Security Hardening Checklist for Magento 2

1. Server Infrastructure Hardening

Securing a Magento 2 deployment starts at the operating system layer. Restricting SSH key authentication, changing default admin endpoints, and setting file permissions stops automated vulnerability exploits.

2. Production Linux Command Permissions Script

# Magento 2 Production Linux File Permissions Hardening Script
cd /var/www/html/magento2

# Set directories to 750 and files to 640
find . -type d -exec chmod 750 {} +
find . -type f -exec chmod 640 {} +

# Make app/etc/env.php read-only to web server
chmod 600 app/etc/env.php

# Restrict generated and var directory write access to web-data user
chmod -R 770 var generated pub/static pub/media

3. Frequently Asked Questions (FAQ)

1. Why is changing the default admin URI essential?

Automated botnets launch brute-force attacks against default paths like `/admin`. Customizing the admin URL path stops automated scanning.

2. What are the correct Linux file permissions for production?

Directories should be set to 750, files to 640, and `env.php` restricted to 600 to prevent unauthorized file read/write access.