Overview

Steps

• Enable maintenance mode
• bin/magento maintenance:enable

• Disable cron execution
• Backup the existing crontab: crontab -l > /tmp/cron.bak
• Clear the crontab: crontab -r

• Rotate encryption keys as per Adobe recommendation:
• https://experienceleague.adobe.com/en/docs/commerce-admin/systems/security/encryption-key?lang=en
• Once the key has been changed/env.php updated - visit the Quick actions section in the control panel to reload the application pods OR Perform a deployment

• Rotate all Admin panel user passwords

• Deactivate and regenerate all REST/SOAP/GraphQL integration tokens (System > Extensions > Integrations)

• Rotate OAuth client secrets for any connected third-party applications.

• Rotate payment gateway API credentials at the provider level (Stripe, Braintree, Adyen, PayPal, etc.).

• Rotate database credentials
• You may self-rotate any custom users however please contact our support team to rotate your root credentials as we'll need to process it for you.
• To update the Magento database user:
• Generate and print a new password:
• NEW_DB_PW=$(openssl rand -base64 24 | tr -dc 'A-Za-z0-9!@#$%^&*' | head -c 16;); echo "$NEW_DB_PW"
• Change to your Magento 2 directory:
• cd /var/www_m2/example.com/htdocs
• Update the DB password and set it in env.php
• mariadb -h "$DB_HOST" -u application -p"$APP_DB_PASSWORD" -e "SET PASSWORD = PASSWORD('$NEW_DB_PW');"
• magerun2 config:env:set db.connection.default.password "$NEW_DB_PW"
• Visit the Quick actions section in the control panel to reload the application pods OR Perform a deployment

• Rotate SSH/deploy keys and any cron or system-privileged service account credentials.
• Security policy ensures that in the event of a compromise, there is no access to system privileged credentials and that deployment private keys are not kept in the web environment.

• Rotate API keys for shipping, tax, and other integrated third-party extensions.

• Flush the cache, this can be done using the Magento CLI
• bin/magento c:f

• Enable cron execution
• cat /tmp/cron.bak | crontab

• Disable maintenance mode
• bin/magento maintenance:disable