Update your password regularly

This is age-old advice - so we wouldn't suggest it if it wasn't critical. Read our blog for advice on how to choose a safe password.  Multi Factor Authentication will provide even stronger protection - a low-cost but highly effective security control.  

Change your Admin Path URL

This is the URL you and your team use to log in to your website. All Magento websites by default use the same variation of URL, and if an attacker finds your admin page, they have a far better shot at gaining access to your website.  In fact... it's easy to break in, unless you have security in place to protect your site.

Monitor the accounts which are accessing your website's backend

Never share accounts.  Run regular audits on admin accounts - keep admin access to a minimum. You should know who has access to your website. If accounts are logging in at unexpected hours, this could be a sign that an attacker has compromised the account.

Check your recently changed files - are they genuine?

Many compromises involve files being added or changed on a website. Take a look at your change log for any suspicious file activity - who made those changes, were they planned, are the files legit?

Scan your website regularly for indicators of compromise, malware

Using an external malware/IOC scanner, such as WebScan for occasional on-demand scans - or sign up for our FGX-Web Lite service for daily external scans delivered to your inbox - can give you a quick and simple insight into the security posture of your website. 

Both WebScan and FGX-Web include historic data so that you can track changes to your Risk Score over time.