Sample Magento Health Check report

This is what a Health Check report looks like. The store, findings, costs and estimates are all fictional.

The bottom line

Your store is working, but a few items need attention before you plan an upgrade. Fix the two high-priority items first, then remove unused extensions. That lowers risk and makes the upgrade cheaper. The cost review found up to $17,500 a year in possible reductions.

2 high-priority findings

3 medium or low findings

1 item needs your confirmation

What to do first

Confirm who owns the unrecognized administrator account.
Update PHP on staging, test it, and then update production.
Remove the 7 unused extensions before any Magento upgrade.

Confirmed means I saw direct evidence. Needs your confirmation means I found a signal, but only you can tell me what it means.

Findings

Reviewed: Magento and PHP versions, extensions, custom code, patches, administrator accounts, and recent logs on a staging copy.

1. PHP is below the October security release

High Confirmed

Evidence: The staging server reports PHP 8.2.30. The October 2026 fix for the 8.2 line is 8.2.35.
Why it matters: CISA lists the flaws fixed in that release as actively exploited.
Recommendation: Update to the latest supported PHP release for your stack, test on staging, then update production. Confirm the release covers all open PHP advisories on the day you deploy.

2. One administrator account has no known owner

High Needs your confirmation

Evidence: The account "support_tmp" does not match the staff list you provided. It last signed in 12 days before the review.
Why it matters: It may be an old contractor account, or it may be unauthorized. This finding does not show that the store was compromised.
Recommendation: Ask your team and past contractors who created it. If no one claims it, disable it, keep the logs, and start a deeper review.

3. Seven extensions appear unused

Medium Confirmed

Evidence: 7 of 38 installed extensions have no active configuration or storefront use.
Why it matters: Each one adds license cost, patch work, and upgrade testing.
Recommendation: Remove them on staging one at a time and confirm nothing depends on them.

4. A custom checkout module blocks the upgrade

Medium Confirmed

Evidence: Example_Checkout replaces a core Magento class instead of extending it.
Why it matters: Checkout is more likely to break during an upgrade, and fixes cost more.
Recommendation: Rebuild the override using a supported extension point before the upgrade.

5. Deployment isn’t documented

Low Confirmed

Evidence: No written deployment or rollback steps were included in the materials provided.
Why it matters: A release problem depends on one person remembering what to do.
Recommendation: Write a short runbook and test the rollback once on staging.

Cost review

Based on the invoices and subscription list you provided. These are estimates, not guaranteed savings.

Yearly costs and possible reductions (fictional)
Area	Now, per year	Possible cut	What would change it
Hosting	$14,400	$0	Keep for now. Review after the upgrade.
Extension licenses	$6,800	$1,900	Remove the unused extensions.
SaaS tools	$9,600	$3,600	Drop two tools that overlap with Magento features.
Outside development	$36,000	$12,000	Document routine tasks so your team can handle more.
Total	$66,800	$17,500

Start with extensions and SaaS tools, since those can change without new development. The outside development reduction depends on finishing the documentation and on how much routine work your team wants to take on.

AI shopping readiness

A snapshot of how easily AI shopping tools can read your store, and whether you could measure the traffic they send.

AI shopping readiness (fictional)
Area	Status	What I saw	Next step
Product data	Needs work	Key attributes, such as size and material, are often blank.	Fill them in for your top sellers first.
Structured data	Needs work	Product pages include price, but not stock status.	Add the missing fields to the product template.
Crawler rules	Your decision	Firewall rules challenge some known AI crawlers.	Decide which crawlers to allow, then update the rules.
AI traffic tracking	Not set up	Analytics doesn't separate AI referrals.	Create a separate AI referral segment for a baseline.
API stability	Needs work	Core APIs work, but custom endpoints aren't documented.	Document them before any integration work.

These steps are optional and aren't included in the fix plan total. They improve readiness, but they can't guarantee AI-driven sales.

Fix plan

In priority order. Your team can handle these, or I can scope them as a fixed-price project.

Fix plan with estimates (fictional)
Order	Action	Finding	Estimate
1	Identify the administrator account	2	$150
2	Update PHP and test on staging	1	$450
3	Remove unused extensions	3	$750
4	Rebuild the checkout override	4	$1,800
5	Write and test the deployment runbook	5	$600
	Total estimate		$3,750

This report covers what I reviewed on the date shown. It isn’t a penetration test or a full incident investigation, and it can’t guarantee that a store is clean. I use AI tools to help analyze code and prepare documentation. I reviewed every finding in this report and stand behind it.

Want this for your store?

$900 fixed price, $1,500 for multi-store or ERP-connected stores. If we work together within 60 days, the full fee comes off the project.

Book a Health Check Start with a free call.