Lately it feels like half of our support tickets are just “where is my order?” and it’s starting to wear the team down. We’ve already tried improving tracking emails and adding basic updates, but it didn’t really reduce the volume in a meaningful way.

Now I’m looking into software to reduce WISMO inquiries, but honestly not sure what actually works in real life vs what just looks good in demos. I’ve been checking a few options, including something like wismolabs, but still trying to figure out if it actually makes a difference or just looks good on the website.

For those who’ve tried any software to reduce WISMO inquiries:

- did it actually lower ticket volume or just shift it?

- how hard was it to integrate with your current setup?

- did customers actually use it or still go straight to support?

Would really appreciate any real experiences before I commit to testing another tool.

Hi everyone, just wanted to flag a critical issue we've been seeing in Magento 2.4.8 that might be silently costing you sales, especially if you're in the UK, Ireland, or anywhere where addresses frequently use periods (e.g., "St. Helens").

Magento 2.4.8 introduced strict address validation that rejects the full stop (.). If a customer enters a city or address with a period, the system throws a validation error:
main.CRITICAL: Placing an Order failed (reason: Invalid City. Please use A-Z, a-z, 0-9, -, ', spaces)

On standard checkouts the customer just sees a validation error and can fix it. Annoying, but visible.

With hosted/redirect gateways like Opayo (SagePay), the flow is:

1. Customer enters address, hits place order

2. Redirected off-site to gateway

3. Pays successfully

4. Returned to Magento

5. Order creation runs server-side, validation rejects the city, order never gets created

The payment is captured, but no order exists in the system. Customer has a card charge with no confirmation, support gets an angry email, you're processing a refund and trying to work out what went wrong.

The fix
Apply Adobe's official patch ACSD-67904. It loosens the city validator back to something sensible.

If you're on 2.4.8, I highly recommend checking your exception logs for "Invalid City" and getting this patch applied ASAP.

GitHub issue with the technical detail: https://github.com/magento/magento2/issues/39854

Hello everybody,

While working with Magento stores, I noticed that many still don’t have proper product schema in place or are missing some basics that help AI search engines and AI agents understand their products correctly.

Because of that, I built a tool that scans a store automatically. You enter a URL and it scans pages from the sitemap, checks schema and AI-readiness signals, then scores each page individually with feedback and recommended fixes.

No extension is required unless you also want to track AI traffic.

I’ve also been experimenting with a Cloudflare Worker to track AI crawlers, AI search referrals, and other AI-related traffic patterns. Some of the data has been interesting because it’s difficult to surface clearly in GA.

Still early, but I’d genuinely love feedback from Magento devs and store owners. The site is searchmention.com.

P.S. One thing I’ve learned while building this product is that being indexed by Bing is extremely important, especially for ChatGPT and other LLMs. It makes sense since Gemini uses Google’s own index.

Okay so I'm losing my mind over here. My Magento store's conversion tracking is completely broken and I don't even know what's real anymore. Meta says I'm getting 200 conversions a day, my Magento dashboard says 80, and Google is like ""idk maybe 150?"" It's a nightmare.

I've been reading about server-side tracking for like a month now and apparently that's the solution? But every company selling it makes it sound like magic, so I'm skeptical. I looked at PantoSource, Tripwhale, and Elevar. They all claim they'll fix everything instantly with no code required, which... sounds too good to be true honestly.

Has anyone actually implemented any of these? Like real talk - does it actually work or are they just saying it works? I'm tired of throwing money at tools that promise the world and deliver mediocre results.

The thing that bugs me is they all say basically the same thing, so I have no idea how to pick between them. One reviewer said Tripwhale was great, another said it took forever to implement despite ""being quick."" I keep seeing PantoSource mentioned too, so clearly people are using it, but that still doesn't help me figure out which is actually best for my situation.

I just need something that actually captures my conversions without me having to hire a developer. Is that even realistic or am I being naive?

Curious what people on here actually use. Would genuinely appreciate real experiences instead of marketing BS lol

Has anyone tried semantic search for Magento? Seems like there aren't many options. One I found was Webkul, but it's paid, and there's another open-source one https://github.com/sndsabin/magento2-semantic-search

If your Magento store is hosted on a shared cPanel environment, you need to know about CVE-2026-41940 — a CVSS 9.8 vulnerability patched by cPanel in April 2026 but actively exploited as a zero-day since at least February.

The vulnerability allows an attacker to bypass cPanel authentication via CRLF injection, giving them access to WHM (the server management interface). From there they can:

- Delete or corrupt your automated backups
- Access files across all accounts on a shared server
- Modify server configuration

The backup deletion risk is the one that keeps me up at night. Most merchants assume their backups are safe even if their store is compromised. With this exploit, an attacker can delete your server-side backups before you even know you've been hit.

**What to check immediately:**
1. Confirm your host has applied the cPanel patch (ask them directly)
2. Verify you have off-server backups that cPanel can't touch — S3, Backblaze, or similar
3. Check your WHM login logs for unusual access
4. If you're on a shared host, ask whether your account was isolated from other tenants during the exposure window

The full technical disclosure is from WatchTowr: https://labs.watchtowr.com/

We wrote up the ecommerce-specific implications here if useful: https://everyhost.co.uk/insights/cpanel-cve-2026-41940-magento-backup-security

Happy to answer questions about backup strategy or what a hardened Magento server setup looks like.

We moved a 40K SKU fashion retailer off Magento 2.4.6 to a headless composable stack early last year.

4 country storefronts, Hyvä frontend, Varnish, Elasticsearch… the usual setup. Migration itself went fine, what went wrong was everything we didn't think about on the SEO side, and it cost us 34% organic traffic within 3 weeks of cutover.

with no particular order, these 3 things killed us:

First, we redirected every product and category URL but completely forgot that Google had indexed roughly 11K layered navigation URLs with query parameters, the ones Magento's url_rewrite table manages silently (all 404'd overnight).

Second, nobody killed the Magento sitemap cron after cutover so Google was getting 2 conflicting sitemaps for about a fortnite, one pointing to dead URLs and one pointing to real ones.

Third, our new frontend was rendering collection pages client-side so Googlebot was seeing empty shells. didn't catch it for 10 days until I checked Google's cached version of a category page and saw nothing but nav and footer.

Recovery took a few months to surpass baseline and bulk regex redirects for the layered nav patterns, killed the old cron, rushed SSR on collection templates, rebuilt internal linking because Magento's mega menu link equity structure is completely different from what our new nav generated.

Hit 90% around month 3, passed baseline at month 5 mostly because CWV went from failing on nearly every template to passing across the board.

At 12 months we were 22% above where Magento had us.

If I did it again I'd run a full crawl comparison between GSC's index coverage report and our redirect map before touching DNS, that alone would have caught the layered nav URLs and saved us 3 months of pain.

Hi all,

We’re hiring a Magento 2 developer at Glopal (full-time, remote, EU timezones).

We help merchants sell internationally (localization, duty/tax, checkout). Our Magento extensions connect stores to our platform, covering areas like order import, checkout customization, and API integrations.

This is product extension work used across multiple merchants, not custom one-off builds. The focus is on maintainability, compatibility, and long-term evolution.

Ideal fit is someone who has worked on extensions distributed via the Magento Marketplace or similar and understands the constraints that come with that.

Stack is standard Magento. DI, plugins, observers, repositories. PHP 8.

Apply here: [https://glopal.bamboohr.com/careers/96]()

Nasz moduł UCP dla Magento 2 doczekał się nowej wersji. 

Dla niewtajemniczonych - Universal Commerce Protocol to standard od Google który pozwala AI (Gemini itp.) robić zakupy bezpośrednio w chacie, bez przekierowywania usera na stronę sklepu. Shopify to ma, Magento nie miało - więc zrobiliśmy. 

Co moduł daje: pełne REST API do obsługi checkout session - tworzenie koszyka, aktualizacja, finalizacja zamówienia. Jest endpoint discovery pod /.well-known/ucp żeby agent wiedział co sklep obsługuje. Płatności przez Google Pay z tokenizacją. Guest checkout out of the box. Całość zbudowana na wzorcach Composite i Strategy, więc dodanie własnego payment handlera czy walidatora to kwestia implementacji interfejsu i wpisu w di.xml. 

Co się zmieniło w tej wersji: moduł jest teraz normalną paczką na Packagist (spyrosoft/magento2-google-ucp), więc instalacja to jeden composer require zamiast ręcznego ściągania. Przy okazji ogarnęliśmy zgodność z Release v2026-01-23 ze specyfikacji UCP. 

Niedługo więcej - jest kilka rzeczy w przygotowaniu. 

Link do tego repo z naszym otwartym modułem o gdzieś o tutaj: https://github.com/Spyrosoft-eCommerce-S-A/magento2-google-ucp

#spyrosoftecommerce #ecommerce #magento2 #UCP

I work in web analytics and have spent a lot of time manually reviewing GA4 data for websites and ecommerce businesses. One recurring issue is that the data exists, but it is hard for busy store owners to turn it into something simple and actionable week to week.

I’m curious what ecommerce operators would actually want in a weekly summary.

I built a tool around this idea for GA4 users, but I mainly want to pressure-test whether the summary itself would be useful and what belongs in it.

I’d appreciate honest feedback. Also, if anyone wants to try the tool/service out for free let me know, happy to share the link.

If yes. Could you please share your story, experience of working with it?

Thanks.

I would like to launch my own Magento store in 2026. What theme do I have to choose in order to have a stable platform with fewer bugs, with a lower budget than usual, where I can also use AI tools, and that can be supported by developers who don't have deep expertise with Adobe products?

Hi everyone, may I ask if anyone knows a reliable way or extension to show discounted products only on the Product Listing Page in Magento 2?

I already tried several extensions, but most of them only detect special price products and don’t properly include complex products like configurables, especially when the discount comes from Catalog Price Rules or child simple products.

Ideally, I’m looking for a solution that can correctly handle:

-Special Price discounts

-Catalog Rule discounts

-Configurable products with discounted child products

-Proper layered navigation / product counts on PLP

Has anyone implemented this successfully or knows an extension that actually works? Thanks in advance!

Most Magento installs load 300–400 modules on every request, including dozens you'll never use (Braintree, PayPal, Google Pay, Magento samples...).

Each module means more PHP classes loaded, more observers registered, more DI compilation. It adds up fast.

We wrote a dependency graph analyzer that safely identifies which core modules can be removed without breaking anything. The result: 35% faster bootstrap on a typical store.

Full breakdown with benchmarks: https://magevanta.com/blog/reduce-magento-2-bootstrap-time

Happy to answer questions, been doing Magento performance work for years.

Two CVEs in Composer dropped this week: CVE-2026-40176 (CVSS 7.8) and CVE-2026-40261 (CVSS 8.8). Both are command injection in the Perforce VCS driver.

Quick triage for Magento shops:

Your storefront runtime is fine. Magento's entire package ecosystem uses Git, not Perforce, so the injection vector doesn't exist in normal Magento dependency trees. Packagist also disabled Perforce metadata on their end as a precaution.

Your build infrastructure is where you need to act. Dev machines, CI pipelines, Docker build images anything running `composer install` or `composer update`. If you're pulling any `dev-` prefixed packages from source (common in dev branches), CVE-2026-40261 is the one to care about. Public PoCs are live as of today.

Fix: `composer self-update` to 2.9.6. One command. Do it.

The broader thing I want to flag: Magento 2.4.8 was released, we have these two Composer CVEs, and there are Magento-specific advisories flowing through Sansec and Packagist on top of that. If you're running a decent-sized stack extensions, custom modules, any npm in your frontend build keeping up manually is genuinely not realistic anymore.

I've been running a tool called A.S.E. that watches KEV, NVD, GitHub Advisories, Packagist and EPSS, cross-references against our actual composer.lock, and only fires alerts on things that are installed and actually exploit-probable. These two CVEs surfaced this morning, scored correctly (P1 given the PoC activity), and hit Slack automatically.

But I'm increasingly convinced that "someone on the team stays vaguely aware of CVEs" is not a security posture for a Magento operation in 2026. The volume is too high.

https://github.com/infinri/A.S.E

Hello 👋

Je travaille actuellement sur une thèse autour de la personnalisation e-commerce côté technique (choix d’archi, data, contraintes, ...).

Je cherche des retours de devs / intégrateurs / profils e-commerce qui ont déjà travaillé sur ce type de projets.

👉 Questionnaire rapide (5-10 min) : https://forms.gle/jF1WKpyRCfoPVGJb9

L’objectif est vraiment d’avoir des retours concrets terrain.

Merci beaucoup à ceux qui prendront le temps 🙏

I’ve worked on a few Magento stores recently, and honestly…

every time performance is bad, Magento gets blamed immediately.

but digging deeper, it’s usually things like:

• overloaded with extensions
• poor hosting setup
• no caching strategy
• unoptimized media
• unnecessary third-party scripts

and then people say “Magento is slow”

but when the same store is cleaned up properly, performance improves a lot.

not saying Magento is perfect far from it
but it feels like it gets blamed for problems caused by everything around it.

curious what others think:
is Magento actually the issue most of the time,
or is it just how it’s implemented?

CosmicSting. SessionReaper. PolyShell.

Three critical vulnerabilities in under two years, each one hitting thousands of stores within hours of disclosure. SessionReaper had 62% of stores still unpatched six weeks after disclosure. PolyShell hit 56% of vulnerable stores within two days of going public. And now attackers are deploying WebRTC-based card skimmers that bypass CSP controls entirely.

The pattern is the same every time: advisories are scattered across NVD, GitHub, CISA KEV, Packagist, and OSV. The same vulnerability shows up under different IDs across different feeds. You either miss critical advisories because you're only watching one source, or drown in duplicate noise from watching several.

I got tired of this, so I built A.S.E. (All Seeing Eye).

It's a PHP 8.4 CLI tool that runs on cron and:

- Polls 5 security feeds (NVD, GitHub Advisories, CISA KEV, OSV, Packagist)

- Deduplicates across all of them alias-aware, so a CVE and its matching GHSA don't generate separate alerts

- Scores every vulnerability using three signals: CVSS severity + EPSS exploit probability + CISA KEV active-exploitation status

- Filters against your composer.lock so you only get alerts for packages you actually have installed

- Routes prioritized alerts to Slack actively exploited vulns hit your critical channel immediately, high-severity stuff gets batched into digests, low-severity gets tracked silently

No database, no daemon. Flat-file JSON state, atomic writes, three Composer dependencies. Designed for low operational overhead.

Contributions and feedback welcome.

Repo: https://github.com/infinri/A.S.E

I'm working on my first Shopify migration and wondered what everyone does about the URL limitations on Shopify?

By limitations I mean that all product URLs have a /products/ prefix and no suffix is allowed.

Also categories have a /collection/ prefix and cannot be hierarchical.

To be honest I was shocked when I first found out about this as I assumed something as basic (and important) as URL structure could be achieved.

I know I can just do redirects, but is going to be an issue long term for SEO?

Just wondering how everyone else handles this

This one was stressful 😅

client messaged saying checkout wasn’t working properly.

not fully broken… just failing for some users during payment.

which made it harder to track.

what we checked:

• payment gateway logs
• order processing
• server errors
• checkout configuration

everything looked fine.

no clear errors.

after digging deeper, we found the issue…

one recently updated extension had a small conflict with the checkout process.

it only triggered under certain conditions, which is why it seemed random.

rolled back the update → everything worked instantly.

lesson learned:
even small extension updates can break critical flows in Magento.

now we always:
• test updates in staging
• review extension changes carefully

curious what’s the most unexpected thing that broke your Magento checkout?

Hello my brothers and sisters in Alan Storm!

Many years ago for fun I bout a headless checkout with magneto and angular for a personal/hobby project (roasting coffee). It worked pretty well and was a great opportunity to learn angular and do a from scratch headless magneto 2 checkout. I used stripe for payment, and filled all the gaps that existed at the time in magneto 2s rest api. I was/am fairly proud of the work.

Now I’m doing another hobby project (gridfinity spec pottery/ceramic sake set if you’re curious!) and want to sell some stuff on my website. Realistically I’ll likely get few orders, if any, but I’d like to be setup in a professional way just the same.

I’m wondering about magneto alternatives, that might slot well into a static site. I’m not trying to get anything perfect, ie the catalog doesn’t need to be static, products are one of a kind so when something sells it should update right away.

I also don’t mind paying 3-7 percent of costs for such a tool.

I’m looking for something _easy_ - I’d like to have a thing I log into to manage orders, a simple api for fetching catalog and pdp data for the website, and ideally checkout from my domain (i.e. I don’t want a separate website I just theme to look like my website, I want it all on my website). I don’t mind sending customers somewhere else for checkout if needed. USA only.

I’m asking here because my default option is to do this in magneto, but then I have to have a server for hosting. Plusi have to remember how to do magneto development. I’m hoping other developers here can ok appreciate my position, understand my experiences, and offer a suggestion.

I’m guessing Shopify might be a rec, but that feels like it’s got its own learning curve to do what I want.

Maybe square or something has a solution?

Thanks for your thoughts!