Security Health Check

What it does

For stores without a security team. One page checks the settings that matter, finds backups and test files anyone can download, PHP files in upload folders, server code in editable templates, forgotten staff accounts and common staff passwords. A hash of every code file is compared with the baseline you accept, so a changed, new or removed file stands out.

How it works

Open Administration, Security health check and press Run the checks. The first run records your code files as the baseline. Fix what the report lists, run again and see it turn green. Add the cron line for a daily check. After an upgrade, check the listed files and accept the current files as the new baseline. Vendors have no access.

Features

• Checks of the settings that matter, with a fix for each
• Backups and test files in the web root
• PHP files in images and var, core stubs left out
• Server code in snippets, e-mail templates, documents and blocks
• Common staff passwords, stale and root accounts
• File integrity baseline: changed, new and removed files
• Scan in steps, safe on large stores
• Daily cron and a notice in the admin panel
• Nothing sent outside your server

What you get

Compatibility

We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.

Requirements