Security approach
PrestaShop Security Engine is built to help merchants detect threats, monitor integrity, and respond with clear signals — not to promise an unhackable store.
What we optimize for
Practical PrestaShop operations: finding suspicious files, spotting unauthorized changes, catching known vulnerable modules, reducing abusive login and probe traffic, and giving staff a dashboard they can act on.
Detection, not magic
- Heuristics have limits. Malware scanning looks for suspicious patterns and known dangerous tooling. Novel or carefully disguised payloads may not match every signature.
- Integrity needs a good baseline. Expected changes (updates, legitimate module installs) will appear as differences until you review and refresh baselines.
- Advisories depend on data sources. Vulnerability checks use Friends Of Presta / advisory data available to the module; coverage is only as current as those sources.
- WAF and login locks reduce abuse. They do not replace secure coding, hosting hardening, or strong employee practices.
Defense in layers
Security Engine complements — it does not replace — hosting firewalls, OS patching, TLS, least-privilege employee accounts, backups outside the store, and careful module selection. Use it as the PrestaShop-native layer that sees shop files, modules, and back-office authentication.
Honest expectations
We do not claim “100% secure,” “guaranteed protection,” or “unhackable.” The product goal is earlier visibility and actionable controls so you can investigate and respond before a quiet compromise becomes a full outage.
How we handle your purchase data
Checkout is processed by Paddle. License activation ties a key to your store domain through our licensing API over HTTPS. See the privacy policy for how account and support data are handled.