1

Has anyone used the Magento Community version for a live site?

http://www.magentocommerce.com/product/compare#comparison-chart

I've used ubercart for a few sites and am wondering if the free version of Magento is workable for someone with CMS and eCommerce experience, or are there security issues?

Improve this question
3
  • 1
    I would think if there were any known security issues that it would be patched by now.
    – John Conde ♦
    Commented Jul 8, 2011 at 15:53
  • I just used security as an example. I was wondering if you can use the free version for 'proper' sites or if their are too many limitations. Thanks
    – Evanss
    Commented Jul 8, 2011 at 16:08
  • Use Version 1.4.2.0 or later. There have been minor concerns with cross site scripting in previous versions. Get your templates from a trusted source or familiarize yourself with proper programming to avoid XSS when you modify stuff so you don't introduce any. Limitations? This is enterprise level stuff even on CE, it needs the horsepower to run it, shared hosting need not apply for SMB use over 2000 products and 25 daily customers.
    – Fiasco Labs
    Commented Jul 16, 2011 at 18:50

3 Answers 3

Reset to default
3

The community edition doesn't have the secure payment bridge which helps with PCI compliance. That's the real difference between community and pro. For commercial sites that process more than a few thousand credit card transactions a year, use magento professional or magento go if it's a small business.

I don't mention enterprise because you'd already know if you needed it.

Improve this answer
3
  • Is the secure payment bridge needed for pay pal payment standard? Im guessing not as you dont handle credit card data yourself. Thanks
    – Evanss
    Commented Jul 8, 2011 at 16:26
  • @user793011 - If you're using paypal primarily, then all you need is community. Payment bridge helps if you're taking credit cards directly. I wouldn't have any security concerns running community in production using only paypal or google checkout if hosted in a secure environment.
    – JMC
    Commented Jul 8, 2011 at 16:31
  • Is the secure payment bridge really necessary? Our credit card processor is concerned about meeting PCI-DSS and thinks that the USAePay gateway module meets all the requirements. Just don't use the Stored Credit Card method.
    – Fiasco Labs
    Commented Jul 16, 2011 at 18:44
0

The security in Magento is done properly, i.e. URL key for admin, MD5 for passwords, .htaccess restrictions to protect user uploaded files, an encryption key that goes with the build.

Regarding payment by credit card, you can store credit card data, however, anyone with more brain-cells than a foetus uses a payment gateway with Magento. Popular gateways are provided by all payment processors or someone has written a gateway for them.

There are thousands of Magento stores out there, taking money. Have a look at the Magento blog and their Magento-spotting feature. Take it back to before 'Professional' came out to see top brands on Magento CE.

Improve this answer
0

The community edition doesn't have the secure payment bridge which helps with PCI compliance

There is a PA-DSS certified solution for Magento CE - http://www.magentocommerce.com/magento-connect/kuzzma/extension/4110/cdev_xpaymentsconnector

The connector module is free, but vendor asks ~$400 for X-Payments

If you're using paypal primarily, then all you need is community.

Depends on what PayPal method you are going to use. For PayPal Website Payments Pro, PayPal Website Payments Pro Payflow Edition and PayPal PayFlow Pro where a payer enters credit card info right on your web-site you are to use a PA-DSS certified software otherwise you can be fined by your bank/merchant account provider. While they do not impose these regulations strictly at the moment we see more merchants being penalized for accepting credit card directly and not using a PA-DSS compliant software.

Migration to a "web-based" payment gateway where customers go to payment gateway's secure web-form for payment is another and much more cost-effective solution in this situation. Though in some cases such distraction (i.e. moving a customer from your web-site to payment gateway web-site) may influence conversion rates negatively.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.