PrestaShop security checklist for 2026

Most of the hacked stores we see were not the victims of a sophisticated attack, but of something left unpatched for months or a reused password. This is the list we go through with our clients.

Software

• PrestaShop on a supported version with the security patches applied.
• PHP on a version that still receives security support.
• Modules up to date, especially those that expose public controllers (payments, importers, forms).
• Modules you do not use: uninstalled and their folder deleted. A disabled module still has its files accessible.

Back office

• Admin folder with a non-obvious name (PrestaShop renames it on installation; do not change it to “admin”).
• Two-factor authentication for every employee.
• One user per person, with the minimum profile they need. No shared accounts.
• Long, unique passwords, kept in a password manager.
• Lockout after failed login attempts.

Server and files

• HTTPS across the whole site.
• Correct permissions: 755 for folders, 644 for files; nothing at 777.
• PHP execution blocked in upload folders (upload/, img/, download/).
• No backup files, SQL dumps or ZIPs in the public root.
• Debug mode disabled.

Backups

• Daily backups of database and files, stored off the server.
• At least one test restore a year: a backup that has never been tested is not a backup.

Monitoring

• Alerts when core files change or new .php files appear.
• Regular review of employees, Webservice keys and active integrations.
• Web application firewall (WAF) and bot rate limiting.