Robust security within an e-commerce system is non-negotiable. Strong encryption, authentication, regular audits, and a defense-in-depth posture protect customer data, mitigate breach risk, and protect the merchant’s reputation.
Eight security practices
- Keep security patches up to date.
- Change the default admin URL.
- Set up two-factor authentication (2FA) for all admin users.
- Whitelist admin access by IP address.
- Run daily security scans (use the built-in Security Scan tool).
- Conduct monthly or quarterly penetration testing.
- Process log files actively — don’t just collect them.
- Maintain backups and a disaster recovery plan.
Fastly: CDN, DDoS, and WAF
Fastly provides CDN and DDoS protection from Layer 3 through Layer 7. The Fastly CDN isolates direct access to the origin server, and the public DNS only points to the Fastly network.
The Fastly DDoS solution protects against highly disruptive Layer 3 and Layer 4 attacks, plus more complex Layer 7 attacks. Layer 7 attacks can be blocked using custom rules based on the entire HTTP/HTTPS request — headers, cookies, request path, client IP, geolocation.
The Fastly Web Application Firewall (WAF)
Fastly’s cloud-based WAF uses third-party rules from commercial and open-source sources, including the OWASP Core Ruleset and Commerce-specific rules. Customers are protected from key application-layer attacks: known injection attacks, malicious inputs, cross-site scripting, data exfiltration, HTTP protocol violations, and other OWASP Top 10 threats.
WAF rules are updated as new vulnerabilities are identified. This means Commerce can virtually patch security issues in advance of formal software patches — a critical capability for the gap between a vulnerability being disclosed and a patch being available.
Reference
Adobe Commerce Security Scan tool →
Adapted from the Adobe Commerce Primer, slide 29. Last reviewed May 2026.