Send us the address of a Magento, Adobe Commerce or Mage-OS store. A senior engineer reads what it already shows the world and emails you one page on where it stands and what to do first.
Freeno obligation
1page, by email
2working days
0logins or tests
Request your health checkFree, one page, two working days
Request received.
Your one-page health check will reach your inbox within two working days. It is read from publicly served pages only; nothing on the store is accessed or tested.
NowThe request is with us. Nothing else is needed from you: no login, no access.
Within two working daysOne page arrives by email: findings, what they mean, and what we would do first.
ThenNothing, unless you want it to. Reply to the email if you want an estimate for any of it.
Magento Security and Upgrade Health CheckPage 1 of 1
Store.co.ukRead from public pages on 29th October 2026
Needs attention
Platform and release
Magento Open Source 2.4.4-p3
Adobe support
ended 12th April 2025
PHP
8.1, end of life 31st Dec 2025
Frontend
Luma
Last deployment
about 14 months ago
Security headers
2 of 6 present
Hosting and CDN
UK host, no firewall seen
Hijack indicators
none found
What it means
The store is on a release that no longer receives security fixes, on a PHP version past end of life. No sign of compromise was found on the day.
What we would do first
Apply the outstanding security fixes as backported patches.
Add the missing security headers at the edge.
Plan the upgrade to a supported release, or the alternatives.
Example, store redacted PDF by email, within two working days Nothing accessed or tested
An example of the one page you receive, with the store name redacted. Every reading on it is illustrative.
Six readings, each with what it means for the store and what, if anything, we would do about it first. The values shown in grey boxes are examples.
01
Release and support date
Which Magento Open Source, Adobe Commerce or Mage-OS release the store uses, and the date Adobe stopped, or will stop, shipping security fixes for it.
Example2.4.6-p8standard support ended 11th Aug 2026
02
PHP and PCI
The PHP version, where the store reveals it, and its end-of-life date. An unsupported PHP version puts PCI DSS compliance at risk.
ExamplePHP 8.2end of life 31st Dec 2026
03
Frontend and upgrade path
Luma, Hyvä or a custom theme, and what that means for speed and for the route to a supported release.
ExampleFrontendLuma
04
Last deployment
How long since the code last changed, read from the versions of the static files the store serves.
ExampleStatic filesabout 14 months old
05
Headers, hosting and CDN
Which of six security headers browsers rely on are present, who hosts the store, and whether a firewall sits in front of it.
ExampleHeaders2 of 6 present, no firewall seen
06
Signs of a hijack
Spam pages indexed under the domain, injected scripts and the other signs that someone else is already in.
ExampleIndicatorsnone found
Every report ends with what we would do first, in order, if it were our store.
How it is done, and what it is not.
A health check is only useful if you can trust how it was made. It is read from outside, the way a search engine or an attacker first sees the store, and nothing more.
What we read
The pages the store serves to every visitor
The response headers that come back with them
The versions of its static files
What search engines have indexed under the domain
Public DNS records
What we never do
Log in, authenticate or ask for access of any kind
Run scanners or vulnerability tests against the server
Submit forms or place test orders
Add you to a mailing list or share the report
Guarantee any security outcome
Want a check with access, against the code and the admin? That is the technical audit: paid, authorised in writing, and priced before it starts.
Who it is for, and where to go if you need something else.
The check suits most Magento stores. If you need something different, we very likely do that too.
For
Owners and ecommerce managers of Magento Open Source, Adobe Commerce and Mage-OS stores in the UK and Ireland.
Stores on a release that is out of support, or will be soon: Magento 2.4.7 support ends on 31st May 2027.
Anyone who received our email about their store and wants the detail behind it.
Merchants who want an independent second opinion before they approve an upgrade quote.
Asking about a store that is not yours? By asking, you confirm it is yours to ask about. Health check terms.
Want someone answerable for security every month? The check is a snapshot from outside, on the day. What a security retainer covers.
What happens after you send the address.
Three steps, two working days, no obligation at any of them.
1
www.yourstore.co.ukRequest received
You send the store address
The form on this page, or a reply to the email that brought you here. Nothing else is needed: no login, no access.
One minute
2
pagesheadersstatic filessearch resultsDNS
An engineer reads the store from outside
Public pages, headers, static files, search results and DNS: the things an attacker reads first, read for you instead.
Within two working days
3
PDF
One page arrives by email
Findings, what they mean and what we would do first. If the store is in good order, the page says so.
Then nothing, unless you reply
Why we read UK Magento and Adobe Commerce stores at all.
Because the UK Magento estate is in worse shape than most of the people responsible for it know. This is what we found on the .co.uk web in 2026.
35%of Magento stores pass Google's Core Web Vitals on a phone, according to the HTTP Archive Web Almanac 2025
722Magento stores found hijacked and serving spam pages, almost all on unsupported releases
916stores still live on Magento 1, unsupported since June 2020
What merchants say about the people who write it.
Verbatim Google reviews. 5.0 from 22, and every one can be read on the profile.
… Security was a top priority for us and he answered all our questions and is always on hand when updates are urgent. … Whilst I know Rowan has many clients, he makes us feel like we are his only client which speaks volumes in itself. …
… Every time I’ve emailed them, they’ve been incredibly responsive with quick replies, clear answers, and genuinely helpful support. … The quality of their work is second to none. …
After having a number of bad experiences with 3rd party developers for Magento we decided to go with Rowan for our last site redesign and upgrade. … We no longer feel like we are in perpetual development. …
Questions merchants ask before they send the address.
Why is it free?
Because it is how most merchants first find out whether they have a problem, and some of them go on to become clients. It takes a senior engineer under an hour. If the store is in good order we say so and leave you alone.
Is this a sales call in disguise?
There is no call. The report arrives by email and ends with what we would do first if it were our store. If you want an estimate for any of it, reply to the email. If you do not, nothing else happens.
Will you contact our current agency or developer?
No. The report goes to the email address you give us and to nobody else. Whether you pass it to your agency, your developer or your board is up to you.
What if you find something serious?
We say so plainly at the top of the page, with what we would do first and in what order: for a compromised store, usually isolate, clean and then upgrade. If it looks urgent we say that too, and you can call us on 020 8058 5072. You are under no obligation to use us for the work.
Do you need a login, or will you test anything?
No. Everything in the report is read from pages and headers your store already serves to every visitor and every search engine. We do not log in, do not run scanners against the store, do not submit forms and do not test for vulnerabilities. If you want that depth, the technical audit is the paid, authorised version.
Is this a security guarantee?
No. It is a snapshot of what can be seen from outside on the day we look. A clean report does not mean a store cannot be compromised, and we never say otherwise.
Who sees the report?
You, at the address you give us, and the engineer who wrote it. We keep a copy for six months so that we can answer questions about it, then it is deleted. Details are in our privacy notice.
We are on Shopify. Can you check our store?
The health check is built around Magento, Adobe Commerce and Mage-OS, because that is where unsupported releases and hijacks are concentrated. For a Shopify store, tell us what is on your mind and we will reply within one working day.
Send the address. We will do the rest.
One page, by email, within two working days. Read from publicly served pages only; nothing is accessed or tested, and there is no obligation.
