1. 12 Ways to Improve Magento 2 Security and Performance OF TOPIC
Pavlo Okhrem CEO at Elogic Commerce
12 Ways to Improve Magento 2
Security and Performance
OF TOPIC

2. CEO and Co-Founder at eLogic Commerce
Vice president of International affairs at Cluster BIT
Co-founder and chairman at Chernivtsi IT CEO Club
Participant in international business programs in Sweden and Norway
Not married

3. Agenda Performance Security Environment settings: PHP 9. Permissions
Job Que
DB solutions: Scaling
Client side features
Advanced caching
Images compression, CDN
Profiling instruments for code optimization
Catalog search optimization
Security
9. Permissions
10. Secure workflow/deployment
11. Server side logging configuration
12. Best practices of application configuration for security purposes

4. Magento2 Performance tips

5. Environment Settings: PHP
Recommended list of extensions
Sufficient memory_limit 768MB
XDebug adds extra 20% to response time
OpCache with recommended settings:
- Enough memory portion to fit the code [512MB]
- Max_accelerated_files_count [60000]
- Timestamp validation / Consistency checks
Note: Max performance will be achieved only if
OpCache is enabled.
php-bcmath
php-cli
php-common
php-gd | php-imagick
php-intl
php-mbstring
php-mcrypt
php-pdo
php-soap
php-xml

6. Job Queue
Integration with RabbitMQ.
Available only in Enterprise Edition.
Asynchronus jobs execution

7. Automatic connection resolver (CQRS pattern)
DB Solutions: Scaling (EE)
Web servers
Automatic connection resolver (CQRS pattern)
Available only in Magento 2
Enterprise Edition
Main (Catalog)
Master
Checkout
Master
Order MS
Master
Main
Slave
Catalog
Slave
Checkout Slave
EAV
Slave …

8. DB Solutions: Scaling (EE)
Adding a Slave database:
CLI: magento setup:db-schema:add-slave
Moving a separate part to a separate master database:
CLI: magento setup:db-schema:split-quote
CLI: magento setup:db-schema:split-sales

9. Configuration: Client side features
Minification (CSS, JS, HTML)
JS resources bundling
Caching of static content
Images compression
CLI: magento catalog:images:resize

10. Caching

11. Caching
Can be used used as page
cache and session storing

12. CDN and image compression
CDN will help you to
deliver content faster.
Reduce images size where possible.
Use JPEG format for catalog pictures.

13. Code optimization
Using the Zend Z-Ray, you can inspect, debug, and optimize your pages, and easily add additional functionality.

15. Catalog search
Magento 2 EE provides the support for Solr – a robust catalog search engine option.
Elasticsearch utilizes the RESTful web interface as well as uses schema-free JSON documents. Merchants prefer this search engine, because it offers real-time search, high scalability, and enterprise-level performance.

16. One more useful thing

17. Magento2 Security tips

18. Permissions
The owner of the Magento file system: Must have full control (read/write/execute)
of all files and directories.
Must not be the web server user; it should be a different user.
The web server user must have write access to the following files and directories:
var app/etc pub
In addition, the web server's group must own the Magento file system so that the
Magento user (who is in the group) can share access to files with the web server user.

19. Permissions All directories have 770 permissions.
770 permissions give full control (that is, read/write/execute) to the owner and to the
group and no permissions to anyone else.
All files have 660 permissions.
660 permissions mean the owner and the group can read and write but other users
have no permissions.

20. Workflow
Limit the access to the production server. Ideally, with the help of CI, so
nobody will have access to the live container
Limit admin access (use different roles)
Only 1 person should have the access to merging commits and deploying
them to the live environment
Purchase extensions from verified extensions providers

21. Server logging
Configure the logging in a way that it detects all of the suspicious
activities on your server
Configure the firewall
Use Fail2Ban to ban all of the suspicious activities on your server

22. Application configuration
Change the default admin url path
Change the default downloader url path
Use only secure communications protocol (SSH/SFTP/HTTPS) 
Use strong, long, and unique passwords, and change them periodically.
Immediately install patches when new security issues are discovered.

23. Recommended extensions
Creaminternet/module-secure-passwords
Xtento Two-Factor Authentification (paid)
Admin actions Log (paid)

24. One more thing Close all of the unnecessary ports on your server
Restrict SSH access by IP
Use password managers like LastPass, PassPack etc to
store password securely

25. Useful resources
- How to configure Magento with http/2
- Magento security lifehacks
- Magento2 z-ray plugin
Ways to bulletproof your magento security

26. Contact me
Phone: +38(050)
Skype: okhrempavlo
LinkedIn: /paulokhrem
Facebook: /puncher