How to tell if your PrestaShop store has been hacked

An attacker who gets into an online store does not want you to see them: they want to stay. That is why the signs are subtle. If you are suspicious, these are the checks we run.

Warning signs

• Customers reporting fraudulent charges after buying in your store.
• Redirects to other sites, especially only from Google or only on mobile.
• Back office employees that nobody created.
• Google Search Console warnings about hacked content or spam.
• High server load with no increase in visits.

Looking for webshells

A webshell is a PHP file that lets the attacker run commands on your server. It usually hides in module or image folders, with innocent-looking names.

# PHP in folders where there should be none
find img upload download -name "*.php" ! -name index.php

# Functions typical of backdoors
grep -rlE "eval\s*\(\s*(base64_decode|gzinflate|\\\$_(POST|REQUEST|GET))" --include=*.php .

# PHP files modified in the last 30 days
find . -name "*.php" -mtime -30 -not -path "./var/*"

Looking for skimmers

A skimmer steals card details at checkout. It is usually JavaScript injected into the database (configuration, text blocks, translations) or into the theme’s JS files.

• Search for <script in the configuration, CMS and HTML block tables.
• Check which external domains your payment page loads (the browser’s Network tab).
• Compare the theme’s JS files with a clean copy.

Compare with the original

Download the official ZIP of your PrestaShop version and compare the core files. Any difference in classes/, controllers/ or src/ that does not come from a documented override is suspicious.

Obligations

If personal data has been exposed, the GDPR requires you to notify the Agencia Española de Protección de Datos (the Spanish data protection authority) within 72 hours and, if card data is involved, your payment provider. Check with your legal adviser.