1,669 Online Stores Still Run Magento 1, Six Years After Support Ended

A specialty food shop has taken orders on the same Magento 1 store since 2014. The checkout still works and customers still buy. But the software behind it has had no official security patch since mid-2020, and the store collects names, addresses and card details every day.

Magento is an ecommerce platform, now owned by Adobe. Version 1 reached end of life on June 30, 2020, meaning Adobe stopped releasing fixes for security holes found in it. Online stores are attractive targets because they handle payments and customer data, so an unpatched store is a risk to its customers as well as to the business.

1,669 stores still run Magento 1, 6% of Magento stores with a detectable version. Most of them sit among less-visited websites, where a store may run for years with no developer checking on it, but 141 rank among the 1 million most visited.

We counted homepages running Magento in the September 2026 HTTP Archive crawl, a public project that loads millions of homepages each month and records the technologies they use: 44,869 in all. For the 27,994 where the major version was visible, we recorded whether it was Magento 1 or Magento 2, and we split the results by how popular each website is.

End of life means the software's maker no longer releases security fixes or updates. Magento 2 is the current, supported version; moving from Magento 1 to Magento 2 is a full rebuild rather than an update. Popularity groups run from the 10,000 most visited websites to those outside the top 10 million.

That is 1,669 online stores running checkout software that has not had an official security patch in more than six years. Any weakness discovered since June 2020 stays open on those stores unless the owner has paid for fixes from an outside provider or patched it themselves.

The risk is concrete. An online store's checkout is where card details and customer addresses pass through, and outdated store software is a common way for attackers to insert code that copies them. The store can keep taking orders normally the whole time, so the owner may not know anything is wrong.

Among popular stores Magento 1 is almost gone: it runs on 2% to 3% of versioned Magento stores ranked between 10,000 and 1 million, and 2.5% across the 1 million most visited websites. Among stores outside the top 10 million it is 14.8%, nearly six times that rate and close to one in seven. That group also holds 645 of the 1,669 Magento 1 stores, even though it has fewer Magento stores overall than the 1 million to 10 million group.

Popular stores are not entirely clear either. One of the 17 versioned Magento stores among the 10,000 most visited websites and 141 among the 1 million most visited still run Magento 1. These stores have enough traffic to make a breach costly, on software that has gone six years without an official patch.

94% of Magento stores with a detectable version run Magento 2, 26,325 stores. The platform as a whole has mostly completed the move, which leaves the Magento 1 holdouts increasingly on their own: fewer developers, hosts and extension makers still support the old version.

For the owners of those 1,669 stores, the choice is the same one every Magento 1 merchant has faced since 2020: an expensive rebuild on Magento 2, or a move to a hosted platform where the provider handles security. Either way the store has to be rebuilt, and its product pages, categories and search rankings have to come across with it.

If your store still runs Magento 1, assume it is exposed. At a minimum, run a malware scan, check your checkout pages for code you did not add, and confirm your host still patches the server and PHP. Then set a firm date to move. Rebuilding on Magento 2, moving to Shopify or moving to another hosted platform are all better than staying.

When you move, carry over every product address with a permanent (301) redirect and keep product copy intact, so the new store keeps its search rankings. Our magento migration services plan that move from the product catalog to the last redirect, whichever platform you choose.

Embed this research

Cite this study