PrestaShop store hacked: what to do

A redirect to an unknown site, an administrator account nobody created, a payment form that suddenly looks different, a warning from Google or from your host: these signs need to be taken seriously. The steps below follow the order of an incident response. Above all, do not wipe everything in a hurry: without evidence, you cannot tell how the attacker got in, and they will come back the same way.

If you are not comfortable with these tasks, bring in a security professional or your PrestaShop agency from the start. In France, the cybermalveillance.gouv.fr platform points victims to service providers and offers support; many countries have a similar national service.

1. Isolate the store

1. Switch the store to maintenance mode from the PrestaShop back office, allowing only your own IP address.
2. If malicious code is stealing payment data, or if the back office is no longer reachable, ask your host to cut off public access to the site.
3. Tell your host: they can provide their logs, and other sites on the same server may be affected.

2. Preserve evidence before cleaning up

Before deleting or restoring anything, take a full copy of the current state and keep it off the server:

1. all the site’s files;
2. a database export;
3. the web server logs (access and error) and PHP logs;
4. the logs of your security tools.

Also write down when you noticed the problem and what you saw, with screenshots. All of this will be needed for the investigation, for a possible police report and for the notification to your data protection authority.

If Sentinel was installed, export its security logs without delay: they are kept for 7 days. They may contain failed logins, blocked back-office access, sensitive requests and, with the Pro version, detected attacks.

3. Find the entry point

Restoring without knowing how the attacker got in often just lets them back in. The most common causes are:

• a vulnerable module or PrestaShop version: compare your versions with published vulnerabilities, or run Sentinel’s vulnerability scanner, which lists the known flaws in your installation;
• a compromised account: employee, FTP, SSH, hosting control panel. Look for unknown accounts and unusual logins;
• an uploaded file: an unknown PHP script in the image, upload or module folders.

Search the server logs for requests to suspicious files and for the date of the first abnormal activity. That date tells you which backup is clean.

4. Restore a clean backup

1. Pick a backup from before the first sign of intrusion.
2. Restore files and database, then carefully bring back the orders and customers recorded since, rather than copying back the whole compromised database.
3. Before going back online, update PrestaShop and fix the flaw you identified: update, uninstall the module at fault, delete the uploaded files.

Without a clean backup, cleaning file by file is possible but tricky: this is exactly where a professional saves time and avoids oversights.

5. Change every secret

Assume that anything stored on the server may have been read. Change:

1. the passwords of all back-office employees, and delete any unknown accounts;
2. the database password, then update PrestaShop’s configuration;
3. FTP, SSH and hosting control panel credentials;
4. API keys: payment methods, carriers, PrestaShop webservice, email services;
5. the passwords of the email accounts linked to the store.

Then turn on two-factor authentication for the back office. Sentinel offers it for free: see the two-factor authentication page.

6. Check file integrity

Once the store is restored, make sure no modified or added file remains. Compare PrestaShop and module files with the official archives for their versions.

Sentinel Pro’s file integrity check runs this comparison for PrestaShop itself, modules and themes. It flags modified, missing or unexpected files and shows the differences line by line. A module missing from its reference base can be checked against its ZIP archive. It does not replace a professional’s analysis, but it quickly shows you where to look.

7. Notify the people affected

If personal data may have been accessed, copied or altered (customer accounts, addresses, orders), the GDPR applies:

1. Notify your data protection authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people’s rights and freedoms. In France, that authority is the CNIL. Notification is made online, and can be completed later if the investigation is still under way.
2. Inform the customers concerned without undue delay if the risk to them is high, for example when passwords or payment data were stolen.
3. Document the incident internally in every case, even without a notification: facts, effects, measures taken.

If card data may have been intercepted, tell your payment provider immediately. You can also report the attack to the police, using the evidence kept in step 2.

8. Prevent it from happening again

A store that has been attacked once is often targeted again. Once the crisis is over:

• keep PrestaShop and your modules up to date, and check regularly for known vulnerabilities;
• keep automatic backups, stored off the server and tested;
• protect the back office: named accounts, two-factor authentication, access restricted to your team’s addresses;
• monitor your logs and the integrity of your files.

Our guide How to secure the PrestaShop back office covers these measures in detail, and How to check if your PrestaShop modules are vulnerable explains how to check your modules. With the Pro version, Sentinel’s web application firewall blocks known exploit attempts and anti-DDoS limits abusive requests. Plans are compared on the pricing page.