My PrestaShop store was hacked: the 7 immediate actions

Don't panic (but act fast)

In our audit of 60 French stores, 20 had at least one critical issue and 11 ran on end-of-life PHP, with no security patches for years. In other words: PrestaShop store hacks are not rare, and most are linked to known, documented vulnerabilities. That's bad news — but also good news: it means cleanup follows a known procedure you can apply in order.

The 7 actions, in order

1. Take the store offline immediately

Cut public access to the site (maintenance mode or suspension with your host). Goal: stop the data leak and prevent the attacker from doing more damage. Your revenue can wait 24 hours — your customers and your reputation cannot.

2. Change ALL passwords

PrestaShop back office, database, FTP/SFTP, hosting, business emails, PrestaShop Addons accounts. Use unique, long passwords (a password manager is essential). Enable two-factor authentication (2FA) everywhere possible. An attacker who got in once often leaves backup access.

3. Back up the current state

Before deleting anything, save the entire site as-is: files (via SFTP) and database (via phpMyAdmin or your host's tool). This "contaminated" copy is your evidence: it lets you analyze the malware safely and understand what the attacker did. Never restore it as-is.

4. Identify the vulnerability (the most important step)

If you clean up without finding the entry point, the attacker will return within days — that's the classic scenario. Look for:

• Recently modified files (within the last 30 days), especially in modules/, themes/, override/ and the root.
• Backdoors: suspicious PHP code in files that should not contain any (image, CSS, JS files with PHP).
• Unknown administrator accounts in the database (ps_employee table).
• Non-official or outdated modules — the #1 cause of PrestaShop compromise.
• Modified .htaccess files (redirects to third-party domains).

Our PrestaShield module automates this search: scan of known infection patterns (eval+decode, webshells, phpunit exploit), recent files in critical folders, suspicious .htaccess, exposed accounts. The report scores your store /100 and lists the issues — exactly what you need at this step.

5. Clean the malware

Two strategies: restore from a clean backup predating the hack (the safest), or surgical file-by-file cleanup (when you have precisely identified the infected files). In both cases:

• Reinstall PrestaShop core files and modules from official sources.
• Delete unknown files (backdoors often have random names: wp.php, c3b4.php, cache/xx.php...).
• Check the database: look for injected code in configuration fields (ps_configuration) and content pages.

6. Update BEFORE reopening

Upgrade PHP, PrestaShop and all modules to the latest compatible versions. A hacked store running PHP 7.0 (end-of-life since January 2019) is a magnet for attackers: as long as the version is unsupported, the same vulnerability stays open. This is the time to do that migration you keep postponing.

7. Reopen with monitoring

Once the site is clean and up to date: change passwords once more, enable logs, and monitor modified files and suspicious connections for at least a month. If you have a legal obligation (customer data — GDPR), document the incident and notify the CNIL (72 hours) as well as the affected individuals if data was exposed.

What if it happens again?

Prevention is cheaper than intervention: the stores we monitor continuously detect problems before attackers do, not after. The free audit gives you a /100 score in 30 seconds, and the PrestaShield module (€29.90) scans your files in the back office with automatic email alerts — the kind of safety net that turns a hack into a simple incident.

Sources: statistics from our audit of 60 French stores (August 2026). Incident procedure follows PrestaShop recommendations and OWASP best practices.