SW Secure Deploy

Security configs and deployment tips for a secure Shopware 6 setup.

Links

• Shopware 6 Security
• Shopware 6 Security Plugin
• Two Factor Authentication
• FroshTools

Usage

All codes should be inserted right at the beginning of the files.

• Add code from .htaccess to your .htaccess file.
• Add code from robots.txt to your robots.txt file.
• Create file config/packages/prod/z-monolog.yaml and add code from z-monolog.yaml.
• Execute bin/console cache:clear to apply the changes.
• Schedule periodically execution of bin/console cache:clear (see cron.txt).

Recommendations

• Update Shopware and apps/themes
• Install/Update the Shopware Security Plugin
• Enable Two Factor Authentication
• Verify production mode is enabled
• Verify backups are working
• Verify Shop Status (FroshTools)

Advanced

• Use a creative admin user name
• Setup stricter rate limits (shopware.yml)
• Install extensions as composer packages