# Identifying and avoiding harmful Magento extensions

> Spot risky or badly coded Magento extensions before you install them, and follow best practices to keep your store secure.

Source: https://helpcenter.ruachost.com/apps/magento/identifying-and-avoiding-harmful-magento-extensions/

Magento extensions add powerful features to your store, but poorly coded or malicious extensions can cause serious problems. On **ruachost.com**, it’s important to carefully evaluate extensions before installing them.

## Risks of Harmful Extensions

- **Security vulnerabilities** → May expose customer data or allow unauthorized access.
- **Performance issues** → Poorly coded extensions can slow down your store.
- **Compatibility problems** → Conflicts with Magento core or other modules.
- **Hidden malware** → Some extensions may contain malicious code.

## How to Identify Harmful Extensions

### 1. Check the Source

- Only download from trusted sources such as the **Magento Marketplace**.
- Avoid third‑party sites offering “nulled” or pirated extensions.

### 2. Review Ratings and Feedback

- Look for reviews and ratings from other Magento users.
- Be cautious of extensions with few or no reviews.

### 3. Verify Developer Reputation

- Research the developer’s history and other extensions they’ve published.
- Established developers are less likely to distribute harmful code.

### 4. Inspect the Code (if possible)

- If you have technical expertise, review the extension’s code for suspicious functions.
- Watch for obfuscated code or hidden scripts.

### 5. Test in a Staging Environment

- Always install new extensions on a **staging site** first.
- Monitor for errors, performance issues, or unexpected behavior.

## Best Practices to Avoid Harmful Extensions

- Keep Magento and all extensions updated.
- Regularly audit installed extensions and remove unused ones.
- Use security scanning tools to detect vulnerabilities.
- Back up your site before installing or upgrading extensions.

## Important Notes

- Extensions from unverified sources may contain malware or backdoors.
- Nulled/pirated extensions are a major security risk and should never be used.
- If in doubt, consult **ruachost.com  support** before installing.