12 Ways to Improve Magento 2 Security and Performance OF TOPIC Pavlo Okhrem CEO at Elogic Commerce 12 Ways to Improve Magento 2 Security and Performance OF TOPIC

CEO and Co-Founder at eLogic Commerce Vice president of International affairs at Cluster BIT Co-founder and chairman at Chernivtsi IT CEO Club Participant in international business programs in Sweden and Norway Not married

Agenda Performance Security Environment settings: PHP 9. Permissions Job Que DB solutions: Scaling Client side features Advanced caching Images compression, CDN Profiling instruments for code optimization Catalog search optimization Security 9. Permissions 10. Secure workflow/deployment 11. Server side logging configuration 12. Best practices of application configuration for security purposes

Magento2 Performance tips

Environment Settings: PHP Recommended list of extensions Sufficient memory_limit 768MB XDebug adds extra 20% to response time OpCache with recommended settings: - Enough memory portion to fit the code [512MB] - Max_accelerated_files_count [60000] - Timestamp validation / Consistency checks Note: Max performance will be achieved only if OpCache is enabled. php-bcmath php-cli php-common php-gd | php-imagick php-intl php-mbstring php-mcrypt php-pdo php-soap php-xml

Job Queue Integration with RabbitMQ. Available only in Enterprise Edition. Asynchronus jobs execution

Automatic connection resolver (CQRS pattern) DB Solutions: Scaling (EE) Web servers Automatic connection resolver (CQRS pattern) Available only in Magento 2 Enterprise Edition Main (Catalog) Master Checkout Master Order MS Master Main Slave Catalog Slave Checkout Slave EAV Slave …

DB Solutions: Scaling (EE) Adding a Slave database: CLI: magento setup:db-schema:add-slave Moving a separate part to a separate master database: CLI: magento setup:db-schema:split-quote CLI: magento setup:db-schema:split-sales

Configuration: Client side features Minification (CSS, JS, HTML) JS resources bundling Caching of static content Images compression CLI: magento catalog:images:resize

Caching

Caching Can be used used as page cache and session storing

CDN and image compression CDN will help you to deliver content faster. Reduce images size where possible. Use JPEG format for catalog pictures.

Code optimization Using the Zend Z-Ray, you can inspect, debug, and optimize your pages, and easily add additional functionality.

Catalog search Magento 2 EE provides the support for Solr – a robust catalog search engine option. Elasticsearch utilizes the RESTful web interface as well as uses schema-free JSON documents. Merchants prefer this search engine, because it offers real-time search, high scalability, and enterprise-level performance.

One more useful thing

Magento2 Security tips

Permissions The owner of the Magento file system: Must have full control (read/write/execute) of all files and directories. Must not be the web server user; it should be a different user. The web server user must have write access to the following files and directories: var app/etc pub In addition, the web server's group must own the Magento file system so that the Magento user (who is in the group) can share access to files with the web server user.

Permissions All directories have 770 permissions. 770 permissions give full control (that is, read/write/execute) to the owner and to the group and no permissions to anyone else. All files have 660 permissions. 660 permissions mean the owner and the group can read and write but other users have no permissions.

Workflow Limit the access to the production server. Ideally, with the help of CI, so nobody will have access to the live container Limit admin access (use different roles) Only 1 person should have the access to merging commits and deploying them to the live environment Purchase extensions from verified extensions providers

Server logging Configure the logging in a way that it detects all of the suspicious activities on your server Configure the firewall Use Fail2Ban to ban all of the suspicious activities on your server

Application configuration Change the default admin url path Change the default downloader url path Use only secure communications protocol (SSH/SFTP/HTTPS)  Use strong, long, and unique passwords, and change them periodically. Immediately install patches when new security issues are discovered.

Recommended extensions Creaminternet/module-secure-passwords Xtento Two-Factor Authentification (paid) Admin actions Log (paid)

One more thing Close all of the unnecessary ports on your server Restrict SSH access by IP Use password managers like LastPass, PassPack etc to store password securely

Useful resources https://elogic.co/blog/ultimate-magento-performance-guide-nginxhttp2php-7-0-8/ - How to configure Magento with http/2 https://elogic.co/blog/magento-security-lifehacks/ - Magento security lifehacks https://github.com/magento/magento2-zray - Magento2 z-ray plugin https://www.linkedin.com/pulse/20141210024646-1143212-22-ways-to-bulletproof-your-magento-security - 22 Ways to bulletproof your magento security

Contact me Email: pavlo@elogic.co Phone: +38(050)764-1000 Skype: okhrempavlo LinkedIn: /paulokhrem Facebook: /puncher