Security on a Gen2 server is a set of layers. If one is bypassed, the next one still holds. Most of them are on from the first minute and need nothing from you.
Security updates for the operating system are installed automatically every day.
Enforcing. A process that is broken into can only touch what its role allows.
Only web, mail and SSH ports are open. You add rules per address or range.
No root login and no passwords for system accounts. Optional allow-list for SSH and SFTP.
Bans addresses that guess passwords, scan for weak spots or keep hitting the limits.
Each application has its own Linux user and PHP pool and cannot read another application's files.
Per-address and per-shop limits, refused attack tools, and a browser check when overloaded.
Every night, pulled to a NAS in another place, 7 nights kept.
What you should do
- Turn on two-factor sign-in for your console account.
- Use SSH keys rather than passwords for SFTP and SSH users, and give each person their own user.
- Keep your store's software and extensions up to date; most hacked stores are hacked through an old extension.
- Run WhizzyScan after installing extensions from unknown sources.
- Invite your team with the smallest role they need (roles).
Did this solve it? If not, tell us what you see and we look at your server.
Open a ticket