Third-party modules: how to assess whether a module is safe before installing it
Every module you install is code that runs in your store with full permissions. These questions help you decide whether it is worth it.
Updated: 26/09/2026
114
Share:
Most serious vulnerabilities in PrestaShop stores are not in the core, but in modules. The point is not to install none, but to choose well.
Before buying or downloading
- Source: PrestaShop Addons or the developer’s website. Never “free” versions of paid modules: they usually come with a gift attached.
- Updates: when was the last one? Does it support your PrestaShop and PHP versions?
- Support: does the developer respond? Is there a changelog?
When reviewing the package
- Overrides: how many does it install? Each one is a source of future conflicts.
- Public entry points: standalone PHP files accessible from outside (
ajax.php,cron.php,export.php) without a token check are the most common vulnerability. - SQL queries with unescaped variables (
pSQL(),(int)). - Obfuscated code: a module that hides its code does not let you know what it does.
- Calls to external servers: what data does it send, and where?
After installing
- Test it first on a copy of the store.
- Check which hooks it registers and on which pages it acts.
- If it stops being used, uninstall it and delete its folder.
A specific warning sign: a module that compares its endpoint token with a configuration key that does not exist. Comparing against an empty value can let anyone through. We have seen it in export and migration modules.
-
Regulations for online stores Sales and discounts under the Omnibus Directive: how to advertise a reduced price without risking a fine -
Regulations for online stores The right of withdrawal in 2026: the new mandatory button and everything your store must comply with -
Strategy and conversion The real margin on each order: the calculation almost no store does (and should) -
Regulations for online stores Mandatory web accessibility for online stores: what the law requires since 2025 and how to comply
-
Regulations for online stores Sales and discounts under the Omnibus Directive: how to advertise a reduced price without risking a fine -
Regulations for online stores The right of withdrawal in 2026: the new mandatory button and everything your store must comply with -
Strategy and conversion The real margin on each order: the calculation almost no store does (and should) -
Regulations for online stores Mandatory web accessibility for online stores: what the law requires since 2025 and how to comply -
-
Marketing and loyalty Black Friday and seasonal campaigns: preparing the store technically -
ERP, invoicing and integrations REST APIs for ecommerce integrations: authentication, limits and errors -
Purchasing, stock and logistics Purchasing management: where an online store gains or loses its margin
