Mitigates the PolyShell unrestricted file upload vulnerability in the Magento REST API by enforcing an image-only extension allowlist on custom option file uploads. Blocks executable file uploads at both the validator and uploader level.
No Errors in Security & Compliance
These modules have no PHPCS errors (warnings OK), pass PHPStan, and build correctly.
Automatically scans and removes malware files from the Magento media directory every 15 minutes, protecting the store from uploaded malicious files.
Manages Content Security Policy rules via Magento CLI, storing them in env.php for environment-specific control without database access. Includes automatic CSP header splitting to avoid size limits on servers.
Mitigates PolyShell-style file upload abuse by blocking file custom option uploads and restricting allowed extensions to images only. Includes a CLI command to scan and clear suspicious files from the custom_options media directory.
Detects a visitor's country using GeoIP data. Provides a REST API and PHP interface to retrieve the country code, with fallback options.
Integrates Umami, a privacy-focused open-source web analytics service, with your storefront for cookie-free visitor tracking.
Allows administrators to change customer passwords directly from the customer edit page in the admin panel. Includes a command-line interface for password updates.
Intercepts the customer address file upload endpoint and returns a 403 Forbidden response, effectively disabling address file uploads for security hardening.
This extension is adjusting the Cookie SameSite attribute issue since Chrome 80.
Disables customer registration on the frontend. Removes the registration link and form, useful for B2B stores that manage customer accounts internally.
Validates customer addresses during checkout in Magento 2. Requires PHP 8.1+ and Magento 2.4.6+.
Disables Content Security Policy (CSP) in Magento 2. Simplifies disabling CSP for shops where it's not required.