CMS Security

Magento Session Cookie Security Check

Magento session cookies must be protected by Secure and HttpOnly flags. Check their configuration to avoid session theft.

What this test checks

This test checks whether Magento session cookies are protected by the Secure (transmitted only over HTTPS) and HttpOnly (inaccessible via JavaScript) flags. Without these flags, cookies can be intercepted by attackers, especially via XSS attacks, allowing session and admin account theft.

Our recommendation

Enable Secure and HttpOnly flags for session cookies in Magento configuration (env.php). Ensure your site is on HTTPS. Test the configuration using browser developer tools.

Security tests

View all tests

Sensitive Files

Magento Session Cookie Security Check

What this test checks

Our recommendation

Read more

Configuration File Exposure Check

Access to wp-cron.php Check

PrestaShop Upload Folder Indexing Check

CAPTCHA Presence on Contact Form Check

Shopify X-Content-Type-Options Header Check

PrestaShop parameters.php File Access Check

Database Administration Tools Access Check

Magento Admin Login Page Protection Check

Permissions-Policy Header Check

Joomla Upload Folder Indexing Check (images/)

WordPress Upload Folder Indexing Check (wp-content/uploads/)

Shopify Client Login CAPTCHA Protection Check

admin-ajax.php Accessibility Check

CAPTCHA Presence on Password Reset Form Check

CAPTCHA Presence on Admin Page Check

Server Status Pages Access Check

PHP Error Display on WordPress Check

Shopify HSTS Header Check

Magento Admin Access Check

Shopify Permissions-Policy Header Check

Drupal Log File Exposure Check

Joomla Backup File Exposure Check

SQL Query Exposure Check

Shopify Cart Endpoint Exposure Check

Shopify Cookie Consent Banner Presence Check

Installation Log File Exposure Check

CORS Configuration Check (Access-Control-Allow-Origin)

PHP Error Display on Joomla Check

Shopify REST API Exposure Check

Shopify HTTPS Redirect Check

Cookie Policy Page Presence Check

Shopify Storefront API Exposure Check

CAPTCHA Presence on Registration Page Check

HSTS Header Check (HTTP Strict Transport Security)

Login Attempt Limiting Check

Shopify Contact Form CAPTCHA Protection Check

Joomla Temporary Folder (/tmp/) Access Check

CAPTCHA Presence on Client Login Page Check

Shopify API Key Exposure Check

Shopify Content-Security-Policy Header Check

Shopify Referrer-Policy Header Check

Shopify File Upload Security Check

Shopify Admin Access Restriction Check

PHP Error Display in Production Check

Directory Indexing Check

.htaccess File Presence and Security Check

Drupal Backup File Exposure Check

Joomla Admin Access Check

Shopify Error Display Check

Shopify X-Frame-Options Header Check

Drupal Upload Folder Indexing Check (sites/default/files/)

Shopify SQL Injection Protection Check

Cache Policy Check (Cache-Control, Pragma, Expires)

Joomla Version Check

PrestaShop Session Cookie Security Check

Plaintext Password Exposure Check

CNIL Mention in Privacy Policy Check

PHP Error Display on Magento Check

CMS Vulnerability Check

Joomla configuration.php File Access Check

PrestaShop Admin Login Page Protection Check

Privacy Policy Page Presence Check

PrestaShop Backup File Exposure Check

WordPress REST API Access Check

Shopify HTTP Security Headers Check

wp-config.php File Access Check

PrestaShop Version Check

Database Backup File Exposure Check

WordPress Debug Log Exposure Check

Drupal Admin Login Page Protection Check

WordPress Heartbeat API Check

WordPress Backup File Exposure Check

PHP Error Display on PrestaShop Check

Shopify Terms and Conditions (T&C) Presence Check

Clear-Site-Data Header Check

Email Address Exposure Check