In short
A PrestaShop security audit from WebIntacta costs €169 ($169 outside the EU), excluding VAT, and the external scan before it is free. I do it myself (Jose Soriano, a PrestaShop developer): I check every module in your store, disabled ones included, against the published advisories, and review overrides, core files and checkout scripts with a read-only connector, without asking for FTP access. You get a PDF report with a grade and a concrete action for each finding. It matters because most PrestaShop break-ins come through a third-party module with a published vulnerability, not through the core.
Reviewed by Jose Soriano ·
Most PrestaShop break-ins come through a third-party module with a published vulnerability, not through the core. Every module that isn't kept up to date is an open door. I check them one by one against the published advisories.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.
STEP 01
Platform, version, visible modules, exposed files, headers and reputation.
STEP 02
A module you install from the back office, no FTP needed, that lets me see the full inventory and the integrity of every file.
STEP 03
A PDF with the grade, the priorities and a concrete action for each module: update, patch or replace.
What I check first in a PrestaShop 8 or 9 store, and what you can check yourself from the back office or your hosting's file manager. Almost all of it applies to 1.7 too:
admin, admin1 or the name of the store, rename it to something that can't be guessed and clear the cache (var/cache/). It doesn't replace a good password, but it takes automated attacks out of the picture.install/ folder must not exist. PrestaShop asks you to delete it when the installation is done; if it's still there (or there's an install.zip or a copy of it), delete it._PS_MODE_DEV_ must be false in config/defines.inc.php (or "Debug mode: No" under Advanced Parameters → Performance). When it's on, it shows paths and errors to any visitor.app/config/parameters.php kept safe. It holds the database password and the cookie keys: it must not be downloadable from the internet, and there must be no copies such as parameters.php.bak or .old on the server.override/ should come from a module or from your developer; one nobody can explain is the first thing I look at.This is the most common way in. PrestaShop publishes core advisories in its GitHub repository, and the Friends of Presta association keeps a list of vulnerable third-party modules. I check your inventory against those sources, module by module and version by version, disabled ones included. If you want to check yours, I explain how in the guide to vulnerable PrestaShop modules. If the store already shows symptoms, go straight to hacked PrestaShop repair.
| Free external scan | PrestaShop security audit | Penetration test | |
|---|---|---|---|
| What it sees | What anyone sees from the internet: version, visible modules, exposed files, headers | The inside of the store through a read-only connector: every module and version, file integrity, overrides, employees, checkout scripts | How far an attacker gets, by actively attacking the store with permission |
| Access needed | None | A module installed from the back office; no FTP, no passwords | A contract and a test window |
| Result | A 0–100 grade and the issues visible from outside | A PDF report with priorities and an action per finding | A report of exploited weaknesses |
| Price | Free | €169 | Quoted by specialist firms; I don't do pentests |
For most small stores, the audit answers the useful question (what is vulnerable and what to fix first) without the cost of a pentest.
A store on 1.6 no longer gets patches, and an old 1.7 carries flaws that were fixed long ago. Upgrading isn't just pressing a button: modules, overrides and the theme need checking first, on a copy. How to plan it without breaking the cart, in the guide to upgrading PrestaShop.
The online store report includes a review of the checkout and payment. Its price is deducted if you sign up for a cleanup or maintenance within 30 days.
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
Free
No sign-up, no commitment
Everything in the website report, plus a review of checkout and the store's modules.
€169
excluding VAT$169 outside the EU
PrestaShop or WooCommerce: everything in the business website plan, plus checkout monitoring.
€69/month
excluding VAT$59/month outside the EU
The security report and the fix of what is urgent (up to 3 hours).
€299
excluding VAT$299 outside the EU
Outside the EU, the store report is $169 and the Online store maintenance plan $59/month. All prices
Guides
€169 for one store ($169 outside the EU), excluding VAT, with the PDF report and a walk-through of the results by email or chat. The price is deducted if you sign up for a cleanup or maintenance within 30 days.
Yes: I work with PrestaShop every day, from 1.6 to 9, and I handle English-speaking customers by email and chat (no phone calls), so every finding and decision stays in writing. I'm based in Spain and work remotely with stores in any country.
PrestaShop publishes core advisories in its GitHub repository, and Friends of Presta keeps a list of vulnerable third-party modules. I check your inventory against both sources and against other vulnerability databases.
Yes, and you should. But in stores with overrides or a modified theme, updating without testing can break the cart. On the maintenance plan I test on a copy first whenever possible.
No. It only runs when I ask it to from the dashboard with a signed request, and it doesn't run on your customers' visits.
Yes: it's exactly the riskiest case, because that version no longer gets patches. The report tells you what needs protecting right now and what migrating involves.
Free external scan. No sign-up and nothing to install.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.