MyShopCarts runs each store in its own isolated environment with dedicated resources and manages the underlying infrastructure, HTTPS and automatic backups, so much of the platform-level security is handled for you. That leaves you to focus on store-level practices such as patching, admin hygiene and careful extension management.

For the wider context on how the platform is run, see our overview of managed Magento hosting.

Learn more about managed Magento hosting and choose a plan that fits your store.