Hardening site security checklist

To harden the security of your HCL Commerce site, you can enable and configure various security features. In addition, site customizations must always be made to comply with best practices as outlined in this document.

This is not an all-inclusive list of security measures for your site. This list is designed primarily to facilitate navigation of the HCL Commerce security section of the HCL Commerce documentation, and to highlight security considerations for HCL Commerce customizations and the secure configuration of other companion products. Further security hardening might be required to ensure the security of your site. For more information about security standards, see Security standards.


This list is provided for the purposes of development. Ensure that your site customizations conform to the best practices laid out in the following topics:


This list is provided for the purposes of site administration. Ensure that your site is configured to be hardened against common attack vectors with the following topics:
  • Protect your merchant and payment keys by using the Key Locator Framework (KLF).
  • Ensure that login timeouts are enabled for user sessions. To enable session timeouts, see Session timeout. This is even more critical if you have enabled multiple logon support.
  • Enable whitelist data validation for store URLs and REST calls to disallow non-conforming parameters. For information on whitelist filtering, see Enabling WhiteList data validation.
  • Ensure that cross-site scripting protection remains enabled. To ensure that this feature is enabled, see Enabling cross-site scripting protection.
  • Upgrade your database encryption to a stronger standard to reduce the chance of a successful brute force attack. For instructions on upgrading your database encryption, see Updating encrypted data in the database using MigrateEncyrptedInfo.
  • Implement business object thresholds to reduce the threat of denial of service attacks. For instructions on implementing business object thresholds, see Business Object thresholds.
  • Use the updateua utility to assign and restrict database permissions for essential control only. For more information about the updateua utility, see Update user authorization utility.
  • Ensure that password complexity rules and account lockout policies are in place. See, Setting up a password policy, and Setting up an account lockout policy.
  • Ensure that privileged users, such as customer service representatives and site administrators, are prevented from logging in to your site from external networks. For more information about controlling privileged users' access, see Prevent privileged users from logging in externally.
  • Ensure that the STORECONF table is only populated with non-sensitive store configuration data. This is due to the fact that it is intended to be accessible by unauthenticated store client code.


This list is provided for the purposes of site deployment. Ensure that your site is configured to be hardened against common attack vectors with the following topics:

Maintenance and operations

This list is provided for the purposes of site administration on an ongoing basis. Timely review and application of security and maintenance patches ensures that you are aware of ongoing security issues, and that your site is up-to-date and hardened against attacks that would otherwise succeed:
  • Subscribe to HCL Commerce security bulletins, and review all published security bulletins. For more information, see Security bulletins.
  • Ensure that you keep your product up to date with the latest maintenance fix packages. Pay particular attention to security-related bulletins.
  • Test your site thoroughly, and on an ongoing basis. Pay particular attention to any site customizations. Remember: Security is an ongoing process, not a product, or task that is ever complete.
  • Implement an encryption key rotation schedule, and ensure that the process is secure. This process reduces the chance of a successful brute force attack, and mitigates the potential outcomes of a compromised key. For information on how to change your encryption key, see MigrateEncryptedInfo utility.
  • Use the -passwordFile parameter for all command-line utilities that have such a parameter to limit the exposure of plain text passwords.

Other software

HCL Commerce is just one piece of a larger group of software that is required to run your site. Ensure that you correctly configure and harden all software that is part of your installation. Ensure that you are prompt with all maintenance and security releases. Any customizations made to these products must also adhere to the respective documented best practices.

Review the following documentation for each piece of software that you use for more security recommendations:

Note: This list is not exhaustive, and is limited to IBM products.