Deploying Shopware 6.7 in a production environment requires more than meeting baseline software versions. E-commerce traffic patterns are inherently spiky, and transactional consistency must never be compromised by inadequate infrastructure. While the official documentation provides a checklist, real-world performance hinges on deliberate architectural decisions. This guide details exactly what your server stack needs to deliver a fast, secure, and horizontally scalable Shopware 6.7 storefront.

Core Runtime & Extension Requirements

Shopware 6.7 officially supports PHP 8.2 and 8.3. Both are viable, but PHP 8.3 is strongly recommended for its improved JIT compilation, reduced memory overhead, and enhanced type safety. Ensure you compile or enable the following extensions: opcache, intl, mbstring, curl, xmlreader, xmlwriter, gd (or imagick for advanced media processing), redis, pdo_mysql, zip, and sodium. Disable Xdebug entirely in production to avoid severe latency penalties.

A properly sized PHP-FPM pool is critical. Start with pm = dynamic, pm.max_children = 20, pm.start_servers = 5, and pm.min_spare_servers = 5. Monitor CPU load and adjust dynamically as concurrent checkout requests scale. Enable OPcache with opcache.jit=1235 and opcache.memory_consumption=256 to reduce bytecode parsing overhead.

Database Architecture & Tuning

MySQL 8.0+ or MariaDB 10.5+ are mandatory for Shopware 6.7. The framework relies heavily on JSON storage, generated columns, and advanced full-text indexing, which stabilize in these releases. Configure innodb_buffer_pool_size to approximately 70% of available RAM on dedicated database nodes. Enable innodb_flush_log_at_trx_commit=1, sync_binlog=1, and utf8mb4_0900_ai_ci collation for consistent multilingual search and tax compliance.

Connection pooling is non-negotiable in production. Use proxy tools like ProxySQL or HAProxy to prevent connection storms during peak campaigns. Maintain regular index statistics updates with ANALYZE TABLE or automated scheduling. Avoid running Shopware directly against primary replicas without query routing, as write-heavy plugin operations can block read replicas and trigger deadlocks.

Search Engine Transition in 6.7

Shopware 6.7 permanently drops legacy Elasticsearch 7 support. The officially supported backends are OpenSearch 2.x or Meilisearch. OpenSearch 2.x functions as a direct architectural drop-in, offering improved document mapping and faster aggregation queries. Allocate 2–4 GB RAM per node, configure heap size matching your product catalog size, and set discovery.type: single-node for standalone deployments or cluster.initial_master_nodes for multi-instance clusters.

If using Meilisearch, prioritize low-latency network topology between Shopware and the search instance. Maintain separate indices per sales channel to prevent cross-store contamination during category filtering or faceted navigation. Regularly rebuild mappings after plugin upgrades that introduce custom product attributes.

Caching, Sessions & Distributed Locks

Redis is mandatory for production caching, session storage, and distributed lock management. Use Redis 6.x or 7.x with maxmemory-policy allkeys-lru and maxmemory set to roughly half your available RAM. This prevents out-of-memory kills while keeping high-traffic product pages, cart states, and token buckets readily accessible.

Configure session storage via the Shopware configuration file:

session:
  save_handler: redis
  save_path: "tcp://redis-host:6379?database=1"

For multi-node deployments, implement Redis Sentinel or Cluster to eliminate single points of failure during failover events. Avoid using Redis solely for static asset caching; let CDN edge networks handle media delivery while Redis manages stateful operations.

Hardware Sizing & Storage I/O Characteristics

While Shopware scales dynamically, baseline production specs should reflect commercial load patterns:

  • CPU: Minimum 4 cores; recommend 8+ for multi-storefronts or heavy plugin ecosystems.
  • RAM: 8 GB minimum; 16 GB recommended to accommodate PHP-FPM pools, database buffers, and Redis simultaneously.
  • Storage: NVMe SSDs are strongly advised due to heavy I/O from media processing, database transactions, and log rotation. Allocate at least 50 GB free space, scaling with catalog size and audit log retention policies.
  • Network: Gigabit Ethernet minimum, with DDoS mitigation and global CDN integration required for international storefronts.

Web Server, TLS & Security Hardening

Nginx or Apache can serve Shopware, but Nginx is preferred for static asset handling, Gzip/Brotli compression, and reverse proxy efficiency. Always route traffic through HTTPS using TLS 1.2/1.3 certificates managed via Let’s Encrypt or a commercial CA. Configure secure headers explicitly:

add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy "default-src 'self'" always;
add_header X-Frame-Options "SAMEORIGIN" always;

Enable rate limiting on authentication endpoints and implement WAF rules to block credential stuffing. Avoid running Shopware as root. Use systemd for process management, enable fail2ban, and restrict SSH access to key-based authentication only.

File Permissions, Deployment & CI/CD Workflow

File permissions must strictly follow the www-data user model. Execute:

chown -R www-data:www-data .
find var -type d -exec chmod 750 {} \; && find var -type f -exec chmod 640 {} \;
chmod -R o-w var/

Never run console commands as root. Use CI/CD pipelines with versioned artifact storage, database migration tracking (bin/console migrate), and atomic deployment strategies. Always enable maintenance mode during updates:

bin/console system:maintenance set true
# deploy code & assets
bin/console cache:clear --env=prod
bin/console system:schema:update --force
bin/console system:maintenance set false

Test staging environments under load using k6 or Locust before production promotion. Maintain rollback snapshots of both database dumps and media directories.

Monitoring, Logging & Incident Response

Production readiness extends beyond configuration. Implement centralized logging with ELK or Loki, track Redis hit rates, monitor PHP-FPM process exhaustion, and alert on failed transaction endpoints. Use OpenTelemetry for distributed tracing across microservices and payment gateways. Regularly rotate logs, compress historical data, and enforce GDPR-compliant retention policies.

Final Thoughts

Meeting Shopware 6.7’s server requirements is merely the foundation. Production readiness depends on continuous monitoring, security patching, and infrastructure elasticity. Refer to the official Shopware documentation for version-specific tuning guides, and consider managed hosting or container orchestration if operational complexity outweighs internal capacity. A well-architected stack ensures your storefront remains fast, compliant, and resilient under peak commercial demand.