Guide · Shopware

Shopware 6 update failed? Causes, the way back, security updates

A Shopware update was aborted, or the store no longer runs properly afterwards. What counts now is a calm sequence: protect your customers, narrow down the cause, then repair or restore.

Julian Bräucker Updated: 11 min read
01 · Stay calm

The first steps

An update was aborted, or afterwards the store shows errors, blank pages or an Administration that will not load. What helps now is a fixed order of steps.

  1. 01

    Turn on maintenance mode

    For all sales channels. That way no orders come in to a half-updated store.

  2. 02

    Save the current state

    Even broken, it is what you troubleshoot from.

  3. 03

    Read the logs

    Before you change anything. The message usually names the spot.

  4. 04

    Decide

    Repair if the cause is clear and quick to fix. Restore if it is not.

You turn on maintenance mode in the settings of each sales channel, or on the console for all of them at once. In the channel settings you also allow your own IP address, so you can still see the store during maintenance.

On the console, for all sales channelsbin/console sales-channel:maintenance:enable --all
02 · Causes

Where it usually goes wrong

If the Administration does not load, an extension often ships outdated Administration files. Updating or temporarily deactivating it helps.

Cause 01

Incompatible extensions

A plugin does not support the new version yet. Especially extensions that reach deep into checkout, payment or shipping.

Cause 02

Composer conflicts

If you update with Composer, you get “Your requirements could not be resolved” when extensions require different package versions.

Cause 03

Aborted migrations

An update restructures the database. If a migration aborts, the database is stuck between the old and the new state.

Cause 04

Theme not recompiled

The Storefront looks unstyled or individual elements are missing.

Cause 05

Caches and OPcache

The server still delivers parts of the old code. The errors go away once all caches are cleared and PHP is restarted.

Cause 06

Background processes

The queue and scheduled tasks keep running with old code: emails, indexing or exports get stuck.

03 · Troubleshooting

Narrowing down the cause

Shopware writes errors to log files in the var/log folder, in a production store to files like prod-<date>.log. On top of that there is the web server’s error log. The message usually names the class or file, and through it the plugin.

One command at a time, with a look at the log in between. If you run everything at once, you will not know afterwards what helped.

  • bin/console plugin:refreshReload the extensions.
  • bin/console plugin:listAll extensions with version and status.
  • bin/console plugin:deactivate <Name>Switch off a suspicious extension.
  • bin/console cache:clearClear the cache.
  • bin/console theme:compileRecompile the theme.
  • bin/console dal:refresh:indexRebuild the indexes when search or categories show wrong results.
  • bin/console messenger:stop-workersStop the background processes so they restart with the new code.
Updating with Composer

Before the update bin/console system:update:prepare, afterwards bin/console system:update:finish. The latter runs the database migrations. If this step was forgotten or aborted, that alone is often the cause.

04 · The way back

Going back only works with files and database together

An update changes not only files but, through its migrations, the database too. Old files on a database that has already been restructured lead to new errors.

Without a backup from right before the update, the only option is to repair forward: find the cause, update or replace extensions, run the migrations again. That usually takes longer and needs experience with Shopware.

A clean way back

Files and database from the same backup

Taken right before the update. Orders placed after it will be missing from the store afterwards.

That is why maintenance mode comes first

It keeps such orders from coming in. Anything ordered between the backup and maintenance mode has to be reconciled with your payment provider and your inventory system.

05 · Security

Security updates cannot wait

A failed update is no reason to update less often from now on.

Shopware publishes security fixes as patch releases, recognizable by the last digit of the version number. Older versions get selected fixes through the security plugin, which does not replace a current version. Two examples from 2026:

Fixed in 6.7.13.1 · 6.6.10.23

Store API

Under certain conditions, takeover of the administrator account and code execution, especially in headless stores.

Source: Sansec, August 2026
Fixed in 6.7.8.1 · 6.6.10.15

App credentials

CVE-2026-31889: takeover of the credentials of installed apps.

Source: GitHub Security Advisory, 2026

So: apply security updates promptly and tested, not blindly. How to do that without downtime is covered in the guide How to update Shopware 6 without putting your store at risk.

06 · Dress rehearsal

Rehearse, but not with real customer data

The best insurance against a failed update is a dress rehearsal on a copy of the store. There it is allowed to fail and gets fixed before the live store takes a hit.

From a data protection point of view, a copy with real names, addresses and orders is a second database full of personal data, often less well protected than the live store.

Example: a customer record before and after anonymization (made-up data)
FieldLive storeCopy
NameJane ExampleCustomer 4711
Emailjane@example.comcustomer4711@test.invalid
Address1 Sample Road1 Test Street
Order3 items, €129.003 items, €129.00

Made-up sample data. Products, prices and order structures stay, people do not.

07 · My solution

How I prevent this with the Doppelgänger

For my clients, I apply every Shopware update to the Doppelgänger first, an exact copy of the store on a dedicated server in Germany.

Anonymized copy

Customer data is anonymized on every copy.

Checked through to checkout

I check extensions, theme and background services, and I place orders through to checkout, using the payment providers’ test modes.

Live, reversible at any time

Only the checked state goes live, within a few minutes. Every release is a version of its own, and the previous state is back in seconds.

Tested every morning

Every morning a test order runs through the live store up to payment.

What that looks like in detail is on the page The Doppelgänger for Shopware.

From a client: JuCad works with the Doppelgänger: every update and every new feature runs on the copy of the store first and goes live only after testing.

Doppelgänger for Shopware
Since our store got its Doppelgänger, where Julian checks every update and every change first, the store has been running absolutely smoothly. Updates are no longer a big project we keep putting off. We see and test new features there before they go live, and only approve them once everything is right. It has made our work noticeably more productive.
Bettina SanioHead of Marketing & Communications, JuCad®
Since 2020in my careShopware 6with the Doppelgänger
Frequently asked questions

Quick answers.

What do I do first when a Shopware update fails?

Turn on maintenance mode for all sales channels so that no orders come in to a half-updated store. Then save the current state for troubleshooting and look at the logs under var/log and at the web server's error log.

Can I just copy the old files back?

No. Through its migrations, an update also changes the database. Old files on a new database structure lead to further errors. Going back only works with files and database from the same backup, ideally taken right before the update.

Which extensions cause the most problems during updates?

Extensions that reach deep into checkout, payment or shipping, and custom plugins whose vendor does not support the new Shopware version yet. Before every update, it pays to check the compatibility information of all installed extensions.

After the update, the store looks unstyled. What happened?

Usually the theme was not recompiled after the update, or caches are still delivering old files. Recompiling the theme and clearing the caches fixes this in many cases. If the error remains, it is often a theme extension that does not fit the new version.

How urgent are Shopware security updates?

Very urgent. Shopware publishes security fixes as patch releases, and for older versions through the security plugin. In 2026, fixes included a vulnerability in the Store API with a possible takeover of the administrator account and a vulnerability affecting app credentials. Updates like these should be applied promptly, but tested.

May I test updates on a copy with real customer data?

I advise against it. From a data protection point of view, a copy with real names, addresses and orders is a second database full of personal data, often less well protected than the live store. For testing, a copy with anonymized customer data is enough.

Keep reading

More guides

Shopware
From Shopware 5 to Shopware 6: how to get the migration right
What moves over, what has to be rebuilt and how to keep your search rankings.
Learn more
Costs
Shopware Community Edition over €1 million in sales: what now?
What you lose above €1 million GMV, what Rise costs and why switching systems is rarely cheaper.
Learn more
Security
Cyber Resilience Act: what it means for your website or online store (and what it does not)
Who the CRA obliges, who it does not, and what changes indirectly for website and store owners.
Learn more
Staging
Staging environments: host staging, plugin or your own server?
Four approaches compared: isolation, data protection, rollback and suitability for stores.
Learn more
Shopware
From Shopware 5 to WooCommerce: how to get the move right
When WooCommerce fits, what moves over and how to protect your rankings and customer accounts.
Learn more
Costs
Website maintenance: What does it really cost?
Maintenance contracts compared, hours per update round, and what a single incident can cost.
Learn more
Security
NIS2 for small businesses: covered or not, and what your customers are asking now
Who NIS2 covers directly, what customers ask suppliers, and how to answer website questions with evidence.
Learn more
Shopware
How to update Shopware 6 without putting your store at risk
Patch, minor or major: a checklist for backups, staging, extensions and rollback.
Learn more
Security
Online store hacked: what to do now
First steps for Shopware and WooCommerce: skimmers, payment providers, customer data, reporting.
Learn more
Shopware
Replacing Shopware 5: which alternative fits your store?
Shopware 6, WooCommerce, Shopify, JTL-Shop and Magento: costs, effort and which one fits whom.
Learn more
Security
PHP2Shell: what the critical PHP flaw means for your website
What the PHP flaw allows, who is affected and why this time your host has to act.
Learn more
Security
PHP2Shell: what to do now
Check the PHP version, ask your host, protect the site meanwhile, look for signs of a break-in.
Learn more
Security
Security in the age of AI: what changes for your website
What AI changes about attacks on websites, what is proven, and which defenses really help.
Learn more
Security
Updates are mandatory: what the GDPR requires of website and store owners
What Art. 32 GDPR requires for updates, backups and access, and what supervisory authorities say about it.
Learn more
WordPress
Critical error after a WordPress update: how to get your website back
Recovery mode, switching a plugin off via FTP, rolling back a version and preventing it in the future.
Learn more
Security
WordPress hacked: what to do now
First steps, signs, backup or cleanup, the Google warning and the reporting duty.
Learn more
WordPress
How to update WordPress safely without putting your website at risk
Why postponing is risky and which routine keeps core, plugins and WooCommerce safe.
Learn more

Updates without weekend call-outs?

Tell me which store you run and how updates are handled today. I will tell you how the Doppelgänger would protect your store.

Send an inquiry +49 211 174 205 79
The Doppelgängerby jbraucker

Developed by Julian Bräucker, Düsseldorf. Servers in Germany.

Cover for your website. © 2026 Julian Bräucker · jbraucker.com Data center in Falkenstein, Germany