If you run an online store with Shopware, your credentials are of central importance. They provide access to your entire store and allow you to make important settings, manage orders, and make changes to the design or functionality. Therefore, the security of these credentials should be a top priority. In this article, you’ll learn about the types of credentials in Shopware, how to manage them securely, and what to watch out for to protect your store optimally.
Types of Credentials in Shopware
a) Shopware Account
The Shopware Account is the central management tool for Shopware users. These credentials not only allow you to log into the Shopware backend but also provide access to other important features such as the plugin store, support services, and license management. It’s crucial to store your Shopware Account credentials securely and only share them with trusted individuals.
b) Shopware FTP Access
The Shopware FTP access allows you direct access to your store’s files on the web server. With FTP access, you can upload, edit, or delete files. This is especially useful when installing plugins or customizing Shopware themes. Since FTP credentials grant direct access to your shop’s files, they should be managed with extra care.
c) Shopware Database Access
Database credentials connect to your Shopware database, where all essential information about your store is stored, including customer data, orders, and product information. Access to the database is typically managed through tools like phpMyAdmin. These credentials should be very well protected, as unauthorized access could cause significant damage to your shop.
Secure Management of Shopware Credentials
a) Password Security
The first step in securing your Shopware credentials is choosing a strong and secure password. A secure password consists of a combination of uppercase and lowercase letters, numbers, and special characters, ideally with a length of at least 12 characters. Avoid simple passwords like “123456” or “password,” as they are easy to crack.
b) Two-Factor Authentication (2FA)
Two-factor authentication adds an extra layer of security to your Shopware Account. In addition to your password, a second factor is required for authentication, such as a one-time code generated by an authenticator app like Google Authenticator or sent via SMS. This prevents attackers from accessing your shop even if they have stolen your password.
c) Regular Password Changes
It’s advisable to change the passwords for your Shopware Account, FTP access, and database regularly. While this may seem inconvenient, it provides additional protection against potential attacks. Make sure to record the new passwords in a secure place or use a password manager.
d) Limiting Access Rights
In companies where multiple people work with the store, it’s important to carefully manage access rights. Not every employee needs access to all areas of the store. It’s a good practice to assign roles and permissions so that only certain individuals can access sensitive areas like FTP or database access.
How to Protect Your Shopware Account
a) Secure Password Management
Besides choosing a strong password, make sure that your passwords are not stored in plain text. A password manager, such as LastPass or 1Password, can help you store and manage your credentials securely. This prevents you from writing down passwords or storing them in insecure locations.
b) Updates and Security Vulnerabilities
Always keep your Shopware installation up to date. Shopware regularly releases updates that fix security vulnerabilities and offer new features. An outdated system may be vulnerable to attacks, as known weaknesses could be exploited by attackers.
c) Using Secure Connections
When logging into your Shopware Account or FTP access, always use a secure connection. Ensure that your connection is encrypted via HTTPS, especially when logging in over public Wi-Fi networks. For FTP access, always use a secure FTP connection (SFTP) to prevent your credentials from being intercepted.
Handling Shopware FTP Access
a) Avoiding Insecure FTP Programs
There are many FTP programs available, but not all of them are secure. Make sure to use a program that supports encryption, such as FileZilla or Cyberduck. An FTP program without encryption can result in your credentials being transmitted in plain text and intercepted by attackers.
b) Limiting Access
Only provide Shopware FTP access to people who really need it. It’s a good practice to create temporary FTP access accounts that expire after a certain time or can only be used for specific tasks. This reduces the risk of unauthorized access.
c) Managing FTP Logins
Always keep track of who has access to the FTP area of your store. Remove old and unused FTP accounts and regularly check the activity on your FTP servers. This ensures that no unauthorized access is occurring.
What to Do in Case of a Security Breach?
a) Change Passwords Immediately
If you suspect that unauthorized individuals have gained access to your Shopware credentials, immediately change all affected passwords. This includes not only the Shopware Account but also the FTP and database credentials. In this case, be sure to use an entirely new and strong password.
b) Check Logs
Reviewing log files can help identify suspicious activities. In the log files of your server or Shopware backend, you can trace when and from where access to your Shopware Account or FTP occurred.
c) Seek Professional Help
If you discover that your Shopware store has been hacked or someone has gained unauthorized access, do not hesitate to seek professional help. There are many experts and service providers specialized in securing Shopware stores who can help minimize damage and secure your store again.
The secure handling of your Shopware credentials is essential for protecting your online store. Simply using secure passwords is not enough-regular updates, managing access rights, and using security measures such as two-factor authentication are equally important. In case of a security breach, it’s crucial to act quickly and seek professional assistance. This is the only way to ensure that your store and your customers’ data are well protected.
