In short
A Magento 2 store (Adobe Commerce or Magento Open Source) is a prime target for card-stealing skimmers, and critical flaws like CosmicSting (2024) or SessionReaper (2025) are exploited at scale within days of the advisory. At WebIntacta (Jose Soriano) I review your Magento store from the inside with a read-only module: integrity of the core and its JavaScript, modules and Composer packages with published vulnerabilities, hidden PHP and forgotten backups. The report costs €169, excluding VAT.
Reviewed by Jose Soriano ·
Magento is the platform where large-scale card theft (Magecart) was born, and it is still one of its favorite targets. On a Magento store, what removes the most risk is applying Adobe's patches as soon as they come out and knowing whether anyone has touched the code that loads on the payment page.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.
STEP 01
Magento branch, Adobe advisories, third-party scripts and skimmers visible on public pages, exposed files, headers and email.
STEP 02
Copied to app/code/ and enabled with bin/magento over SSH (Magento does not install modules from the admin panel). It only answers signed requests.
STEP 03
A PDF with the grade, the urgent items first (patches and checkout) and what to do with each finding.
Adobe publishes security bulletins (APSB) for Adobe Commerce and Magento Open Source several times a year. The critical ones are exploited very quickly: CosmicSting (CVE-2024-34102, June 2024) allowed reading files on the server and, chained with other flaws, running code; SessionReaper (CVE-2025-54236, September 2025) allowed taking over customer sessions. In both cases there were mass attacks against unpatched stores in the following weeks. If you cannot upgrade, Adobe usually publishes an isolated patch you can apply without waiting.
Magento 1 stopped getting patches in June 2020. If your store is still on Magento 1, no report makes it secure: it has to be migrated.
pub/static/ or in the source code: that is why I compare each file with the original of your version.How a skimmer works and what to do if you find one is in the guide on credit card skimming in online stores. If customer data is affected, the GDPR sets deadlines for EU stores: see data breaches in online stores.
/admin) and two-factor authentication for every user, which Magento 2.4 ships with..bak copies of app/etc/env.php.If a customer tells you their card was misused after buying from your store, act as if there is a skimmer until proven otherwise: do not delete anything before making a backup, and check the checkout first. Magento malware removal costs from €390, with a fixed quote after the scan, because it depends on the size of the installation and its modules.
I do not have a fixed-price maintenance plan for Magento: patching a Magento store requires a staging environment and depends heavily on its modules. I quote it in writing after the report.
The store report includes the checkout review and is fully deducted if you order the cleanup within 30 days.
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
Free
No sign-up, no commitment
Everything in the website report, plus a review of checkout and the store's modules.
€169
excluding VAT$169 outside the EU
Joomla, Drupal, Magento or your own code: a fixed quote after the analysis.
from€390
excluding VATfrom $390 outside the EU
For Magento stores outside the EU, the report is $169 and the cleanup from $390. All prices
The module works on Magento 2.4. Core integrity is compared with the published Magento Open Source releases; packages exclusive to Adobe Commerce and third-party packages are not judged as core, but they are matched against published vulnerabilities.
Yes. Without SSH the module cannot be enabled, but I can use a temporary agent uploaded by FTP to the Magento root that expires after 72 hours and deletes itself.
No. It sends versions, file fingerprints and metadata, plus the contents of the code files I ask for; never env.php, nor backups or database dumps. It changes nothing.
It costs from €390, excluding VAT, with the price agreed in writing after the scan.
Free external scan. No sign-up and nothing to install.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.