# Upgrading PrestaShop (1.7 → 8 → 9) without breaking the store

> How to upgrade PrestaShop from 1.7 to 8 and from 8 to 9: PHP per version, modules and overrides, Update Assistant or manual, staging and a rollback plan.

URL: https://webintacta.com/en/guides/upgrade-prestashop
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** You cannot jump from PrestaShop 1.7 straight to 9, because no PHP version works with both: you move to 8.2 on PHP 7.4, raise PHP to 8.1 and then upgrade to 9. Before that, take an inventory of modules and overrides, test on a staging copy, check the checkout and have a rollback plan. The requirements were checked against the official PrestaShop documentation in October 2026.


By Jose Soriano (WebIntacta) · published 2026-10-24

Upgrading PrestaShop is intimidating, and rightly so: a store with twenty third-party modules and a handful of overrides can break at checkout without warning. But staying on a version that no longer gets patches is worse. This is how I approach it, with the requirements checked against the official documentation as of October 2026.

## Why upgrading is a security matter

Every PrestaShop release fixes flaws that are then published with their identifier. For example, in August 2026 **8.2.8 and 9.1.5** came out together with five security advisories, among them an SQL injection in the back-office list filters and an SSRF in the CSV import ([PrestaShop security advisories](https://github.com/PrestaShop/PrestaShop/security/advisories)). From the moment they are published, anyone can read what was wrong.

And some versions no longer get fixes at all. According to the PrestaShop team, the 1.7.8 branch stopped being maintained when PrestaShop 9.0.0 was released (June 2025); the last 1.7 version is 1.7.8.11, from January 2024. The 8.2 branch is in extended support, which [will end when PrestaShop 10.0.0 comes out](https://build.prestashop-project.org/news/2025/82x-extended-support-phase/). If you are on 1.6 or 1.7, every new flaw that is discovered will stay open in your store.

Upgrading does not fix everything: third-party modules have their own flaws and are updated separately. The best-known ones are listed in [PrestaShop modules with vulnerabilities](https://webintacta.com/en/guides/vulnerable-prestashop-modules). And if you suspect the store is already compromised, do not upgrade on top of it: first [check and clean it](https://webintacta.com/en/guides/prestashop-hacked-what-to-do), because an upgrade does not remove a backdoor or a malicious override. The [free scan](https://webintacta.com/en/free-website-security-scan) tells you from the outside which version it detects and which visible modules have published flaws.

## Which version you should move to

Check your version under **Advanced Parameters → Information** in the back office (or in the corner of the dashboard). Then:

- **1.6.x**: first you have to move to 1.7 with version 4.14.3 of the upgrade module (the last one that supports 1.6), and continue from there. It is a big jump: the theme changes completely and many modules have no equivalent. Often a migration (fresh install plus data transfer) makes more sense than an upgrade.
- **1.7.x**: the goal is to reach 8.2 and then 9. Below I explain why it is almost always two steps.
- **8.0 or 8.1**: upgrade to the latest 8.2 and plan the move to 9.
- **8.2.x**: apply the latest patch (8.2.8 as of this guide) and plan the move to 9 calmly.
- **9.x**: stay on the latest patch of your branch. 9.2.0 was released on September 30, 2026.

## Requirements: the PHP version decides

The requirement that constrains you most is **PHP**. According to the official requirements tables for [1.7](https://devdocs.prestashop-project.org/1.7/basics/installation/system-requirements/), [8](https://devdocs.prestashop-project.org/8/basics/installation/system-requirements/) and [9](https://devdocs.prestashop-project.org/9/basics/installation/system-requirements/):

| PrestaShop | Supported PHP | Recommended |
| --- | --- | --- |
| 1.7.7 | 7.1 to 7.3 | 7.3 |
| 1.7.8 | 7.1 to 7.4 | 7.4 |
| 8.0, 8.1 and 8.2 | 7.2 to 8.1 (7.2 not recommended) | 8.1 |
| 9.0 | 8.1 to 8.4 | 8.4 |
| 9.1 | 8.1 to 8.5 | 8.5 |
| 9.2 | 8.1 minimum | see the official table |

Source: requirements tables in the official PrestaShop 1.7, 8 and 9 documentation (checked on October 8, 2026). For 9.2, the minimum comes from its composer.json; the official table is updated with each release.

For 8 and 9 you also need at least **MySQL 5.7 or MariaDB 10.2**, Apache 2.4 or Nginx, and for 9 a `memory_limit` of at least `512M` is recommended. The usual PHP extensions (cURL, DOM, GD, Intl, Mbstring, Zip, PDO MySQL…) come with most hosting plans, but check.

> Notice the gap: 1.7.8 goes up to PHP 7.4 at most, and the 9 series starts at PHP 8.1. There is no PHP version that runs both 1.7 and 9. That is why, in practice, you go from 1.7 to 8.2 (which runs on PHP 7.4), then raise PHP to 8.1, and then move to 9.

> PHP 8.1 is only an intermediate step: since October 2026 it has critical flaws with no official fixed release ([PHP2Shell](https://webintacta.com/en/guides/php2shell-vulnerability)). Do it on a staging copy and, once on PrestaShop 9, move to PHP 8.3 or 8.4 on their fixed releases.

The upgrade module does this math for you: it only offers the highest version compatible with the PHP the server is running at that moment.

## Inventory of modules and overrides

This is the step most stores skip and the one that prevents the most problems. Before touching anything, make a list of:

- **Every third-party module**: technical name, installed version, where it came from (Addons, another vendor, custom) and whether the author publishes a version compatible with your target version. The ones that do not are your biggest risk.
- **Modules you do not use**: uninstall and delete them before upgrading. Fewer things to migrate and less attack surface.
- **Overrides**: everything in `override/classes/` and `override/controllers/`. Each one modifies a core class that may have changed in the new version. Note which module or developer created each one.
- **The theme**: if it is a purchased theme, whether the author has a version for 8 or 9; if it is a child of the default theme, which templates it overrides.
- **Changes made directly in the core** (files in `classes/` or `controllers/` edited by hand). The upgrade overwrites them without warning. Comparing the core with the original of your version is the only way to know.

From the command line, the upgrade module itself has a command that lists the modules that need some action before or during the upgrade (you will see it below).

## Update Assistant or manual

### Update Assistant (the autoupgrade module)

The official upgrade module, technical name `autoupgrade`, is now called **Update Assistant** (for years it was "1-Click Upgrade"). Its current versions work for any store from 1.7 on. You install it from the back-office Marketplace, from Addons or from [GitHub](https://github.com/PrestaShop/autoupgrade), and it works in two ways:

- **From the back office**, with a wizard: pick the version (it suggests the recommended one for your PHP), review the requirements (blockers show in red), choose options and backup, and start the upgrade.
- **From the command line**, which I recommend for large stores because it does not depend on browser or web server time limits.

The main commands, run from the module folder (`modules/autoupgrade`), according to its official documentation:

```
# Does the server meet the requirements?
php bin/console update:check-requirements your-admin-folder

# Modules that need some action
php bin/console update:check-modules your-admin-folder

# Versions available for this store
php bin/console update:check-new-version your-admin-folder

# Backup and upgrade
php bin/console backup:create --config-file-path=config.json your-admin-folder
php bin/console update:start --config-file-path=config.json your-admin-folder
```

Options worth understanding: **disable non-native modules** (on by default; according to the documentation, from PrestaShop 9 on this option is ignored), **regenerate email templates** (on by default; you will lose any customizations you have) and **disable all overrides** (off by default). The backup can be full, without images or none; if you choose none, the backup is up to you.

### Manual

The official documentation only describes the manual upgrade (replacing files and running the database upgrade scripts by hand) for jumps within 1.7, from 1.7.0 to 1.7.8, and recommends the Update Assistant for everything else. When someone asks me to "upgrade PrestaShop manually" to 8 or 9, in practice it means one of two things:

- Using the Update Assistant **from the command line** with a downloaded package (the `local` channel, with the version's `.zip` and `.xml` in `your-admin-folder/autoupgrade/download`). It is the most controlled option.
- **Migrating**: installing the new version clean and moving over the catalog, customers and orders. It is more work, but it leaves behind years of old modules and overrides. It makes sense from 1.6 or for heavily patched stores.

## Staging and checkout testing

I never upgrade directly in production. The order:

1. **A copy of the store on a subdomain or test server**, with the same PHP version production will have. Password-protect it and turn off customer emails and the live mode of the payment gateways (use their test modes).
2. **Upgrade the copy** following the plan: remove the modules you do not need, update the third-party ones to compatible versions, run the Update Assistant.
3. **Go through the [official post-update checklist](https://devdocs.prestashop-project.org/9/basics/keeping-up-to-date/update/post-update-checklist/)** and clear the cache.
4. **Test the full purchase flow** with every payment and shipping method: customer sign-up, cart, coupons, payment, confirmation email, PDF invoice, order status change in the back office.
5. **Check the logs**: `var/logs/` and the PHP error log. Deprecation notices usually point to the module that will fail.
6. Only when all of that comes out clean, **repeat in production** during a low-sales window, with the store in maintenance mode.

## Rollback plan

Before you start in production, be clear on how to get back in minutes:

- **Your own full backup** (files and database), in addition to the module's. The module's backup is stored on the same server; yours, off it.
- **Restoring from the module**: the Update Assistant offers to restore its backup if the upgrade fails, from the back office, or with `php bin/console backup:restore --backup=NAME your-admin-folder` if you have lost access to the admin.
- **PHP**: if you raised the PHP version for the new release, note how to lower it in the hosting panel. The restored copy needs its old PHP.
- **Orders during the window**: if you restore the database, you lose the orders placed between the backup and the restore. That is why you upgrade with the store in maintenance mode.

## If you would rather I do it

I do PrestaShop upgrades with this same method: inventory, staging copy, test purchase and rollback plan. The online store maintenance plan (€69/month excluding VAT) includes a module review before every update and one hour of technical work per month; major version jumps are quoted separately depending on the store's modules. Details in [PrestaShop maintenance](https://webintacta.com/en/prestashop-maintenance). If you only want to know where your store stands before deciding, the [PrestaShop security audit](https://webintacta.com/en/prestashop-security) checks every module and version against the published advisories and the integrity of the core files, so you know what to fix first.

## Sources

- [PrestaShop 1.7](https://devdocs.prestashop-project.org/1.7/basics/installation/system-requirements/), [8](https://devdocs.prestashop-project.org/8/basics/installation/system-requirements/) and [9](https://devdocs.prestashop-project.org/9/basics/installation/system-requirements/) system requirements (official documentation).
- [Updating PrestaShop 9](https://devdocs.prestashop-project.org/9/basics/keeping-up-to-date/update/) and [updating from the back office](https://devdocs.prestashop-project.org/9/basics/keeping-up-to-date/update/update-from-the-back-office/).
- [The autoupgrade module (Update Assistant) on GitHub](https://github.com/PrestaShop/autoupgrade): commands, channels and options.
- [PrestaShop core security advisories](https://github.com/PrestaShop/PrestaShop/security/advisories) and [published releases](https://github.com/PrestaShop/PrestaShop/releases).
- [PrestaShop 1.7.8 in extended support](https://build.prestashop-project.org/news/2023/178-in-extended-support-phase/) and [8.2.x in extended support](https://build.prestashop-project.org/news/2025/82x-extended-support-phase/).

## Frequently asked questions

### Can I upgrade PrestaShop 1.7 directly to 9?

In practice, no: 1.7.8 runs on PHP 7.4 at most and PrestaShop 9 needs PHP 8.1 or later. The usual path is 1.7 to 8.2, then PHP up to 8.1, then 9.

### How do I upgrade PrestaShop 1.7 to 8?

With the official Update Assistant module, after checking that your third-party modules have versions compatible with 8, reviewing the overrides and testing everything on a copy of the store. On PHP 7.4, the module will offer you the latest 8.2.

### What PHP version does PrestaShop 9 need?

PHP 8.1 at least. According to the official table, 9.0 supports 8.1 to 8.4 and 9.1 supports 8.1 to 8.5. Check the requirements table before changing the server's PHP.

### Will I lose my modules when I upgrade?

They are not deleted, but the incompatible ones may be disabled or stop working. That is why you take an inventory first and test them on a copy.

### Does 1-Click Upgrade still exist?

It is the same official module (autoupgrade), now called Update Assistant. You use it from the back office or from the command line.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos