Shopware: 2,667 title matches, 1,094 on 443 and 80 certificate hits

Commerce platforms carry a data set that is unusually complete: customer identity, address, order history, payment method references, and sometimes stored card tokens. Shopware is a German commerce platform with a significant European deployment base, and its online profile shows a population that is large enough to matter and small enough that individual instances are still identifiable.

The counts

ZoomEye queries on 23 October 2026, sub_type=all, page size one:

• title="Shopware": 2,667
• title="Shopware" && port="443": 1,094
• title="Shopware" && ssl="shopware": 80
• app="Shopware": 1 The application fingerprint returning one, against 2,667 title matches, is the same pattern already documented for other products in this series. A commerce platform behind a reverse proxy presents a web page and a certificate; it does not necessarily emit a protocol-level signature that an index recognises as the product.

Three deployment shapes inside one number

The title population mixes at least three kinds of asset, and their risk profiles differ.
Production storefronts make up the part that matters. A storefront is designed to be public, and its security depends on the administrative back end being separated from it. Shopware's administration is typically served from a distinct path or host, with its own authentication.
Staging and demo installations form a second group. These frequently have weaker credentials, older releases, and data imported from production for testing. An accidentally published staging storefront is a common finding, and it is often the easiest path into an estate.
Documentation, extension marketplaces and agency portfolios form the third. They match the title query because they name the product, and they carry no customer data.
A title match alone cannot separate them.

Why the administrative side is the interesting surface

An e-commerce admin controls products, prices, orders and, critically, the configuration that connects the platform to payment providers and fulfilment systems. That configuration holds API keys with real financial consequence.
Two risks follow.
The first is credential exposure through the administration interface. A weak password on a back end that is reachable from the internet is a direct path, and it is testable by an attacker without touching the storefront.
The second is plugin and extension supply chain. Commerce platforms are extended heavily, and each extension is code with access to the same data. A vulnerable extension is a vulnerable storefront, and the platform version alone does not tell you about it.

Reading the numbers with their limits

The 1,094 assets on 443 suggest that standard HTTPS fronting is the norm, which is expected. The 80 certificate matches describe a naming choice made by a small minority, and each of them confirms the platform without an HTTP request.
The single application fingerprint match shows why a fingerprint query cannot serve as an inventory. One match against 2,667 title matches would be an absurd conclusion if read as coverage; read as a statement about signature availability, it is exactly right.

Internal review priorities

• Separate storefront and administration at the network level. Administration should be reachable from an office address, a VPN or a bastion, never from arbitrary addresses.
• Enumerate extensions with their versions, and map them to advisories. The platform release notes do not cover extension security.
• Check staging and pre-production environments for public reachability and for production data. This is where the cheapest finding usually lives.
• Review payment provider credentials and their permissions. A credential that can capture payments should not also be able to change payouts.
• Confirm that order and customer exports are not accessible without authorisation. The commerce back end can produce a complete customer list in a few clicks, and that output is what a breach of this platform looks like.

Detection notes

Administrative logins are the event to watch, particularly successful logins from addresses that have never been seen for that account. Commerce platforms tend to have few administrators and stable working hours, which makes the baseline unusually clear.
Plugin installation events are the second signal. A new extension is code deployment, and it should follow the same approval path as a code release. On many installations it does not, and the audit log is the only record.

The measurement lesson

A commerce platform is public by design, so external counts describe distribution rather than exposure. The useful question is not how many storefronts exist but whether the administration path of your storefront is reachable from a network you do not control, and whether the release behind it is one you chose.

References

• Shopware developer documentation: https://developer.shopware.com/
• Shopware project site: https://www.shopware.com/
• ZoomEye queries executed 23 October 2026 with sub_type=all: title="Shopware" 2,667; title="Shopware" && port="443" 1,094; title="Shopware" && ssl="shopware" 80; app="Shopware" 1