Magento Analyzer

Ecosystem overview

Magento Statistics

Aggregated across 1,301 shops MageInfo has checked. No individual shop is ever identifiable from these numbers.

Last updated 3 minutes ago.

Shops tracked

1,301

Running an up-to-date version

9.1%

Average security score

77.8/100

Flagged for a known CVE

96.8%

Geography & hosting

Where the hosting sits — by hosting-provider country, not the shop's own country.

Where shops operate from

  • 🇳🇱 NL399
  • 🇬🇧 GB124
  • 🇺🇸 US74
  • 🇮🇹 IT51
  • 🇩🇪 DE39
  • 🇧🇪 BE30
  • 🇷🇴 RO30
  • 🇪🇪 EE24
  • 🇫🇷 FR19
  • 🇵🇱 PL11

Where shops are hosted

  • 🇺🇸 US649
  • 🇩🇪 DE160
  • 🇧🇪 BE121
  • 🇳🇱 NL92
  • 🇬🇧 GB59
  • 🇨🇦 CA23
  • 🇫🇷 FR17
  • 🇮🇹 IT17
  • 🇮🇪 IE16
  • 🇪🇪 EE15

Top hosting providers

  • Cloudflare, Inc.515
  • Fastly, Inc.79
  • Hetzner Online GmbH61
  • Combell NV56
  • Amazon.com, Inc.31
  • Combell Network25
  • Shopify, Inc.22
  • DigitalOcean, LLC19
  • Team Blue Carrier Limited17
  • Openminds Bvba15

Checks per platform

3,360 checks in total, split by the platform detected. Sites counts distinct domains behind those checks.

Platform Checks Share Sites Last 30 days
Magento 2,627
78.2%
951 405
Not determined 652
19.4%
358 162
Shopify 26
0.8%
22 12
Mage-OS 14
0.4%
9 1
WordPress 12
0.4%
11 8
WooCommerce 11
0.3%
11 3
Shopware 8
0.2%
7 3
BigCommerce 2
0.1%
2 0
Tiendanube 2
0.1%
2 0
Drupal 1
0%
1 1
HubSpot CMS 1
0%
1 0
OpenCart 1
0%
1 0
PrestaShop 1
0%
1 0
Salesforce Commerce Cloud 1
0%
1 0
Squarespace 1
0%
1 1

Check activity

Checks per day, last 90 days.

Ecosystem health trend

Daily snapshots since 2026-09-20.

Version health

Based on 860 shops with a detected version.

  • Up to date 9.1% (78)
  • Patch behind 80.1% (689)
  • Line outdated 0.1% (1)
  • End of life 10.7% (92)

Security score

Based on 850 shops — combines version status, known CVEs and server hygiene.

77.8/100 average

Isolated (out-of-band) security patch adoption

Independent of the official Magento patch level — a shop can be current on one and behind on the other.

July 2026 — Gallery XSS hardening 91% applied (488 known)
August 2026 — APSB26-92 bundle 66.1% applied (646 known)
September 2026 — ka-44020 (IDOR/ACL fixes) 48% applied (646 known)
October 2026 — email template, token and escaping fixes 26.8% applied (56 known)

Known CVE exposure

Based on 250 shops checked against known Magento CVEs.

96.8% flagged for at least one known issue

CosmicSting — CVE-2024-34102 8% (20)
Session Reaper — CVE-2025-54236 4% (10)
StyleSmuggler — unpatched, no interim filter 74.4% (186)
StyleSmuggler — interim filter active 21.2% (53)
/media/ executes PHP files 2% (5)

SSH exposure

Based on 1,301 shops whose origin server (not behind a known CDN) could be probed on port 22 — a pre-login banner + key-exchange read only, nothing more.

18.9% have SSH reachable from the internet

Vulnerable to Terrapin (CVE-2023-48795) 4.9% (12)
Outdated OpenSSH (pre-8.0) 7.3% (18)
regreSSHion — CVE-2024-6387 0% (0/246)

131 more in the affected version range, vendor patch level unconfirmed.

Pre-auth ping-flood DoS — CVE-2025-26466 0% (0/246)

5 more in the affected version range, vendor patch level unconfirmed.

Pre-auth double-free — CVE-2023-25136 0% (0/246)
Red Hat/Fedora signal-handling race — CVE-2024-6409 0% (0/246)

Site quality

GEO / AI discoverability

69.3/100

1,232 shops

Real-user performance

89.5/100

536 shops

PHP exposure

Based on 422 shops whose server headers were read. 2.1% (9) leak their exact PHP version.

Critical PHP RCE of 21 Oct 2026 (CVE-2026-109618 / CVE-2026-109619), of the shops that leak a version

  • Older than the fix (possibly affected)55.6% (5)
  • Fixed release or newer44.4% (4)
  • On a branch with no upstream fix (8.1 and older)11.1% (1)

"Possibly" because a distribution can backport the fix without changing the reported version.

Shops that hide their PHP version, inferred from their Magento version

  • Magento version only allows PHP 8.1 or older (no upstream fix)4.2% (11 of 265)

Derived from Magento's composer.json PHP constraint, not measured: it is the allowed range, so it only counts where every allowed branch is 8.1 or older.

PHP branches seen

  • PHP 8.43
  • PHP 8.32
  • PHP 8.23
  • PHP 5.31

Security hygiene

  • Security headers all present13.3%
  • Static content versioning enabled92%
  • Content-Security-Policy enforced25.4%

Exposed (should be 0%)

  • .git/HEAD0.2%
  • phpMyAdmin0.9%
  • phpinfo()0.8%
  • composer.lock0.2%
  • env.php0%

Outdated web server (nginx/Apache, of the 294 shops with a version-bearing banner)

  • Outdated1%

Theme popularity

Based on 1,134 shops with a detected theme.

  • Luma889
  • Hyva205
  • Headless37
  • PWA3

Popular named themes

Porto 16 Pearl 12 Claue 5 Argento 5 Martfury 2 Market 1 Natural 1 Magetheme_child 1 Revo 1

Hyvä freshness (of 58 Hyvä shops matched to a known build)

6.9% on an outdated build

Tech stack adoption

Based on 422 shops with detected tooling — most common tool per category.

Analytics

Google Tag Manager 180 Meta/Facebook Pixel 127 Klaviyo 56 Google Analytics (GA4) 53 Mailchimp 39 Hotjar 32 Microsoft Clarity 32

Search

Doofinder 9 Klevu 9 Algolia 9 Nosto 3

Reviews

Trusted Shops 36 Trustpilot 24 Kiyoh 15

Cookie consent

Cookiebot 43 Usercentrics 31

Live chat

WhatsApp 32 Zendesk 31 Smooch 5 Watermelon 1

Payment providers

PayPal 53 Google Pay 45 Apple Pay 44 Braintree 43 Klarna 27 Mollie 14 MultiSafepay 4 Buckaroo 3

Extensions

Anowave Ec 21 Amasty Customform 15 Magefan Blog 15 Amasty Xsearch Hyva Compatibility 13 Amasty Hide Price 11 Amasty Lib Swiper Js 10 Mageplaza Banner Slider 9 Amasty Scroll 8

Domain age

Based on 255 shops — RDAP registration date, or the Wayback Machine's earliest snapshot when that's unavailable.

19.7 years average