If your PrestaShop store may be compromised

When a PrestaShop store looks normal but something feels wrong — odd redirects, new admin users, unexplained PHP files — use a calm checklist and tools that show what changed.

Signs worth investigating

  • Unexpected files under modules, themes, or upload directories
  • Core or override PHP that differs from a known-good backup
  • New back-office employees you did not create
  • Spikes in failed admin logins or WAF blocks
  • Customer reports of redirects, spam, or checkout anomalies

A practical first pass

  1. Preserve evidence: take hosting backups and note timelines before mass deletes.
  2. Rotate employee passwords; enable 2FA; review employee accounts.
  3. Run malware and integrity scans in PrestaShop Security Engine; prioritize critical paths.
  4. Check vulnerability advisories for installed modules and plan urgent upgrades.
  5. Review attack and login logs for the window when symptoms started.
  6. Involve your host or a PrestaShop specialist for deep forensics if needed.

How Security Engine helps (and what it does not)

Security Engine improves visibility and blocking for many common PrestaShop threats. It does not magically undo a full compromise or replace professional incident response. Use it to find signals faster, then remediate deliberately.

Get PrestaShop Security Engine Documentation