“No business is safe from hackers, I’ve had the chance to see it for myself. That’s why I would like to share my experience with all online store owners. My friend, also an owner of a web shop, was recently hit by a hacker attack. His site seemed just fine, all he noticed was a significant drop in sales,” states Brad S., owner of madamebridal.com.
“After a couple of months of trying to figure out what is going on, he contacted a developer. It turned out that his website was infected with malware that was sending spam to his visitors. And on top of that, his site ended up being blacklisted by Google.”
“That was a real wakeup call. Team of developers from Extensions Mall installed the MageFence extension my Magento store which scanned my entire website and fortunately confirmed it was malware free. It was not a moment too soon: shortly after, I got a warning that MageFence detected some changes in files, which turned out to be malicious. We took recommended actions and quickly solved the problem, so this incident had absolutely no consequences to my business or my customers. I know I was lucky, but some of you might not be,” concludes Mr. Simon.
Allowing your website to get hacked will cost you reputation, money and ultimately you will lose your business
Website security is one of those things that everyone talks about, but when you ask them about actual security measures it all comes down to “it won’t happen to me”. We always hear in the news when big companies like Target or Sony get hacked, but in reality small and medium businesses are victims of hacker attacks far more often. According to research 71% of security breaches target small businesses that don’t have a security plan. In other words, anyone who is not actively involved in their website security is at risk of being exploited.
E-commerce platforms are the common target of cyber-attacks. According to Staysafeonline.org, more than half of data breach concerning shopping happens on e-commerce websites. Last year, the retail industry accounted for 80% of records stolen – totaling more than 68.2 million compromised records. The next highest industry on the list is the healthcare sector, with only 9.7% of total records.
Magento is in general a very robust, secure platform, provided that you take all the necessary precautions. During last couple of years several critical vulnerabilities have been discovered and they are still being actively exploited, despite the fact that the security patches have been released. Security of your Magento store requires proactive approach. Think of it as owning a store in a good neighborhood: that still doesn’t mean you should leave your doors wide open.
You probably know that you need to safeguard your online store, but you might don’t know how, or the methods require technical skill you do not have. That is basic idea behind MageFence – an extension that helps you implement the best security practices on your website, and protects your site at all times.
Thousands of Magento stores are still at risk of being exploited by hackers.
Malware is a fast growing threat to Magento websites. A malware attack infects your site so that it becomes a security threat infecting other computers, sending out spam, loading and distributing more malware – all without your knowledge.Malware infection can go unnoticed by owner of infected website for a long time. Recently discovered JavaScript malware dubbed “Credit Card Hijack” that forwards credit card information to an external site,is reported to run on some websites for as long as six months without any externally visible signs. The only way to know with certainty if your website is infected is by purposefully scanning for malware.
MageFence offers “Check Website” feature that scans your Magento for known patterns of malware infection. It performs a detailed check,looking for malicious code.If MageFence finds any signs of malware it will display them on the File Protection page once the scan completes.
At the beginning of 2015, a critical vulnerability called “Shoplift bug” left hundreds of thousands of Magento websites open to attack that can lead to the complete compromise of any Magento powered store.Hackers exploit this vulnerability by using SQL Injection to insert a new admin_user into the database which allows them to obtain control over a store and its sensitive data, including customers’ personal information.
Besides detecting signs of malicious code, MageFence scans your database regularly and checks for admin users created without authorization. When unauthorized admin is detected, you will receive an email warning to check the list of admin users so you can immediately delete the fake admin accounts. This extension also gives you the option to receive email every time a user with admin privileges logs in, which keeps you in total control of your store.
Close to 10,000 websites are blacklisted by Google EVERY DAY due to malware infection
Malware infected websites are considered dangerous to visitors. If your website is suspected for malware, search engines will put it on a blacklist and eventually remove from their index. Blacklisted websites lose up to 95% of their organic traffic. Some of these sites are created for malicious purposes, but most of them are legitimate business, personal, and other websites that have been infected without the knowledge of their owners. Recently, a massive attack of “Guruincsite” malware on Magento sites left more than 8000 domains blacklisted. The malware was found to exploit the Shoplift bug vulnerability and all affected websites were missing the proper patch.
MageFence scans your website and gives you complete list of all applied Magento patches, as well as the missing ones. The extension connects to our server so we will always notify you about new Magento releases and security trends keeping your protection up-to-date.
To make sure that security of your Magento website is not compromised it is important to check integrity of your files and catch the malicious changes as soon as possible.After you have checked your site for malware and resolved security issues, MageFence enables you to create a “Starting Point”. That saves information about the current state of your files, which will be used as a reference for future scans. MageFence runs system scan as scheduled (by default once every 24 hours) and doesn’t let a single change in the files slip under the radar. All modified files are displayed in a list that allows you to confirm all the changes you have made yourself, and pinpoint the changes that can be result of a security breach.
The only way to be completely safe is to check your website on regular basis: look for changes in the code, files and database.
Brute force attacks are among the simplest methods to gain access to a website because they don’t require any additional skill or resources other than time. An automated script tries several different combinations of usernames and passwords, over and over again, until the login security is breached. The attacker then has full access to your Magento backend.
Default Admin Panel URL is an easy target for brute force attacks and it is recommended to change it to something unique. Existing ways of changing Admin Panel URL require modifying the files manually, which can be confusing to a normal user and cause problems. MageFence enables you to safely and easily change your Admin Panel URL just by typing desired value into the field.
Another, often neglected, point of entry to your website is the Magento Connect Manager. Magento Connect Manager is used for conveniently installing extensions to your Magento, but it also offers direct access to your Admin Panel and it can present a security risk. So far, the suggested solutions for protecting Magento Connect Manager were to remove or rename the “downloader” directory, which is not an effective solution, or to completely disable Magento Connect Manager. MageFence offers you safe and effective solution to protect Magento Connect Manager without affecting its functionality by easily changing Magento Connect Manager URL.
MageFence also gives you the option to block brute force attacks by limiting the number of failed login attempts. After the specified number of login attempts has been exceeded, the extension locks out user’s IP address for certain amount of time and sends you an email alert about the incident. You can set both allowed number of login attempts and the amount of time IP address is locked out. This allows you to keep the resources of your site from being overwhelmed by continuous failed logins.
For additional protection you have the option to immediately lock out anyone who tries to log in using the wrong user name.
Find more about MageFence – Magento Security Extension
