Skip to content
Hacked PrestaShop repair

Hacked PrestaShop: the checkout first, then everything else.

In short

If your PrestaShop store has been hacked, check the checkout first, because a skimmer can be copying card details while the store keeps selling as usual. At WebIntacta I (Jose Soriano, a PrestaShop developer) clean the store, remove the skimmer, check overrides and modified modules, close the module or password they got in through and give you the technical report a breach notification needs. It costs €349 ($349 outside the EU), excluding VAT, with a 90-day guarantee, for PrestaShop 1.6 to 9, in English by email and chat.

Reviewed by Jose Soriano ·

In an online store, the attack that does the most damage is the one you can't see: a script in the checkout that copies your customers' cards while the store keeps selling as usual. I work with PrestaShop every day and I know where it hides.

Get help nowFree scan first

Mark it as urgent in the request and your case goes first.

How I fix it

In this order, and for a reason.

  1. STEP 01

    Stop the leak

    If there is a skimmer, the first thing is to pull it out of the checkout, even if that means taking a payment method offline for a while. Every hour it stays active means more stolen cards.

  2. STEP 02

    Core and module integrity

    I compare every file with the original for your PrestaShop version and go through overrides, modules and templates. Whatever was modified gets replaced or fixed.

  3. STEP 03

    Way in and access

    I find the vulnerable module or the leaked credential, update or replace it, change the keys in parameters.php and review the back-office employees.

  4. STEP 04

    Customers, bank and GDPR

    If data was stolen, I explain what usually has to be notified (under the GDPR or the UK GDPR, your data protection authority within 72 hours; elsewhere, your local breach rules) and what to tell your payment provider. The decision and the notification are yours; I give you the technical report they need.

Hacked PrestaShop store: skimmer, malware and the way in

Credit card skimmer on PrestaShop: what to check first

  1. Make a test purchase without being logged in, in a private window and on a phone. A card form you did not add, an error before the real payment page or an extra step are the classic signs of a fake payment form.
  2. Open the theme's shared header, themes/your-theme/templates/_partials/head.tpl, and the checkout templates. According to Sansec, PrestaShop warned merchants in January 2026 to check their theme template files for injected skimmers, and Sansec recommends starting with this file.
  3. Search the database for script tags: a <script> stored in the configuration table, or in an HTML block or custom code module, can run a skimmer that never appears in the files.
  4. Compare the core and the payment modules with the originals for your exact version, and list the files in override/.
  5. If you find something, don't delete it yet: disable the payment method or put the store in maintenance mode, take a copy and write to me. The copy shows how they got in and since when.

Each check, with what the code usually looks like and why it hides from logged-in admins, is in credit card skimmer on your website: how to detect it.

Not only PrestaShop

What I describe here applies to any hacked online store, not just PrestaShop: in WooCommerce the skimmer hides in a plugin or in the database, and in PrestaShop it usually lives in an override, a modified payment module or the theme settings.

How card theft at checkout works, how to detect it and what to do about affected customers is in the guide to credit card skimming in online stores. If personal data was affected, the GDPR side is in data breach in an online store.

If you want to know what to do in the first hour, before hiring anyone, read PrestaShop hacked: what to do. And if the source is a module with a published flaw, in vulnerable PrestaShop modules I explain how to check yours.

Price

What it costs.

Stores cost more than a business website: there are payment modules, overrides, a bigger database and customer data.

PrestaShop or WooCommerce cleanup

Stores: on top of the malware, checkout, overrides and customer data.

€349

excluding VAT$349 outside the EU

  • With priority+€100Your case goes ahead of every other job, weekends too if needed. It is priority, not a guaranteed deadline.+$100 outside the EU
  • Everything in the WordPress cleanup
  • Checkout: skimmers and fake payment forms
  • Modified overrides, modules and templates (PrestaShop)
  • Guidance on breach notification (GDPR) if data was affected
  • 90-day guarantee: if it gets reinfected, I clean it again at no cost.
OrderPay now by card (EUR)

Store rescue

Store cleanup with priority + 3 months of Online store maintenance with the Priority add-on.

€649

excluding VAT$589 outside the EU

  • PrestaShop or WooCommerce cleanup with priority
  • 3 months of Online store maintenance
  • 3 months of the Priority add-on
  • Afterwards it moves to the plan's normal fee; you can cancel it.
OrderPay now by card (EUR)

Outside the EU, the same remote cleanup for a hacked PrestaShop store costs $349. All prices

Questions

What people usually ask me.

How much does it cost to clean a hacked PrestaShop store?

€349 for the store cleanup, and +€100 if you want it with priority, excluding VAT, with a 90-day guarantee. The Store rescue pack (€649) adds three months of Online store maintenance with the Priority add-on.

How do I know if card details are being stolen?

The most reliable sign is your bank or payment provider warning you about fraud on purchases made in your store. Technically, you see a payment form or a script that doesn't belong to the official payment module. The free scan checks the visible scripts; the inside report checks files and the database.

Do I have to close the store?

Not always. If there is an active skimmer, sometimes it is enough to disable the affected payment method while it is being cleaned. We decide based on what I find in the diagnosis.

Do you work with PrestaShop 1.6, 1.7, 8 and 9?

Yes. On 1.6 the cleanup is possible, but that version no longer gets patches: I will suggest how to upgrade so it doesn't happen again.

What about the GDPR?

If personal data was affected and your store is subject to the GDPR or the UK GDPR, the controller (you) must notify the data protection authority within 72 hours of becoming aware of it, and the people affected if the risk is high. Outside Europe, local breach laws apply (in the US, state by state). I give you the technical report with which data and since when; for the legal side, check with your adviser.

My store is not in Spain. Can you still help, in English?

Yes. I work remotely with stores in any country, in English by email and chat (no phone calls), so everything stays in writing. Customers outside the EU pay $349; EU businesses with a VAT number are invoiced from Spain under the reverse-charge rule.

Contact

Tell me what is happening.

Send me the site and what you have seen. If you mark it as urgent, I read it before the rest. I reply with what I would do and a fixed price before touching anything.

I answer myself, as soon as I can and in order. Anything marked urgent goes first. Support in English is by email and chat.

Support request

Open a request with its own private link

  • Your website address and what you have seen (or what you want to hire)
  • If the site is hacked right now, mark it as urgent and I will read it first
  • I reply with the next steps and, if needed, a fixed quote before touching anything
Write to me

Is your website intact? Check it now.

Free external scan. No sign-up and nothing to install.

Get the PDF result and 30-day alerts (optional)

Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.

  • No FTP access
  • Read-only
  • No customer data

Cookie preferences