Let’s talk about how we can build your commerce project — tailored to your business, powered by Rigby
Medusa Security is a new set of managed security features that Medusa Cloud applies to the traffic reaching your store. Medusa announced it in November 2026, and it's now included in every Cloud plan.
Who protects your store from attacks today? If you host Medusa yourself, your own team does. Your developers set up the firewall and deal with DDoS attacks and malicious bots on their own.
On Medusa Cloud, Medusa now does this work for you. It stops malicious requests at the edge, before they reach your store.
Do you already have a store on Medusa Cloud? Then I'd read this before the end of November.
In this article, you'll find out:
- What is Medusa Security?
- Which protections does Medusa Security include?
- What does Medusa Security change for your store on Medusa Cloud?
- How should your team prepare before Medusa turns all protections on?
- What does Medusa Security mean for a self-hosted Medusa store?
Key insights
- Medusa Security is a new suite of security features on Medusa Cloud. It includes Medusa Instant Protection, the Basic Protection Ruleset, DDoS protection, bot detection, and a database IP allowlist.
- Medusa calls Medusa Instant Protection the most important part of the product. Medusa's team finds vulnerabilities in its own platform and blocks them on Cloud before you upgrade.
- New projects have Medusa Security enabled by default. Medusa will enable every protection on existing projects in the second half of November 2026.
- Medusa Security doesn't cover a self-hosted store. Your team stays responsible for the firewall, attack mitigation, and tracking new vulnerabilities.
What is Medusa Security?
Medusa Security is a set of security features that Medusa Cloud applies to the traffic reaching your Medusa projects. Medusa describes it in the Medusa Security documentation as a service that filters malicious requests and blocks automated abuse before they reach your application.
Medusa Cloud is the hosting platform from the company that builds the Medusa commerce software. Medusa Security is available on all Cloud plans, and you manage it from the Security settings of your project.
Why did Medusa build Medusa Security?
In the post announcing Medusa Security, Medusa points to AI agents:
- They now analyze and change software faster than before.
- Vulnerabilities get found faster as a result.
- Public applications also get more automated traffic.
A JavaScript application also depends on many packages that change constantly, and any of them can bring in a new vulnerability.
Medusa's position is that firewall rules, DDoS mitigation, and bot protection should come with the platform. I agree with that for most stores. When I plan a Medusa project with a client, the developers rarely want to own the security setup. They can't skip it either.
What does Medusa Security include?
Medusa Security includes five features, and Medusa adds a Security Analytics page on top of them. The first four work at the edge of the network, so a blocked request never reaches your Medusa application.
What does Medusa Security change for a store on Medusa Cloud?
Medusa treats new projects and existing projects differently, and it enables the protections in two phases.
New projects on Medusa Cloud
Medusa Security is enabled automatically for every new project. You don't configure any of it, and your store is protected from the moment it goes live.
This is the default I'd want. Your team has a long task list before a launch. With this default, traffic security isn't on it.
Existing projects on Medusa Cloud
On existing projects, Medusa enabled only Instant Protection when it announced the product. You enable the other protections yourself in the Security settings of the project, and Medusa strongly recommends that you do.
Medusa's documentation says that in the second half of November 2026, it will enable Medusa Security for all existing projects. After that, you won't be able to disable it.
Medusa notifies the organization owner before it does this. Check today who the owner of your Cloud organization is, and make sure that person reads the notification.
Security settings per environment
Each feature applies only to the environments you select for it. You can select an environment type: Production, Long-lived, or Previews. You can also select individual environments, or combine both.
For example, you can apply bot detection to Production only. Automated tests that send requests to your preview environments will then keep working.
Medusa recommends enabling all security features for Production. If you don't select any environment for a feature, the feature is off.
How should your team prepare before Medusa turns all protections on?
Medusa recommends enabling the other protections right away, and you do it in the Security settings of the project.
Why should you do it now, if Medusa will enable them anyway? Each protection decides which requests reach your store and which are blocked. Sometimes a security rule blocks a request that was legitimate. This is called a false positive.
Today, you still control the features. Until Medusa enables everything automatically, you can disable a feature at any time if you notice too many false positives. After the automatic rollout, you won't have that option.
If you enable the protections early, you see how they work with your store while you can still turn them off. Medusa suggests starting on a preview or staging environment. You enable them on Production once you've verified that everything works correctly there.
Security Analytics shows you which requests were blocked and which feature blocked them.
What does Medusa Security leave to your team?
Medusa Security protects the traffic that reaches your store. It doesn't review what your developers wrote or which packages they installed. Medusa states in its Data Protection guide that the security of your own application stays with you.
In practice, 4 areas stay with you:
- Your custom code. Every custom endpoint, workflow, and integration your team builds needs its own validation and its own tests.
- Your dependencies. Medusa asks you to keep updating your application, and the same applies to every package your project installs.
- Your third-party services. Payment providers, ERPs, and search tools each have their own credentials and their own security settings.
- Access to your organization. Medusa Cloud offers two-factor authentication and organization roles, but your team has to turn them on and decide who gets which role.
I describe that side of the work in the guide to enterprise-grade eCommerce security in Medusa. It covers access control and payment data, and it includes the checklist a CTO should use to evaluate an eCommerce platform
Medusa also says that this first release is a starting point. It plans to add more advanced features in the coming months, so the list above may get shorter.
What does Medusa Security change for a self-hosted Medusa store?
Medusa Security isn't available for a self-hosted Medusa store. It works only on Medusa Cloud, and Medusa hosts Cloud projects only on infrastructure that it manages itself.
In its Cloud vs Self-Hosting comparison, Medusa says that you have to set up and maintain these protections yourself and keep up with new vulnerabilities.
If you self-host, check your setup against the same list:
- Is there a web application firewall in front of the store, and who updates its rules?
- Does your hosting provider mitigate DDoS attacks at the network and application levels?
- Do you block malicious bots without blocking search engine crawlers?
- Is the database closed to public access?
- Can someone on your team see which requests were blocked, and why?
- How fast do you install a Medusa security update after it's released?
I'd look hardest at the speed of your updates. On Cloud, Instant Protection blocks the attack while you wait to upgrade. A self-hosted store stays exposed until your team installs the update.
Self-hosting is still the right choice for some businesses. Medusa's own example is a business that has to keep all data on infrastructure it owns because of internal policy or regulation. In that case, your team or your Medusa development partner has to build and maintain the same protections.
Summary: Is your Medusa store ready for Medusa Security?
- If your store is on Medusa Cloud, Medusa protects its traffic for you. You get it on every plan, and new projects have it from the first day.
- If your project already exists, test every protection on staging now. The automatic rollout is planned for the second half of November 2026, and after that you can't switch the features off.
- If you host Medusa yourself, this work stays with your team. Use the 6 questions above to see how your setup compares.
In both cases, your code and your dependencies remain your responsibility. Medusa handles the traffic, so your developers are free to spend more time on the code.
Do you want a second opinion on the security of your Medusa store before the rollout? Let's talk about your Medusa store.
FAQ
Is Medusa Security free?
Medusa Security is available on all Medusa Cloud plans. New projects have it enabled by default, and you manage it from the Security settings of the project. It isn't available outside Medusa Cloud.
Can you turn Medusa Security off?
You can disable a Medusa Security feature today, but you won't be able to after the automatic rollout. Medusa plans the rollout for existing projects in the second half of November 2026. Until then, you can switch a feature off if you see too many false positives. You can also choose which environments each feature applies to.
Will Medusa Security block real customers or search engines?
Medusa blocks a request only when it's certain that it comes from a malicious bot or matches a known attack. Verified bots, such as search engine crawlers, are allowed through. If a customer is blocked, the response includes a Ray ID. You enter it in Security Analytics to see which rule blocked the request.
Do you still need to update Medusa if you have Medusa Instant Protection?
Yes, you should still update your Medusa application regularly. Instant Protection blocks requests that try to exploit a known vulnerability at the edge. Your own code still has the vulnerability until you install the new version.
Does Medusa Security work with a self-hosted Medusa store?
No, Medusa Security only protects projects hosted on Medusa Cloud. When you self-host, your team sets up and maintains the same protections itself. It also has to keep up with newly discovered vulnerabilities.
