Start with the right server

Magento needs a VPS or dedicated server, not shared hosting. It runs PHP, a database, OpenSearch for catalogue search, Redis or Valkey, and often Varnish and RabbitMQ. For a busy store, plan for at least 4 CPU cores and 8 GB of RAM, with fast NVMe storage, and more for large catalogues. Check Adobe’s system requirements for the exact versions your Magento release supports; Magento Open Source 2.4.8, for example, supports PHP 8.3 and 8.4.

Step 1: switch to production mode

cd /var/www/magento   # your Magento root
bin/magento deploy:mode:set production

Production mode compiles code and deploys static files ahead of time. Never run a live store in developer or default mode.

Step 2: run indexers on schedule

bin/magento indexer:set-mode schedule
bin/magento indexer:status

“Update on Save” reindexes while customers shop, which slows the store down. “Update by Schedule” lets cron handle it. Make sure Magento’s cron runs every minute:

bin/magento cron:install
crontab -l | grep magento

Step 3: use Redis or Valkey for cache and sessions

# Default cache in Redis database 0
bin/magento setup:config:set --cache-backend=redis \
  --cache-backend-redis-server=127.0.0.1 --cache-backend-redis-db=0

# Sessions in Redis database 2
bin/magento setup:config:set --session-save=redis \
  --session-save-redis-host=127.0.0.1 --session-save-redis-db=2

Keep cache and sessions in separate databases, so flushing the cache does not log customers out.

Step 4: put Varnish in front for full-page cache

1. In the admin, go to Stores > Configuration > Advanced > System > Full Page Cache and choose Varnish Cache.
2. Generate the VCL file that matches your Varnish version and install it.
3. Point Varnish at the web server, and put HTTPS (Nginx or a TLS proxy) in front of Varnish.

bin/magento varnish:vcl:generate --export-version=7 > /etc/varnish/default.vcl
systemctl restart varnish

Our Varnish guide covers the ports and HTTPS setup.

Step 5: tune PHP and OPcache

; php.ini (production)
memory_limit = 2G
opcache.enable = 1
opcache.memory_consumption = 512
opcache.max_accelerated_files = 100000
opcache.validate_timestamps = 0
realpath_cache_size = 10M
realpath_cache_ttl = 7200

With validate_timestamps = 0, PHP does not notice changed files, so restart PHP-FPM after each deployment. Size PHP-FPM’s process limits to the server’s memory.

Step 6: database and search

• Give the database enough memory with innodb_buffer_pool_size; Magento catalogues benefit from keeping indexes in memory.
• Do not try to enable a query cache: MySQL 8 removed it. Redis and Varnish do the caching.
• Give OpenSearch its own memory allowance, and keep it off the public internet.

See our database performance guide for the slow query log and sizing.

Step 7: static files, images and CDN

• Serve images in WebP where your theme or an extension supports it, at the sizes the theme displays.
• Turn on Brotli or Gzip compression on the web server.
• Use a CDN for static and media files, and set the base URLs for static and media content in the admin.
• Be careful with JavaScript bundling and merging on HTTP/2; test whether it actually makes pages faster.

Step 8: security for busy stores

• ✓ Apply Magento security patches when Adobe publishes them.
• ✓ Keep two-factor authentication on for admin users, and use a custom admin URL.
• ✓ Put a WAF in front of the store, and rate-limit the login, checkout and search pages.
• ✓ Use your payment provider’s hosted fields, so card data never touches the server.

Step 9: load-test before big events

Test a copy of the store with realistic traffic before Black Friday or a campaign. Watch PHP-FPM, database and OpenSearch load, and the Varnish hit rate. Fix the slowest pages first, then add resources if needed.