New Offers Are Waiting on Shop Code Nobody Can Change.

Marketing has a plan for the festival season. Buy two, and loyalty members get the third at half price.

The developer looks at it for a day and comes back. The discount logic sits in a module written for the old version of the shop in 2017. It leans on an add-on whose maker stopped updating it. Changing either risks the checkout, and the season is six weeks away.

So the offer becomes a flat code that anyone can use. Marketing is told, once again, that the shop cannot do that.

What We Found

We looked at two things: what the public record says about the dates on which shop platform versions stop being fixed, and what India’s government announced about how online sellers show a price cut.

A rule on showing price cuts in India comes into force on 1 January 2027. The government announced on 10 September 2026 that the Consumer Protection (E-Commerce) (Amendment) Rules, 2026 “shall come into force from January 1, 2027”. Under them, “Where a price reduction is announced, the reduced price and prior price shall both be displayed.” The “prior price” is “the lowest price at which the goods or services were offered during the 30 days preceding the announcement”. The release names “e-commerce entities” generally, and “Marketplace e-commerce entities” for some other duties.

Version dates keep arriving, even after a move. Magento 1, a widely used open-source shop platform, has had no fixes from its maker since 30 June 2020. Later versions have passed their own end dates: version 2.3 on 30 September 2022, and version 2.4.5 on 25 November 2024.

In one recorded wave, old shops were hit through a part added to them. In early 2022 a security firm found several hundred infections on the same day, all with the same malicious code, on shops running Magento 1, through a known flaw in an add-on. The wider breach covered several hundred online shops on that version, with card-skimming code, which copies card details at checkout, loaded on all of them. This is an older case. The shops are not named, and no loss is recorded.

The Work That Waits on an Old Shop

The agency’s yearly warning offers two choices: stay another year, or move everything. The question that decides the matter is in neither: what can the business not do while its own rules stay where they are?

New offers. Every offer, voucher and loyalty rule meets the checkout. Where those rules sit in old custom code, each new idea is measured against the risk of touching it, and many are cut down before launch.

The prior price. Our reading, and only that: a shop that overwrites a price when it changes keeps no record of what the price was last week. Showing the lowest price of the past 30 days beside a cut needs that record, and the offer rules that announce a cut would have to read it. If those rules live in old custom code that nobody dares change, this is the change that waits. Whether the rules apply to your shop, and what they require of it, is for you and your advisers.

This is our reading of the evidence. It is not a measured market figure, and we do not put a rupee value on it here. That figure has to come from your own business.

Four Ways to Answer an Unsupported Shop, Weighed

Option	When it fits	What it risks
Keep the old platform and have the agency apply what fixes it can	A move already has a firm date, and few new offers are planned before it	On an unsupported version the maker issues no new fixes. New offers and any change to pricing wait on the old code
Move the whole platform at once with a platform specialist	The shop is close to standard, with little custom code	The firm’s own rules are rewritten under one deadline, found as change requests, and checked by shoppers on launch day
Rebuild the shop’s own rules beside the old shop	The pricing, offer and order rules are the firm’s own and change often	Started without a written record, nobody knows which rules matter. Old and new run side by side, and for a time you pay for both
Write down the custom code first	The shop is old, much changed, and looked after by several agencies in turn	It costs money before anything moves, and the record may show more custom code than anyone expected

Where You Are Now, and Where You Should Be

Before the next year on the old version is agreed, we would set a benchmark for the decision itself.

Measure	Typical starting point	Where it should be	How it is checked
The cost of staying	The agency’s fee alone	The fee, workarounds, offers cut down and staff time, in one place	The cost comparison
The cost of leaving	One wide range in every quote	A price for each stage	The staged plan and quote
Offers and campaigns waiting on old code	Not linked to any part of the shop	Each listed against the custom rule it needs	The staged plan
Where past prices are kept	Not known	Known, and written down for each pricing rule	The specification
The size of one commitment	The whole shop at once, or nothing	One module, with the freedom to pause after any accepted module	The staged plan
The platform move	Priced from the storefront	Priced by a platform specialist against one written scope	The quotes set beside the specification

The starting points above are what we expect to find. In an engagement they are replaced by your own position, taken in the first review. The targets are what we would work towards with you. They are not results we have already achieved for a retailer.

How We Work With You

1. We listen: a free Reliability Review. A first conversation about the shop and the offers that keep being cut down. You leave with a short written note of what we found. You can start with a conversation about the system; we ask for read-only code access only when the assessment begins.
2. We research. We research your sector, the regulator’s position and what the public record says about firms in your situation. This article is an example of that work.
3. We read the system and propose: the Legacy System Specification Assessment. Here the system is the custom code built on your shop. It produces a written specification of what it does, a risk register, a cost comparison between keeping and replacing the system, and a staged plan with a fixed quote. AI does a first pass, our senior engineers review it and trace it to the code, and your own experts confirm it. Code access is read-only and logged, never used for training, and deleted within 30 days of the evaluation ending unless we engage. You get the options and our recommendation.
4. If you approve, we build. We replace a system one module at a time while the old one keeps running. Here that means the shop’s own pricing, offer and order rules, rebuilt beside the old shop on technology that is still supported. We never do a single cutover. The work is billed by milestone, each milestone tied to a module you accept, and you can pause after any accepted module.
5. We review against the benchmark. Before work starts we set the benchmark. After each module we show you where each measure stands, and the filled-in benchmark is yours at the end.

The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The assessment fee is credited in full against the first build stage if it starts within 90 days of the report.

What you need to bring: a budget for the assessment; read-only access to the code once the assessment begins; someone from marketing or operations to accept each module, with real baskets to test; and a way for the old shop to call each rebuilt part, agreed with whoever looks after it.

What we do not do: we patch nothing, and we do not fix flaws in the old shop while it waits. We secure nothing; a rebuilt rule is not a secured shop. We move no platform and choose no platform; that move is made by a platform specialist you choose. PHP is a language we read, not one we build in. Meeting the amended e-commerce rules, or any other rule, is your own work: we do not offer a compliance service, and we do not say what any rule requires of a particular firm. We have no published case of this work for a retailer.

What changes for the business:

Role	What they gain
CEO	The rules that make the shop the firm’s own no longer sit inside software nobody fixes.
CTO or CIO	Custom logic on a technology people can be hired for, and a thinner old shop that is easier to move.
CFO	Spend is released one accepted module at a time, in place of one large migration bill.
CISO	Fewer of the firm’s own rules in unmaintained code, and a smaller, known remainder on the old version. Until the platform move, the old shop is as exposed as before.
Head of marketing	A new offer can be built in code the team understands, without waiting on the old shop.

The cases in this article, and what IOanyT does about that kind of problem:

The case	What IOanyT does
Hundreds of shops on an unsupported version were infected in one day in 2022, through a flaw in an add-on.	Our part is narrower than this case. We do not secure shops or fix add-ons, and we promise no protection from attack. We rebuild a shop’s own rules beside it, one module at a time, so that less of the firm’s logic depends on code nobody maintains.
India’s government announced on 10 September 2026 that, under its amended e-commerce rules, in force from 1 January 2027, “Where a price reduction is announced, the reduced price and prior price shall both be displayed.”	Our assessment shows where a shop’s pricing and offer rules live and what moving them would take. Meeting the rules is the seller’s own work.

IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. The platform’s maker sets the dates; how much of your business still depends on them can be your decision.

Book a free Reliability Review →

Get a fixed quote →

See the Legacy System Specification Assessment →