OpenCart Safety Guide

Why is Security Critical?

The security of an online store is not a luxury, but an absolute necessity. A security breach can lead to:

• Data theft: Steal personal customer data (names, addresses, emails) and payment details.
• Financial Loss: Loss of revenue due to unavailability of the site, restoration costs, possible fines (e.g., GDPR).
• Fame Damage: Loss of customer trust and negative publicity.
• Abuse of Resources: Use your server for spam, phishing or other illegal activities.

Investing in prevention is always preferable to dealing with the consequences of a breach.

OpenCart Installation Security

Follow these steps to shield your OpenCart installation:

1. Keep Everything Updated

The most important practice. Updates often include security corrections.

• Update the core of OpenCart in the latest fixed version.
• Update all topics (themes) and extensions.
• Use supported PHP and MySQL versions.

2. Strong Credentials & Change Admin Path

• Use a powerful, unique password for the administrator account.
• Change the default username 'admin' to something else.
• Change the default admin URL: Rename the folder admin in something unique (e.g., myadm1narea) and update the file admin/config.php (the variable HTTP_SERVER and the DIR routes).

3. Secure File Permissions

The wrong file rights can allow intruders to modify code.

• Folders: 755 or 750
• Files: 644 or 640
• Very Important: Files config.php and admin/config.php must have stricter rights, ideals 444 or 400 after initial adjustment.

4. Delete Installation Folder

After completion of the facility, Always delete folder install from your server.

5. Use of HTTPS (SSL Certificate)

It is necessary for every e-shop. It encrypts communication between the client and the server.

• Install a SSL certificate (many providers offer free Let's Encrypt).
• Enable SSL from OpenCart settings (System > Settings > Edit Store > Server Tab).
• Configure redirect from HTTP to HTTPS via .htaccess.

6. Protection from Common Attacks

• SQL Injection: OpenCart has built-in protection, but make sure that the extensions you use follow good coding practices.
• Cross-Site Scripting (XSS): Avoid installing extensions from unreliable sources.
• Directory Traversal: It is ensured mainly with correct file rights and server settings.

7. Use of Web Application Firewall (WAF)

A WAF (like ModSecurity on the server or services like Cloudflare) can filter malicious traffic before it reaches your site.

8. Regular Backups

Necessary to recover from any problem, including security breaches.

9. Beware of Extensions

• Download extensions only from the OpenCart official market or from reliable developers.
• Read reviews and check developer support.
• Uninstall and delete extensions you don't use.

10. Monitoring Logs

Check the OpenCart and server error logs regularly for suspicious activity.

Security of Related Accounts

The security of your store also depends on the security of the accounts associated with it.

1. Hosting Account

• Use a very powerful, unique password.
• Activate Two Agents Identity Check (2FA / Two-Factor Authentication) if offered.
• Limit access (e.g., via IP whitelist if possible).

2. Email Account

The main email account associated with the store, domain and hosting is critical.

• Use a very powerful, unique password.
• Turn on 2FA at all times.
• Beware of phishing attempts. Do not click on suspicious links or open suspicious attachments.
• Use different emails to manage the store than you use for daily communication, if possible.

3. Domain Registrar Account

• Use powerful, unique password.
• Activate 2FA.
• Activate "Domain Lock" or "Transfer Lock" to prevent unauthorized transfers of your domain.

4. Payment Gateway Accounts

• Use powerful, unique passwords.
• Activate 2FA.
• Regularly check user licenses and security settings within the payment portal platform.

General Security Best Practices

• Powerful, Unique Codes: Do not use the same code in multiple services. Use a password manager.
• Activate 2FA Everywhere: Where available (email, hosting, social media, banks), enable 2FA.
• Vigilance for Phishing: Be suspicious with emails, messages or phone calls asking for personal information or passwords. Always verify the identity of the sender.
• Safe Workstation: The computer you manage the store from must be safe (updated operating system, antivirus, firewall). Avoid management by public or unreliable Wi-Fi networks.
• Regular Control: Check logs, user licenses and security settings periodically.

What to do in case of a breach

If you suspect or confirm a security breach:

1. Change Codes Instantly: Start with OpenCart manager code, host code, FTP/SSH code and database code.
2. Contact the Hosting Provider: Tell them about the situation. They may have tools or logs that will help.
3. Isolate Site (if possible): Put the site in maintenance mode or restrict access to stop further damage.
4. Locate Source: Try to find out how the breach occurred (e.g., old expansion, weak password). Check the logs.
5. Clear the Site: Remove all malicious code. Restore from a clean backup is often the safest solution.
6. Inform Customers (if necessary): If there has been a breach of customer data, you may have a legal obligation to inform them (eg GDPR).
7. Ask for Professional Assistance: If you're not sure, ask security experts.