Magento 2 maintenance checklist, task by task

In short

Every day: cron is running, message queues are moving, indexes are up to date, the disk has room.
Every month: Adobe security patches (second Tuesday), extensions, accounts and the certificate.
Every quarter: a test restore of the backups. Every year: the domain name and the end of support for Magento and PHP.
Monitoring can be automated. Decisions need someone: you, your agency or a maintenance contract.

Contents

Why a Magento 2 store needs maintenance

A Magento store does more than display pages. Behind the scenes, scheduled tasks recalculate prices, send emails, update the search indexes and process exports. Adobe is clear about it: without a properly configured cron, Magento does not work as intended.

Around the store, other things age: the code gets patches every month, certificates expire, the disk fills up, accounts pile up. Maintenance means checking all of this in time, before a customer notices.

This article is the hub of our blog: each task links to a detailed guide. Do you also run a WordPress site? The same habits apply, and spotting a hacked WordPress site covers its security checks.

The Magento 2 maintenance checklist in one table

How often	Task	Guide
Every day	Cron, message queues, indexes	further down
Every day	Disk space and log size	Full disk, log rotation
Every day	Store uptime and orders	further down
Every week	Recurring errors, modified code files	Magecart skimmer
Every month	Adobe security patches	Adobe patches
Every month	Unused or unmaintained extensions	Security audit
Every month	Admin accounts and integrations	Suspicious account
Every month	HTTPS certificate	further down
Every quarter	Test restore of the backups	further down
Every quarter	Admin security settings	Secure Magento 2
Every year	Domain name, end of support for Magento and PHP	further down
Straight away	Priority 1 patch, critical vulnerability, a contractor leaving	PHP vulnerabilities, Magento hacked

Every day: check that Magento is running

The Magento cron

Why. Every minute, cron launches Magento’s scheduled tasks. Adobe lists some of them: catalogue price rules, newsletters, sitemaps, price and stock alerts, reindexing, currency rate updates, and all emails, order confirmations included.

How to check. In the admin panel, the message “One or more indexers are invalid. Make sure your Magento cron job is running” is a warning sign. On the server, the cron_schedule table tells you when cron last ran (commands further down).

What is normal. A last run dated within the current minute or so, and jobs in success. Jobs in missed or error piling up need investigating.

Message queues

Why. Some operations are not done straight away: they are put in a queue, then processed in the background by “consumers”. This is the case for exports, bulk attribute updates, coupon code generation and image resizing. By default, cron (the consumers_runner job) starts these consumers.

How to check. An export that never arrives or a bulk change that never applies are the visible signs. On the server, you check that the consumers are running.

What is normal. Operations started from the admin panel finish within a few minutes.

Indexes

Why. Indexes are precalculated tables: prices, categories, search, stock. An index that lags behind means a wrong price or stock level on the store. Adobe recommends Update by Schedule mode for large or busy stores: the index is updated by cron, in the background.

How to check. System > Tools > Index Management: every index must show Ready. On the server, bin/magento indexer:status also gives the backlog.

What is normal. All indexes Ready, a backlog close to zero.

Disk space and logs

Why. A full disk stops the database and blocks orders. Magento’s logs grow endlessly if they are not rotated.

How to check. Free space and how it changes from one week to the next. The size of var/log/system.log and var/log/exception.log. The details are in full disk on Magento and log rotation.

What is normal. More than 20% free space, steady growth you can explain, and logs rotated every night.

Uptime and orders

Why. A store can be down without anyone noticing at night or at the weekend. And a store that responds but no longer takes orders is down too.

How to check. A probe that calls the store at regular intervals, and an eye on the number of orders today compared with a usual day.

What is normal. The store responds, in a steady time, and orders come in at their usual pace.

Every week: read Magento’s errors

Recurring errors. The last lines of exception.log and the reports in var/report. The same error repeated thousands of times hides a bug, and sometimes an attack.
Modified code files. A file changed outside a known deployment may be a backdoor or a card skimmer.
This week’s backups. They did run, and a copy is off the server.

Every month: Magento security and updates

Security patches. Adobe releases isolated patches every month, on the second Tuesday. They do not change the version number: a store can look up to date and still be exposed. The method is in our guide to Adobe patches. PHP has its own vulnerabilities: see for example the critical PHP vulnerabilities of October 2026.
Extensions. Each one is code to keep track of. Remove those you no longer use, and check the others still get updates. Adobe recommends regularly auditing custom code and third-party extensions. See point 3 of the security audit.
Accounts and integrations. Adobe recommends regularly auditing accounts and removing those no longer in use. An account left by a former employee or agency is an open door. See spotting a suspicious admin account.
The HTTPS certificate. Let’s Encrypt certificates, very widely used, currently last 90 days. Let’s Encrypt has announced they will get shorter: 64 days from 10 February 2027, then 45 days from 16 February 2028. And since 4 June 2025, Let’s Encrypt no longer sends an email before expiry. Renewal must therefore be automatic, and monitored: a renewal that fails silently means a store shown as “not secure” a few weeks later.

Every quarter: test the Magento store’s backups

A test restore of the backups. The CNIL, the French data protection authority, recommends regularly testing the integrity of backups and the ability to restore them. Among the mistakes to avoid, it lists never checking whether they are usable, and keeping backups on the same system as the data. The backup tool built into Magento has been deprecated since version 2.3.0: backups are made with the server’s or the hosting provider’s tools.
Admin security settings: two-factor authentication for everyone, admin address, lockout after failed attempts. See how to secure Magento 2.
A full audit, with our 10-point checklist.

Every year: the deadlines people forget

The domain name. An expired domain means the store and the emails are cut off. For a .com, ICANN policy requires the registrar to send two reminders, roughly one month and then one week before expiry. The contact address still has to be up to date. Turn on automatic renewal and keep a valid payment method. For a country-code domain such as .fr or .co.uk, the terms are your registrar’s: check the expiry date in your customer account.
End of support for Magento and PHP. A version that is out of support no longer gets patches. The dates are in our guide to patches. Put them in your diary a year ahead: an upgrade takes preparation.
Access and contracts. Who still has FTP or SSH access, access to the server or the database? Which contracts (hosting, paid extensions, paid certificates) are coming up for renewal?

Magento maintenance: what can be automated, what needs a human

Task	Can be automated	What stays human
Cron, message queues, indexes	Monitoring and alerts	Understanding why they stopped
Disk space, logs	Log rotation, alerts	Finding what is growing, enlarging the disk
Uptime, orders	The probe, alerts	Diagnosing the outage
Security patches	Detecting missing patches	Applying, testing and deploying them
Extensions	Detecting known vulnerabilities	Deciding to keep, replace or remove
Accounts and integrations	Detecting new accounts	Knowing who is behind each account
Certificate	Renewal, alerts	Fixing a failed renewal
Backups	The backup itself	The test restore, and its verdict
Domain name	Automatic renewal	Keeping the contact and payment details up to date

You run the store: your part of Magento maintenance

Without a terminal, from the Magento admin panel:

The messages at the top of the admin panel. A message about invalid indexes or about cron should be reported to your developer straight away.
Index status, under System > Tools > Index Management: everything must be Ready.
Accounts, under System > Permissions > All Users: every account has a person behind it, and nobody has left.
The Magento version, at the bottom of every admin page: compare it with the end-of-support dates.
The domain name and the certificate: note their expiry dates and check that renewal is automatic.

For the rest, ask whoever manages your store for a regular update:

Message to your agency or developer

Hello,

To keep track of maintenance on our Magento store, could you send us a short update every month on:

cron and the message queues: are they running, and have any jobs failed?
index status and free disk space;
the Adobe security patches applied this month, and those still to be applied;
the extensions to update or remove;
the date of the last test restore of our backups;
the expiry dates of the HTTPS certificate and of the domain name.

Thank you.

You manage the server: Magento maintenance commands

The bin/magento commands are run from the Magento folder, here /var/www/store, as the user who owns the files (www-data in this example). None of them changes the store.

Is cron installed? Magento’s block sits between the #~ MAGENTO START and #~ MAGENTO END comments in the user’s crontab.

Terminal

sudo crontab -l -u www-data
Is cron running? These read-only queries on the Magento database give the last run and a summary of the last 24 hours.

MySQL or MariaDB client

Last job run, to compare with the current time SELECT MAX(executed_at) AS last_run, NOW() AS current_time FROM cron_schedule; Jobs in the last 24 hours, by status SELECT status, COUNT(*) AS jobs FROM cron_schedule WHERE scheduled_at > NOW() - INTERVAL 1 DAY GROUP BY status;

By default, Magento keeps the history of successful jobs for only one hour, and failures for three days: these queries tell you nothing about anything older.
Indexes and message queues.

Terminal, from the Magento folder

Status and backlog of each index bin/magento indexer:status Declared consumers bin/magento queue:consumers:list Consumers currently running pgrep -af 'queue:consumers:start'

A Schedule Status column showing a large backlog (“12345 in backlog”) means cron is no longer keeping up.
Disk and logs.

Terminal, from the Magento folder

df -h ls -lh var/log/
The HTTPS certificate, from any computer (replace the address with your store’s):

Terminal, from any computer

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null | openssl x509 -noout -enddate

The notAfter= answer gives the expiry date of the certificate being served.
Patches and extensions: php vendor/bin/patch-status and composer audit --locked, explained in our guide to patches and the security audit.

Tocsin24 does the monitoring, you keep the decisions

With the Magento module installed, Tocsin24 continuously monitors a good part of this checklist. Store uptime and response time, through a probe at the frequency you choose: an HTTPS certificate that is no longer valid makes the probe fail, and the “Site unreachable” incident opens. Disk space and how fast it is filling up, log size. Adobe monthly patches not applied and known vulnerabilities of your version. New admin accounts, new integrations and their access tokens. Code files modified outside a deployment. Orders and sign-ups that stop.

Tocsin24 does not directly monitor cron, message queues or indexes. There is an indirect sign: Tocsin24’s code check runs with Magento’s cron. If it was active and Tocsin24 has received nothing from it for 24 hours, the “Protection gone” incident opens. Tocsin24 does not check your backups, your domain name’s expiry date, or the certificate’s expiry date before it becomes invalid: those points stay in your diary.

For the decisions, our maintenance service starts from these alerts: maintenance contract or on-demand intervention, with an estimate approved before each piece of work.

Try it for free See Magento 2 monitoring

Espace disque

Espace libre sur le serveur du site.

Disque du serveur racine du site À surveiller

16 Go libres sur 100 Go 84 % utilisé

+2,5 Go par semaine · plein dans environ 6 semaines Relevé le 23/10 09:00

Erreurs de l'application

Logs Magento lus par le module Tocsin24, sans accès à créer chez votre hébergeur.

Récupérés

var/log/system.log 42 Mo écrit il y a 2 min
var/log/exception.log 1,8 Go écrit il y a 3 min Rotation absente

exception.log fait 1,8 Go et remonte au 4 mars 2025 : la rotation des logs n'est pas en place.

Nous en lisons seulement les lignes récentes : la détection n'est pas gênée. Pour éviter de saturer le disque de la boutique, demandez à votre hébergeur ou à votre agence d'activer la rotation des logs Magento (archivage et compression réguliers).

Failles

Inventaire relevé chaque jour par le collecteur « Inventaire des correctifs », et exposition aux failles connues.

Magento

2.4.8-p5

Community

Supportée par Adobe jusqu'au 31 mai 2028

PHP

8.3.27

Correctifs de sécurité seulement, jusqu'au 31 décembre 2027

Module Tocsin24

1.0.2

Dernière vérification

23 octobre 2026 à 09:00

Correctifs de sécurité Adobe

Bulletins Adobe des 6 derniers mois qui visent la version 2.4.8-p5, avec l'archive à télécharger et le fichier de patch qu'elle contient. « Appliqué » quand le module a relevé le patch sur la boutique.

1 patch à appliquer

Octobre 2026

APSB26-153 · bulletin mensuel du 13 octobre 2026 Télécharger 2-4-8-p5-oct-2026.zip, puis appliquer 248p5-2026-10-001-CE.patch 11 failles exposées, dont 1 critique. À appliquer après les patchs des mois précédents (cumulatifs).

À appliquer

Septembre 2026

APSB26-138 · bulletin mensuel du 8 septembre 2026 Archive 2-4-8-p5-sep-2026.zip · patch 248p5-2026-09-001-CE.patch 4 failles corrigées

Appliqué

Septembre 2026

APSB26-146 · hors calendrier du 7 septembre 2026 Exploitée activement Correctif VULN-39341, publié par une annonce Adobe à part 1 faille corrigée

Appliqué

Application screens with example values.

Frequently asked questions

What does Magento 2 store maintenance involve?

All the checks and updates that keep the store able to sell: scheduled tasks (cron), message queues, indexes, disk space, security patches, extensions, accounts, backups, certificate and domain name. Some of it is monitored every day, the rest is done every month or every year.

How often should Magento 2 be updated?

Adobe releases security patches every month, on the second Tuesday. Check them every month, and apply a priority 1 patch straight away. The details are in our guide to Adobe patches.

What happens if the Magento cron stops running?

The store keeps showing its pages, but everything scheduled stops: indexes, emails, price rules, message queues. The prices and stock levels shown can become wrong. Magento then often displays the message “One or more indexers are invalid. Make sure your Magento cron job is running”.

Is a Magento maintenance contract mandatory?

No. But someone has to do the tasks in this article: you, your agency, your hosting provider or a contractor. A contract sets out who does them, how often, and how quickly in case of an outage.

Which part of maintenance can be automated?

Monitoring: cron, message queues, disk space, uptime, certificate, accounts and modified files can all be checked by a tool that sends alerts. The decisions remain human: applying a patch, removing an extension, testing a restore, renewing a contract.

Cédric Michel

Cédric has been building Magento stores for 18 years and holds the Adobe Commerce Developer Expert certification. He created Tocsin24 to monitor the security and health of Magento 2 stores and WordPress sites.

Adobe Commerce Developer Expert
Verify the certification on Adobe’s website

Magento 2 maintenance: daily, monthly and yearly tasks