How to secure the application: session, panel, secrets and dependencies
Opselis
Session cookie, panel 2FA, secrets outside the repo, composer audit and FIM. What each control is for, how it works and how to turn it on in Magento, WordPress and on a host with Wazuh.
Application security is controls in the code and on origin: the HTTP session, the admin panel, secrets, Composer/npm dependencies, file upload, a CVE scan. A WAF at the edge cuts the mass. It does not patch Magento or a plugin. Tools: store config (env.php, wp-config.php), Magento_TwoFactorAuth, composer audit, a Wazuh agent (FIM, SCA), an OpenVAS scan. Goal: make session theft, adminhtml entry and a database password leak from the repo harder.
What each control is for
The session cookie (HttpOnly, Secure, SameSite) limits SID theft via XSS and sending it over HTTP. 2FA on the panel cuts a password leaked from phishing. A secret in a manager (Vault, SOPS, CI variables) not in Git: a public repo scan does not get MariaDB. composer audit and npm audit show known CVEs in libraries. FIM (Wazuh) alerts when someone changes app/etc/env.php or adds a file in pub/media. OpenVAS finds old PHP and open ports. Masking a dump on staging cuts a copy of production on an agency laptop.
How it works
The Magento session sits in Redis or in files. After a password change old SIDs must die. An admin path other than /admin reduces random scans, it does not replace 2FA. Upload without a MIME allow-list is a webshell and Magecart vector (a script in media). The Wazuh agent sends logs and file checksums to the manager. An FIM rule: who-changed, path, alert level. OpenVAS logs in for a scan, NVT versus service versions, the result is a CVE list with priority.
How to set it up
Magento: Stores, Configuration, Web, Default Cookie: Use HTTP Only yes, Cookie SameSite Lax or Strict on admin. Security, 2FA: force it on every admin user. bin/magento config:set admin/url/use_custom 1 and your own path. composer audit in CI, fail the job on critical. env.php outside the repo, injected from a secret at deploy. pub/media without PHP execution (nginx: location for php denied under media).
WordPress: DISALLOW_FILE_EDIT true, a 2FA plugin or SSO, xmlrpc off, composer/wp plugin list with an update date. Host: Wazuh agent, FIM on app/etc, wp-config.php, /etc/nginx. SCA CIS, a failed check with a patch window. OpenVAS: weekly scan, origin and panel. Cloudflare Access or VPN on /admin and /wp-admin, not a password on public 443. Layers: security.