OpenCart Total Security 2.4

OCS Security 2.4: a clearer view of your OpenCart store.

OCS Security 2.4 brings file scans, evidence review, verified protection checks and practical performance diagnostics into one premium OpenCart workspace. See security information on your actual admin home dashboard, use optional protections with preview and rollback, and switch between English and Dutch.

Security on your admin home dashboard

• Four independent native OpenCart dashboard cards show Awaiting review, Last completed check, Live checks verified and OCS controls enabled. Place them between the existing dashboard modules with individual status, width and sort order settings.
• Detailed security panels add review priorities, scan readiness, recent checks and shortcuts. One shared feed refreshes saved facts every 60 seconds while the page is visible. Refreshing never starts a scan or enables controls. Existing hosting protection and OCS-managed controls are shown separately.

Nine practical, optional protection controls

• Essential security headers: nosniff, SAMEORIGIN framing and a strict-origin referrer policy; optional Permissions-Policy and CSP report-only observation. Actual response checks show what is already active. Existing HSTS and enforced CSP are not overwritten.
• Apache SQL query-string filtering plus application GET/POST/JSON pattern filtering. Harmless canaries verify the observed response. The application filter has bounded inspection and exact callback-route exceptions. These are supplemental pattern filters, not a guarantee that SQL queries are injection-proof.
• Static asset caching, CSS/JavaScript/SVG compression, directory-listing prevention and protection of sensitive files and common backups. All nine controls default to off. Preview the managed .htaccess rules, apply deliberately, keep a private backup and verify the live response. Failed checks restore the previous OCS settings; undo checks for later external edits.

Speed checks that explain the result

• Inspect homepage first-byte time and transfer size, static cache/compression behavior, image dimensions and lazy-loading hints, and external scripts without async/defer. Results show observed values and practical next steps.
• These are bounded server-side samples, not a Lighthouse or Core Web Vitals score. The module does not cache customer/checkout/PHP/HTML responses, minify theme code, change PHP handlers or alter Complete SEO.

English and Dutch included

• Switch the module between English and Nederlands using the header language selector, or follow the admin language. The selection is per administrator session and does not change the store or global admin language.
• Dutch covers the six main sections, scan/review controls, native security dashboard cards and their editors, protection explanations, and PDF labels. Technical paths, stored notes, signatures and machine-readable JSON retain the original evidence.

Two scans. One complete audit.

• Core integrity compares files against a trusted matching OpenCart release baseline and identifies changed or missing files. The official OpenCart 3.0.5.1 baseline covers 3,781 core files.
• Suspicious-code inspection checks PHP, JavaScript, markup, embedded PHP and obfuscation patterns. Findings include categories, matched signatures, explanations and a pattern score.
• Run either check separately or choose Complete audit to run both sequentially. Gentle, Balanced and Fast pacing help match the workload to your hosting. Pause, resume or stop between batches. A stopped scan keeps its partial report.

A premium OCS workspace

• Six sections: Overview, Scan centre, Reports, Configuration, Hardening & speed and Automation.
• Official OCS branding, self-hosted Inter fonts, navy panels, purple actions and cyan accents. Responsive layouts and keyboard navigation make daily review easier.
• A permission-aware administration sidebar shortcut, live report statistics, recent checks and environment-readiness indicators.

Evidence you can work with

• Search reports by ID or date, filter by scan type or status, then find files by path, finding category or review state.
• Mark findings individually or in bulk as Reviewed, Expected code or Needs review. Save notes alongside the evidence. Expected code remains included in future scans unless you explicitly exclude its path.
• Existing reports are retained during an update. Earlier reports without detailed evidence are clearly identified.

Reports ready to share

• Download branded PDF, CSV and JSON reports, with all findings or only those still awaiting review.
• PDFs include categories, review states, saved notes and page numbers. CSV output neutralizes formula-leading values; JSON keeps structured evidence.

Tune the scan to your hosting

• Separate batch sizes for each scan: 10-1,000 files per request. Per-file inspection limit: 1-64 MB, with a 16 MB default.
• Separate path exclusions, visible built-in exclusions and safe temporary-cache cleanup. Oversized or unreadable files are flagged for manual inspection.
• Each scan keeps its own inventory and scope settings. Scan and review state changes use per-report locking. Generated files are stored outside the public shop root.

Build a checking routine

• Copy the CLI commands and scheduler examples from Automation into your hosting scheduler. Installing the module does not create scheduled jobs.
• Optional scheduled email reports use your existing OpenCart mail configuration. Set a recipient and a minimum finding threshold from 1 to 10,000. Interactive browser scans never send email.

Compatibility and installation

• OpenCart 3; validated on 3.0.5.1. PHP 8.0+, DOM and mbstring; GD for PDF images; cURL for live checks. PHP 8.5.12 tested. English and Dutch included. Managed server controls require compatible .htaccess support. Integrity checks need a trusted exact-release baseline. Not for OpenCart 2 or 4.
• Validated on OpenCart 3.0.5.1, including browser scans on PHP 8.3 and PHP 8.5 regression checks plus a successful CLI integrity scan on PHP 8.5.12. Integrity checks require a trusted checksum map matching your exact release; other OpenCart 3 releases must be checked with OCS.
• Install the OCMOD ZIP through Extensions > Installer, then install the module under Extensions > Extensions > Modules. For an update, upload the new package and open the existing module. Existing audit reports are retained. Back up first and confirm access permissions and private-storage write access. No core-file replacement or OCMOD XML is required.

What the module does

• File scans are read-only: they never delete or quarantine store files. Optional protection controls change only OCS-managed rules after explicit application. Pattern filtering supplements secure code, updates and backups; heuristic findings need review.
• Heuristic findings require assessment and can include legitimate code. Exclusions and file-size limits apply, symbolic links are not followed, and files may change during a scan. Keep the browser page open for interactive scans.

Latest package: OCS Security 2.4.0 — English + Dutch. Download access follows your existing purchase entitlement.