I run a Spanish baby/children's products store on Magento 2.4.7 (Porto theme, Cloudflare in front, ~15,000 products, ~420 commercial categories, domain since 2010). I have spent nine months and dozens of read-only forensic audits on this, and I'm posting because I've run out of hypotheses, not because I haven't looked. I'll keep it factual; happy to share any log or export.

The pattern

• Product pages rank normally. For a core query like "moisés bebé" (baby bassinet), individual product pages sit at pos. 6-8.
• The category page for the same query sits at pos. 22-27, and has for two years. It is the page with by far the most impressions for that cluster (64% of impressions for the head term, 86% of the cluster), so it's not fragmentation between URLs.
• Across all 424 commercial categories the median position is ~18-20. The store enters the top 5 only where there's essentially no competition.
• The pages outranking the category are tiny: a handful of products, supplier-copied descriptions, some visibly abandoned (no updates in years, broken blogs). They have no measurable backlink profile. My category has a long, hand-written buying guide, 240 products, proper internal linking. Content volume is not the difference.
• Sistrix visibility: peak ~1.1 (Mar 2023), single step down at the Oct 2023 core update (~0.65 → ~0.25), partial recovery to ~0.6 in H1 2024, then continuous bleed to 0.12 today. GSC impressions: 661k (Dec 2024) → 354k (Mar 2025) → 123k (Sep 2026). Clicks flat at ~40-50/day for 9 months. No manual action, no security issues in GSC.
• Google Images used to be the main traffic source (30-40 clicks/day); it fell to 3-4/day at the Aug 2025 migration and never came back, even after all image URLs were fixed and re-crawled.

What has been checked and ruled out (each with logs or exports, not guesses)

Crawl access

• Cloudflare: 30 days of request logs filtered on ASN 15169 show 0 mitigated requests. Bot Fight Mode permissive, Hotlink Protection off, Browser Integrity Check off, Rocket Loader off, no HTML caching at the edge, SSL Full (strict). A country-block rule existed, but Google was exempted by a skip rule placed above it since June; verified 814k events, zero blocks or challenges to Google. Pausing the country rule for a week changed nothing for Googlebot.
• Server: zero 5xx to verified Googlebot. 0 blocks. Googlebot reaches the origin at a steady ~5-7k requests/day; it's not being throttled, it just doesn't ask for more.

Rendering / delivery

• Fetched the category as Googlebot, as Chrome, and from origin: identical HTML, no JS dependency for content, LCP mobile ~3.5s. Compared against a control category on the same theme that ranks pos. 5-9: same template, same weight, same script count. So the theme's weight (large mega-menu, ~200 script requests) is shared by categories that rank fine.

Index hygiene

• Faceted navigation: it was open to crawl from roughly Oct 2024 to Sep 2026 (a Mageplaza layered-nav multi-select bug generated >10⁶ URLs; Googlebot crawled 142k filter URLs in one week in Aug 2026). Fixed: noindex since Mar 2026, full robots block since Sep 2026. GSC now shows 15k indexed, 881k "blocked by robots", 144k "noindex" — all expected and shrinking. No facet URL is indexed.
• Pagination: self-canonical on all paginated pages since Jul 2026. Out-of-range ?p=N pages fixed.
• A noindex bug (theme robots plugin) hit Feb-Apr 2026; fixed Apr 13. Visibility didn't come back afterwards.
• Images: a legacy /cache/ image URL pattern was replaced by a stable path for all 12.7k products in Jul 2026; Googlebot-Image has been re-crawling RAW → stable 301s since.

Site history

• An old SEO-spam snippet (serp.trade iframe injected in two category descriptions) was present 2019 → mid-2025, removed at the migration. No manual action ever. Note the store ranked at its best (2023) with that snippet present, so it's unlikely to be the ceiling.
• Robots.txt was emptied by mistake for ~6 months in 2024-25 (filters crawlable), then restored.
• Apex domain served the home page as 200 without canonical for ~1 year (2024-25); now 301 to www.

Things that did move the needle

• Adding 183 products to one category in Jan 2026 moved it from pos. 35 to 19. Nothing else, technical or editorial, has ever moved a category position in two years.

What I'm asking

I am not asking for a generic audit checklist; everything on the usual lists has been done and verified with data. What I'm looking for is someone who has seen this specific shape before:

1. A Magento 2 store where category pages are systematically capped ~15 positions below its own product pages, with the technical layer verified clean, and what the cause turned out to be.
2. Whether a two-year history of index inflation (10⁶ facet URLs known to Google, now blocked) is known to leave a lasting "ceiling" on category pages even after cleanup, and how long recovery took in cases you've seen.
3. Whether anyone has seen a Google Images collapse tied to a Magento 2 migration that did not recover after fixing the image URLs.

I can provide: GSC exports per URL, Googlebot log analysis (verified by rDNS), Cloudflare logs, the full forensic reports. Thank you for reading this far.

We have created a Quickbooks Online Connector for Magento 2. Check it out https://toweringmedia.com/magento-2-quickbooks-online-connector

On a multi-brand Adobe Commerce storefront, catalog or checkout changes can also affect authored content, promotion claims, and measurement. Does one release owner sign off across those teams, or do merchandising, engineering, and analytics each run separate checks?

What has actually caught a silent content or measurement issue before production?

The PHP security team has released fixes for two critical vulnerabilities, both rated 9.2 out of 10 (CVSS v4.0), that can allow someone with no account and no access to your site to run their own code on the server. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team state that there are no complete mitigations and updating is the only safe choice.

If you're running Magento, patch now, or ask your host to.

Our writeup can be found here: https://prostack.uk/blog/critical-php-security-update-october-2026/ - hope it's useful.

PHP2Shell has been rated 9.2 out of 10. Sansec Shield may not be able to block.

There’s a patch being released at 2PM and attacks are expected to start within 15 minutes.

Enjoy restructuring your day everyone!

https://sansec.io/research/php2shell

I want a platform that helps me manage the WAF whenever new vulnerabilities come out. It should also let me update the server requirements quickly when I need to.

Hello guyz!,
Has Magento work really dried up?

Just a heads up if anyone uses Revolut. In my case the section that shows product in cart page was missing.

I guess their official plugin not exactly built with the highest quality...

Thanks everyone for all the help and suggestions, I am inching my way there.

I have downloaded and install the Patches for my version 2.4.8-p5 for July and August and was able to get them patched. After I was able to run a status check and there are some of the CVE_2026-xxxxx Vulnerability Details/status are showing "NOT_APPLICABLE". Does this mean they are not intalled or not needed and avoided? Most of the them do show "PROTECTED"

How do I know if I am 100% patched for these two (July and August) Patches?

Details as follows:

Here are the status showing the two patches were installed

"applied_patches": [

"248p5-2026-07-001-CE",

"248p5-2026-08-001-CE"

],

"missing_patches": [

"248p5-2026-09-001-CE",

"248p5-2026-10-002-CE",

"248p5-VULN-39341-CE"

],

"unknown_patches": [

"248p5-2026-10-001-CE"

However after appying the August patch I did receive the fowwing warning.

"registry_source": "cache",

"warnings": [

"Failed to forward-apply prerequisite 248p5-2026-07-001-CE when preparing dry-run for 248p5-2026-10-001-CE; result may be inaccurate"

Also after running the Patches I did run Adobe Security Scan and shows Alerts and Notifications -The patches or security updates might be available for your store.

Group: Patch Scan Name: APSB26-73 Status: Alert

I also ran MageInfo Online Scan and also appears to be an issue unless I am reading these results wrong.

One of these versions

• (x) 2.4.8-p5
• (x) 2.4.8-p5-patch-july2026

Not on the latest version (2.4.8-p5-patch-sep2026). Advice: update immediately!

Isolated security patches

• July 2026 — Gallery XSS hardening Unknown
• August 2026 — APSB26-92 bundle Missing
• September 2026 — ka-44020 (IDOR/ACL fixes) Missing
• October 2026 — email template, token and escaping fixes Unknown

As for as Sept and Oct patches, I was not able to run the Sept (APSB26-138) patch successfully as I did the first two. It failed to install for some reason, not sure if there a different way to install than the other two because there are two patches for Sept. Trying to ge this part figured out as well before Octobers which seems to be the issue with two patches

Hey everyone,

I’m a senior Magento 2 developer and Adobe Certified Expert, and I’ve worked on a lot of Magento 2 projects over the years. One thing I kept noticing is how hard it is to find learning material that’s current. A lot of tutorials out there are outdated or skip the “why” behind things.

So I started a free Magento 2 course on YouTube. I’m uploading around 10 videos a day, so the playlist is growing quickly.

Playlist: https://www.youtube.com/playlist?list=PLF9CIkwl81j0

I’d love your input: if there’s a Magento topic that has always confused you drop it in the comments and I’ll add a video on it to the playlist.

Feedback on the existing videos is welcome too, good or bad. I want this to actually be useful.

Hello guys! I added the default hyva theme on M2 and got it running, but I came across this problem, where the view at let's say "abcd.com" doesn't have the same navbar as "abcd.com/home". I am new to Magento, I don't know what to do.

I was in the process on trying to update the July APSB26-73 Patch when I was alerted the newely released 2.4.8-p6 includes the critical security fixes from APSB26-73.

However I cannot verify this any where else online. Has anyone noticed this before I attemp this update

A while back I posted about Lynx, the single-page app storefront we've been building for Magento 2. The first version is now released.

- Runs inside Magento: no separate frontend app or hosting like a PWA

- React or Vue components

- Drag-and-drop builder for every page, not just CMS pages

- One-page fast checkout

- MCP support for building pages with Claude, plus public Claude skills for third-party module compatibility: https://github.com/oocscommerce/claude-skills

- 95+ mobile PageSpeed on the demo

Demo: https://lynx-demo.oocscommerce.com/

Docs: https://docs.oocscommerce.com/lynx/

Free license, no credit card: https://www.oocscommerce.com/lynx-magento.html

Thanks to everyone who gave feedback on the earlier post. Bug reports and questions are very welcome

I am needing to update all the monthly security patch releases they have released since July ASAP.

I have successfully updated my site from 2.4.7 to 2.4.8-p5 on my own and have several other updates in the past, however applying these updates looks a little different to me and I have yet to figure the best and simplest possible way to this.

One of the more important patches I need is for StyleSmuggler as it appears I may have got hit with it. While I know the patch will not clean it, I still need the protection for it along with an alert I received that APSB26-73 (July Patch, I believe) is not installed.

Anyone with east to follow steps to patch all patches available, please suggest.

Hi everyone!

I’d like to share an open-source module for OpenMage / Magento 1 that I recently built for a real-world project and published on GitHub: Modestox_DeltaLog.

To be transparent, I’m not claiming this module is revolutionary or that it’s a commercial-grade product. I built it to solve a practical problem in a live project, while also contributing to my portfolio and growing my open-source presence.

What problem does it solve?

In stores managed by multiple admins or managers, it’s a familiar story: someone changes an order status, a product price, or a customer group, and later there’s no easy way to determine who made the change.

Existing auditing solutions can sometimes be overly complex, generate excessive database writes, or introduce unnecessary overhead whenever an object is saved.

What does the module do?

Modestox_DeltaLog tracks selected data changes, recording:

• Who made the change (admin, customer, Cron, or CLI)
• When it happened
• Source IP address, where available
• What changed, including previous and updated values

Key features

• Performance-focused: Tracking rules are compiled into the OpenMage cache, reducing the need for database lookups on every object save.
• Automated log cleanup: A scheduled Cron job purges outdated logs daily according to a configurable retention period.
• PHP 8.3 compatibility: The codebase uses strict typing throughout.

A note on testing

I’ve tested the module against my own use cases, and it works well for the scenarios it was designed to handle. That said, it hasn’t been extensively tested against every possible edge case, unusual third-party module configuration, or high-load environment.

The module is fully open source and released under the MIT license.

I’d really appreciate any feedback, code reviews, or suggestions for improvement!

If you find the module useful, have ideas for future development, or are interested in collaborating on open-source projects, feel free to send me a DM or connect with me on GitHub. I’d be happy to chat!

Repository link: Modestox DeltaLog

Two months ago, I saw a lot of posts on LinkedIn about the revival of Magento, based on data from https://trends.builtwith.com/shop/Magento.

Honestly, I had doubts back then, thinking it was some changes to builtwith scripts/algorithms. Today, I have no doubts that it was some correlation.

The reasons for my doubts were a couple. First, a simple "Why?" 😄 Second, I hadn't seen a lot of new vacancies for Magento developers.

But if you look at 2018, there was a similar peak on the graph. I doubt that 40K stores were added in one moment and then the same amount removed.

What do you think? What is the reason for such spikes on the graph?

Adobe has release a new set op patches, with a 10.0 as the highest score for an RCE (Remote Code Execution). So .. update!

Mageinfo.online detects if the patch is implemented for the 2.4.9 release and some older ones. 2.4.8 cannot be detected, because in that version there is no functional change which can be detected.

I just completed several Magento site updates from 2.4.7 to 2.4.8-p5 including most of our extensions. After doing so I ran the Magento Security scan and found a couple of issues. One was a Patch APSB26-73 and the oher was a Failed Scan: Compromise, "BotNet Suspect".

I will attempt to install the Patch soon, however my biggest concern right now is the BotNet Suspect. Is anyone familiar with this and how to fix or remove it.

The crazy thing is I have an identical DEV Site that I am working with on the same server testing all the updates before doing so on the Live Site. I made a copy of the dev site from the live site just a few days or so ago. I also did a security scan on the dev site and the BotNet Suspect Passed.

Thanks for any support anyone can offer

Hey everyone,

I’m a certified Magento / Adobe Commerce full-stack developer with 7+ years of experience, looking for a new freelance project or a long-term remote role.

I can help with:

• Custom modules and functionality
• Performance optimization and Core Web Vitals
• Checkout fixes and payment integrations
• API and third-party integrations
• Debugging and improving legacy code
• Magento upgrades and store migrations
• AI automation and workflow integrations

My tech stack includes Magento 2 / Adobe Commerce, PHP, JavaScript, Hyvä, GraphQL, Redis, Elasticsearch, Docker, and AWS.

I focus on clean, maintainable code and keeping production stores stable. I’m available for specific fixes, larger development projects, or ongoing support.

If you’re looking for help with your Magento store, feel free to DM me with a brief overview of the project. Happy to discuss the scope and availability.

Hi all,

I´m using Magento for 10 years now, and doing all the work in site maintenance.
What I´ve noticed is even with the latest Magento version, your still vulnerable to all kind of attacks, if your not proactive monitoring the web traffic that reaches your store.

The patches and upgrades represent costs, instability in the store, that could compromise business.

The use of a firewall represent another layer, in contact with customers, that in comercial sense can have a toll in sales.

What´s yours experiences?

Lynx keeps Magento as the backend and renders the storefront as Vue or React components over Inertia.js, so there is no GraphQL layer and no separate frontend to host. Styling is Tailwind, pages come from a drag-and-drop page builder, and Server-Side Rendering runs on Node or a Cloudflare Worker.

Demo: https://lynx-demo.oocscommerce.com/

Feedback welcome.

Hello guys! I am a 17 years old from Romania, and all my life I developed dynamic webpages with PHP and presentation sites with frameworks of Javascript, in the past I have Laravel & Symfony as PHP frameworks. I am looking to start a new journey with Magento, for a job at 18, in 4 months, what resources do you recommend? what things should I look for? Where can I find the best resources & tutorials? Thank you.

I am wanting to use Magento's default 2FA for my Admin and for some reason it is not listed under Stores>Configuration>Security as it sould be. Is there a way I can get it enabled to show up so I can get it setup. I have seen it listed there before, now it has disapeared.

The only thing I can think of is some time in the past I installed Two-Factor Auth from Mageplaza and maybe that disabled it, idk.