PHP 7.0 to 7.4 reached end-of-life between 2019 and 2022: no more security patches, even for critical flaws. PHP 8.1 and 8.2 reached end-of-life in December 2025. In 2026, aim for PHP 8.3 (supported until November 2026) or 8.4. In our audit, 11 stores out of 60 ran on end-of-life PHP, including 4 on 7.x versions abandoned since 2019-2020.
PrestaShop vulnerabilities are mostly exploited through outdated or non-official third-party modules. Simple rule: any module not updated for over a year is a risk, any module downloaded outside the official Addons marketplace is an additional risk. Remove unused modules — every module is an attack surface.
The default /admin directory is the first thing botnets probe. Rename it (PrestaShop suggests it at install), and never leave an /install directory on the server: it's a known reinstallation flaw. In our scan, one store in 60 still exposed its default admin directory.
.git, .env containing real secrets (passwords, API keys), downloadable SQL backups or ZIP archives: all of these must be inaccessible from the web. Also make sure your backups don't end up in the site's public directory.
Active SSL certificate, HTTP → HTTPS redirect, no mixed content. HTTPS is not optional: it protects your customers' login data and is required for online payments.
Four headers make the difference and are missing on most stores we audit:
Strict-Transport-Security (HSTS): forces HTTPS.X-Frame-Options: prevents clickjacking (your store displayed in an attacker's iframe).X-Content-Type-Options: nosniff: blocks MIME type sniffing.Content-Security-Policy (CSP): limits the scripts the browser can execute — the best defense against XSS.Session cookies must be marked Secure (sent over HTTPS only), HttpOnly (inaccessible to JavaScript) and SameSite. A session cookie without these attributes allows session hijacking.
Debug mode (_PS_MODE_DEV_) displays errors and server paths: it must be off in production. And test your backups regularly — a backup you never restore doesn't exist.
You can check each point one by one — or let the audit do it. Our free audit scores your store /100 in 30 seconds and tells you exactly which points of this checklist are failing, with the fix to apply. It's the same engine as the PrestaShield module (€29.90), which adds file malware scanning, scan history and automatic email alerts directly in your back office.
Passive audit, no modification of your site. Score /100 in 30 seconds.
Sources: official PHP end-of-life dates (php.net), OWASP Secure Headers recommendations, statistics from our audit of 60 French stores (August 2026).