Security

As the bridge between you and your Shopware 6 stores, we manage sensitive credentials. We take this responsibility seriously — below we explain transparently the measures we take to minimise the risk of data misuse.

Secure infrastructure

Hosting in Germany

Our application runs at the German hosting provider Mittwald (Espelkamp, North Rhine-Westphalia). Mittwald is ISO 27001 certified and operates the data centre in compliance with the GDPR.

Encrypted access

All connections to the app, the API and the dashboard run exclusively over HTTPS with TLS 1.2+. We set the HSTS header (HTTP Strict Transport Security) so your browser permanently treats our domain as HTTPS-only — this rules out downgrade attacks on public Wi-Fi.

Protected admin area

The internal management interface (portal) is additionally restricted to a few fixed office IPs via IP whitelist. Even with valid credentials, no-one can reach the admin area from outside.

Secure login

Several security layers are stacked at sign-in:

• Cloudflare Turnstile (CAPTCHA): Before the actual login attempt, Cloudflare filters out automated bot requests without bothering you with image puzzles.
• Multi-stage rate limit: After 5 failed attempts per account or 20 per IP address within 15 minutes, login is automatically blocked — database-based, so it cannot be bypassed by clearing cookies.
• Argon2id password hashing: We never store plaintext passwords. Argon2id is the current gold standard and is, even in a hypothetical database leak, practically infeasible to crack in a reasonable amount of time.
• Secure sessions: Cookies are HttpOnly, Secure and SameSite=Strict — hardened against XSS and CSRF. After 1 h of inactivity you are automatically logged out.
• CSRF protection: Every state-changing action (save, delete, trigger plugin update) verifies a one-time token server-side.

Read-only architecture as core protection

The most important security feature of Webshop-Radar is architectural, not just configurational:

From a technical point of view we can hardly break anything in your store. Our Shopware API client enforces a hard read-only policy:

• HTTP methods: PUT, PATCH and DELETE are unconditionally blocked in code. This block cannot be bypassed via configuration.
• POST endpoints: Only the OAuth handshake and /search requests are allowed (read operations that must be POST due to Shopware schema reasons). Any other POST is rejected.
• Plugin updates (optional, if the Webshop-Radar plugin is installed): run through a separate, narrowly scoped CLI endpoint inside the plugin itself. You can toggle at any time in the plugin configuration:
  • Disable CLI commands — blocks all cache-clear / theme-compile / update actions
  • Disable plugin updates — specifically blocks the update path while still allowing other CLI actions
  These toggles are enforced on the plugin side — we cannot override them from the dashboard.

Automatic security patches

You can enable automatic updates for the Shopware 6 security plugin in Webshop-Radar. Whenever a new security patch is released, it is rolled out to all selected installations automatically – no manual intervention, with a full audit log per store.

Zero-day reaction time for Shopware security issues drops from hours to minutes.

Database-level data protection

Minimal data retention

Your account consists of e-mail, name, optional company and (for premium plans) billing address. We do not collect browsing history, no tracking, no third-party cookies.

Tenant separation

Every database query is scoped to your agency ID and additionally validated per action (validateInstallationOwnership). Even with a bug in a single API route, you cannot see foreign store data.

No SQL injection vectors

All database access uses prepared statements only (PDO prepared statements). There are no eval(), exec() or shell_exec() calls in the entire codebase.

Backups

Daily, encrypted backups by Mittwald. We retain 14 days of history.

Browser-side hardening

HTTP headers close typical web attack vectors:

Header	Effect
Strict-Transport-Security	enforces HTTPS for 1 year incl. subdomains
X-Frame-Options: DENY	our site cannot be embedded in foreign frames (clickjacking)
X-Content-Type-Options: nosniff	browser must accept MIME types as declared
Referrer-Policy	no leak of URLs to third-party sites
Permissions-Policy	microphone, camera, geolocation disabled for Webshop-Radar

Our recommendation: minimal integration permissions

Webshop-Radar needs access to your store — you grant it via Shopware integrations (Settings → System → Integrations → "Add integration"). Please follow the least-privilege principle:

As few rights as possible, as many as necessary.

In practice

Do not enable the admin checkbox. The admin flag in the integration grants us full access to everything — we do not need that.

Use a dedicated ACL role instead. Under "Settings → System → Users & Permissions → Roles" create a new role, e.g. Webshop Radar — Read-Only, and grant it only these permissions:

• System: View (for system info, PHP version, Shopware version)
• Plugins: View (for plugin list and version states)
• Sales Channels: View (for sales-channel status)

Assign this role to the Webshop-Radar integration. You can then run monitoring without anyone changing data through the integration.

Enabling plugin updates — safely

If you want to trigger plugin updates through Webshop-Radar, you have two options:

1. With our Webshop-Radar plugin (recommended): The plugin runs updates through the Shopware CLI — the integration needs no extended permissions for this. You control via plugin configuration whether updates are allowed.
2. Without the plugin: We use the Shopware native update API. The integration role then needs the additional permission Plugins: Edit. Even then, PUT/PATCH/DELETE remain blocked by our read-only policy — the update path is explicitly limited to a POST whitelist.

Token compromised? Revoke immediately.

You can immediately end access at any time:

• In Shopware: Integrations → delete the relevant integration → done
• If the Webshop-Radar plugin is installed: additionally disable all toggles in the plugin or uninstall the plugin

We recommend rotating your integrations every 6–12 months (delete old ones, create new ones with the same role).