Usage

Checks

Check	Problem when	Fix
Installer folder removed	install is on the server	Delete the folder
Admin script renamed	The admin panel is admin.php	Rename the file and set admin_index in config.local.php
Admin panel over HTTPS	The setting is off	Settings > Security
Storefront over HTTPS	The setting is off	Settings > Security
Strong cron password	Empty, MYPASS, or shorter than 12 characters	Change it in Settings > Security and in your cron lines
Minimum password length	Less than 8	Settings > Security
Passwords need letters and digits	The rule is off	Settings > Security
Errors hidden from visitors	display_errors on, or development mode	Ask your host, or edit config.local.php
Supported PHP version	Older than 8.1	Ask your host
No backups or test files in the web root	.sql, .zip, .bak, phpinfo.php, .git and similar	Move or delete them
config.local.php not writable by everyone	Permissions allow any user to write	Set 644 or stricter
No PHP files in images	Any PHP file except the redirect stubs of CS-Cart	Check and delete
PHP files in var checked	PHP files outside cache and snapshots	Check that each one belongs to an add-on you use
No server code in editable templates	Snippets, e-mail templates, documents or blocks with code that can reach the server	Open them and check where the code came from
No forgotten staff accounts	No sign-in for 180 days	Disable unused accounts
Few root administrators	More than three	Give staff their own groups
No common staff passwords	A password from a short list of the most common ones, or the login or the e-mail name	Ask the person to change it

The password check compares hashes and runs for up to 20 seconds. It never shows a password.

File changes

The page lists files that changed, are new or were removed since the baseline. After an upgrade or a change you made yourself, press Accept the current files. If you did not expect a change, compare the file with a clean copy of CS-Cart or of the add-on before you accept it.

Scan files now scans from the page in short steps.