ddtcorex

24 Jul 2026 · 2 min read

The Magento 2 audit checklist: a repeatable health review

A repeatable Magento 2 audit you can run on any store — code, config, cache, search, security, and performance — with the questions that actually surface risk.

An audit shouldn't be a vibe. This post gives a structured, repeatable checklist you can run on any Magento 2 store to surface risk before it becomes an incident. It pairs with the performance and code-best-practice posts.

1. Code & extensions

  • How many third-party modules, and are they all needed?
  • Any Preference overrides of core classes? (red flag for upgrade risk)
  • Any direct EAV/SQL queries in custom code instead of repositories?
  • Is there a test suite, even a small one?

2. Configuration

  • Deploy mode: production, not default/developer?
  • Full-page cache enabled? Which backend?
  • Sessions and cache in Redis (not files)?
  • Correct base URLs per store scope?

A framework-aware local orchestrator such as Govard wires these defaults (FPC backend, Redis sessions/cache, Varnish) automatically, which makes the audit reproducible across machines instead of relying on one person's setup.

3. Caching & edge

  • Is Varnish in front for anonymous traffic?
  • Cacheable blocks correctly marked? Any leaky session cookie bypassing the edge cache?
  • Static assets cached and versioned?

4. Search

  • Search engine (OpenSearch/Elasticsearch) healthy and reachable?
  • Index current, or stale (new products missing from search)?
  • Facet attributes indexed?

5. Database & indexing

  • Indexers scheduled, not "on save" for large catalogs?
  • Slow query log reviewed? Custom tables indexed?
  • Backups and a tested restore path?

6. Security

  • Admin isolated (e.g., behind an access proxy) and 2FA on?
  • Patches / security updates current?
  • File permissions and app/etc exposure correct (served from pub/)?
  • Unused admin accounts removed?

7. Performance baseline

  • Capture a profiler trace as a baseline; track TTFB and DB query counts over time.
  • Compare against the best-practices ranking from earlier in this series.

Output: a prioritized report

Don't dump findings; rank them: Critical (security/down risk), High (real perf/revenue impact), Medium (maintainability), Low (nice-to-have). That ranking is what makes an audit actionable.

What's next in this series

The audit tells you what's wrong; debugging tells you why. Next: the Magento 2 debugging toolkit — profiler, logs, and a production-shaped local environment.

Next in this series: Magento 2 debugging toolkit — /blog/magento2-debugging

magento2auditbest-practices