---
title: "WEB-CMS-015 Magento Not in Production Mode"
canonical: https://openvapt.com/checks/WEB-CMS-015.html
html: https://openvapt.com/checks/WEB-CMS-015.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-CMS-015 Magento Not in Production Mode

Checks app/etc/env.php for a MAGE_MODE other than production.

- Domain: Web Apps
- Severity: Medium
- Control category: Information Exposure
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 16.7
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-489, CWE-209
- OWASP Top 10 2021: A05:2021
- OWASP ASVS 4.0.3: 14.3.2
- OWASP WSTG v4.2: WSTG-CONF-02, WSTG-ERRH-01
- NIST SP 800-53 Rev. 5: CM-6, SI-11

## Why It Matters

Developer and default modes show exceptions with stack traces and file paths to shoppers, disable static file signing and compile code on the fly. Adobe documents production as the only mode for a live store.

## How It Detects

Reads app/etc/env.php in each local web root and its parent folder (Magento serves from pub/) and fails when 'MAGE_MODE' is developer or default.

## How to Fix

bin/magento deploy:mode:set production  (which also deploys static content and compiles DI), then clear caches. Keep developer mode for staging only.

## How to Verify

```
bin/magento deploy:mode:show  prints production.
```

## Learn the Theory

- [P6 Information Exposure and Misconfiguration](https://openvapt.com/academy/p6.md)
- [P14 CMS Hardening in Depth: WordPress, Joomla and Drupal](https://openvapt.com/academy/p14.md)
- [A6 Application Framework and CMS Configuration](https://openvapt.com/academy/a6.md)

## References

- [Adobe Commerce documentation, Set the Magento mode](https://experienceleague.adobe.com/en/docs/commerce-operations/configuration-guide/cli/set-mode)
- [Adobe Commerce documentation, Security best practices](https://experienceleague.adobe.com/en/docs/commerce-admin/systems/security/security-best-practices)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_depth.go

Run it: `openvapt scan --only WEB-CMS-015`. Read it offline: `openvapt explain WEB-CMS-015`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-CMS-015.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.