How to check the Magento store security for free? Use online malware scanners

Every day over 450 000 new malware pieces are registered by security specialists. Rapid progress in malware and software platforms may lead to a situation when even the best software infection scanner can miss some infections that the most average scanner may detect.

Magento offers a free online malware scanner Adobe Security Scan, which monitors for up to 9000 threats, and is one of the best in its class. However, a good practice to enhance the protection of your store would be to use a second opinion scanner in addition to Adobe Security Scan or another product you are already using. It gives you a second line of defense for your store.

Additionally, such a secondary scanner may provide extended information on the security of your store. For example, your store may be cleaned from malware but still be on search engine blacklists or spam lists.

Magento 1 store owners are explicitly recommended to use additional security scanners routinely due to the end-of-life date of this platform.

Dive into the article below to get full information on what additional free malware scanners you can use to get a second opinion in your Magento 2 store.

1. Why is a second opinion scanner a good practice?
2. Sucuri SiteCheck
3. Foregenix Website Security Scan
4. MageReport
5. Quterra.
6. Additional security checking tools
7. Summary

Why is a second opinion scanner a good practice?

No software solution can distinguish a full 100% of the malware threats. Even the best scanners have up to 96.3% online detection rate.

This can be easily demonstrated using VirusTotal - a service that allows checking files and URLs for malware with multiple antimalware solutions at once.

A well-known javascript malware sample from 2017 can still be undetected by a great number of antimalware solutions. Tested sample was detected by 27 out of 56 software security applications:

However, when this exact malware sample is embedded into a website, the detection rate drops dramatically:

And at the same time, this is quite a regular false detection situation. A graphic image of Magento logo on a fresh website installation was detected as malware:

It is becoming obvious that one malware scanner may not be enough, and it's a decent practice to have a second assessment malware scanner for your site. Sweep with it consistently to get those malware samples that your constant protective solution may have missed or falsely alarmed.

Sucuri SiteCheck

Sucuri is a well-known provider of security services for sites on different platforms, including Magento. It supplies customers with cloud-based instruments to provide a total site security overhaul. The basic tools for this include execution improvement using a CDN, alleviation of outside cyberassaults through software exploits and DDoS, etc.

Magento store owners can take advantage of a free malware scanner & security check tool. It provides several major checks:

• Malware and infections. Allows you to distinguish malicious code and tainted documents by examining the Magento site source code available to visitors.

• Check of Magento store blacklist status. Infected sites are placed on blacklists, maintained by site security teams in Google Safe Browsing, PhishTank, McAfee, ESET, Opera, and other list providers. A site can be blacklisted even after removing the malware and the security problem is completely resolved. Being blacklisted has a negative impact on organic store traffic and SEO.

• Warn over out-of-date software components. Magento updates are released regularly, and it is the site owner's task to keep track of them and install them. Recognize if your Magento site runs an obsolete version of CMS or modules.

• Distinguish Magento security issues. Check your Magento site for security irregularities, misconfigurations.

With scan's findings, Sucuri uncovers the types of dangers to which the site is currently exposed. It doesn't leave the site owner simply with the list of vulnerabilities but provides solidifying suggestions for mitigation. It is an easy-to-use tool to get a second opinion on sites security.

You may enhance Sucuri SiteCheck results by using Unmask Parasites service from this developer. It helps to find hidden illegal content embedded in website pages. For example, this could be hidden spam links on pages.

Foregenix Website Security Scan

Foregenix Website Security Scan is another site checking tool that requires no additional software setup or access to private files. The checks are passive, which means this tool searches for vulnerabilities in freely accessible data on the website. It examines sites for explicit security weaknesses and delivers a total danger score to get a simple understanding of the overall site security status.

The tool currently serves over 300 000 Magento merchants globally. WebScan searches for:

• Malware embedded into the website, such as card skimmers;
• Magento platform analysis and provides information on updates;
• Checks for SSL issues.

MageReport

MageReport is one of the most well-known online scanners available specifically for Magento. Its free version searches for several known security weaknesses.

The list of checked vulnerabilities includes:

• Magento security patches installed. It allows checking if your Magento store has deployed the latest patch issued by Adobe.

• Exposure of the admin panel and Magento API.

• Web forms weaknesses that allow remote code execution (RCE).

• Visbot Magento malware. It is a skimming malware specific to Magento. Once installed on the breached server, it captures visitor data by intercepting POST requests to the server.

• Brute force and ransomware attacks.

MageReport not only checks the Magento core for weaknesses but it also analyzes popular third-party extensions as well.

MageReport provides detailed information on how to fix discovered weaknesses or who to contact for help. When the store is protected from a specific vulnerability, the tool shows general info on it.

Quterra

Quttera is a cloud-based application that scans websites for suspicious scripts, malicious files, and other online threats. It also aimed to detect malware lurking in legitimate content and hiding on the website server.

During URL scanning, all available web content is downloaded to the Quttera checking server. HTML pages, JavaScript scripts, images, etc., up to 20 MB in size are scanned.

The malware assessment will contain a detailed threat breakdown for all affected pages. You will get a detailed report on:

• List of external links, including blacklisted ones.
• Malicious and blacklisted iframes.
• List of referenced domains/hosts, including blacklisted links.

This tool stands out for its informative output. It explicitly states why certain records have been named as threatening.

SiteGuarding

SiteGaurding is a free malware scanner that is best suited for checking a site for its presence in global and spam blacklists. It provides a detailed list with several dozen of blacklist providers.

It still provides a fundamental report on the software components your site is running on. It uncovers the version of the CMS and web-server used by your store. Aside from that, you get HTML, CSS, and JavaScript analysis.

However, the free report provided by SiteGaurding does not give details on the uncovered malware names and locations on your server.

Additional security checking tools

If you don't require a full scan of your Magento website, you can use specialized online scanners.

Mage Scan

For your dev sites or intranet sites that do not have access to the online site scanners, you may use local Mage Scan. It is a tool you need to deploy on your server to scan Magento for vulnerabilities.

Google Safe Browsing

Google Safe Browsing is a simple service that assists with identifying malware and dubious links on a site.

It can be the first tool you may use when you detect a significant drop in the number of organic visitors. That's because web-browsers use the data provided by Google Safe Browsing and block access to the site by displaying the alert message to the visitor. The visitor should explicitly press a button to continue loading the site, listed as unsafe by this tool.

Astra Magento Malware Scanner

The Magento Malware Scanner by Astra is the tool you use if you want maximum simplicity.

You get a check with more than 60 blacklists and over 140 security tests, SEO spam. However, while other online scanners fill out the report with data that may be irrelevant in the task of malware protection, such as stating the server's IP address or country location, the Astra scanner gives a simple answer that your server is clean.

Summary

No remote online scanner can detect all malware because it operates only with files that your Magento store makes publicly available. The free forms of all the named scanners offer pretty basic functionality. However, using such a tool for regular security checks can increase the protection level of your website.

These scanning instruments give a site owner an additional level of checks against web malware, platform weaknesses, and other security dangers that could hurt your server.

You can use the mentioned online scanners in addition to the Security Scan, which is a similar tool designed by Adobe specifically for Magento. It is also available for free. Read the step-by-step guide on how to use it.