[Jonas Elfering (keulinho)]

Summary

• Add a Security Best Practices page under Hosting > Installation & Updates covering supported Shopware and infrastructure versions, planning upgrades before end of life, PHP 8.4 PDO parser hardening, and deployment-based extension management.
• Clarify SaaS and PaaS Native responsibilities: Shopware manages hosted infrastructure and automatic SaaS updates; PaaS Native merchants manage application updates, extensions, dependencies, custom code, and PHP and database version selection. Configuration and access management remain merchant responsibilities in both models.
• Add incident-response guidance covering immediate containment, investigation of attacker access and persistence, recovery from trusted backups after suspected remote code execution, credential rotation, legal review, and contacting Shopware during and after an attack.
• Move the Security Plugin guide beneath the new page and document keeping a compatible plugin installed, activated, and up to date even on fully updated shops, with urgent deployment of relevant security releases.
• Update related guidance and cross-references, and redirect the previous Security Plugin URL.

Related links

• Shopware release calendar
• Shopware terms and conditions, section 29.2
• Shopware PaaS Native responsibilities
• PHP driver-specific PDO SQL parsers
• Research on SQL injection through PDO parsing mismatches
• CISA incident-response and recovery guidance
• European Data Protection Board guidance on data breaches

Checklist

• I reviewed affected links, code samples, and cross-references, including PageRef references where relevant.
• I added or updated redirects in .gitbook.yaml if pages were moved, renamed, or deleted.
• I updated .wordlist.txt (and sorted it) if spellcheck flags new legitimate terms.
• I listed every dependent pull request that is not merged yet under Dependent PRs below.
• Dependent changes that must be released, not only merged, before this documentation goes live have been published.
• This pull request is ready for review.

Dependent PRs

Notes

Markdown linting with the repository's pinned rumdl 0.2.67 and configured spelling checks passed for all six affected Markdown pages.
Internal link targets, navigation metadata, the old-URL redirect mapping, and git diff --check also passed.
Added the legitimate terms Cyberattack and backdoors to the sorted spellcheck wordlist.
No dependent PRs are required.
The rendered developer-portal navigation has not been previewed.

[shopware-dev-docs-connector]

Developer Docs healthcheck

Status: Completed with success.
Repository: shopware/docs
Commit: b3657dc
Preview: https://developer-documentation-5u31ofvza-shopware-frontends.vercel.app
Workflow run: #5754

[Copilot]

🟢 Approval recommended

The documentation changes are consistent, the relocated guide has updated references and a redirect, and no blocking issues remain.

No open issues 🎉

What changed in this PR

Adds security best practices for self-hosted Shopware installations and aligns existing hosting documentation with the updated Security Plugin policy.

Changes:

• Documents supported versions, PHP hardening, and deployment-based extension management.
• Recommends keeping a compatible Security Plugin installed, activated, and updated.
• Relocates the plugin guide and updates links and redirects.

File	Description
resources/​references/​security.md	Updates plugin guidance and link
guides/​hosting/​installation-updates/​security-best-practices/​security-plugin.md	Relocates guide and clarifies plugin policy
guides/​hosting/​installation-updates/​security-best-practices/​index.md	Adds hosting security best practices
guides/​hosting/​installation-updates/​performing-updates.md	Aligns update recommendations
guides/​hosting/​installation-updates/​cluster-setup.md	Updates cluster plugin guidance and reference
.gitbook.yaml	Redirects the previous plugin URL

_{Review effort: Balanced}

[github-actions]

📢 Developer Announcement Recommendation

Recommendation: ❌ No Announcement Recommended

No developer announcement signals were detected.

This PR does not appear to introduce developer-facing changes that require a community announcement.