# PrestaShop security audit: the modules, the overrides and the checkout.

> PrestaShop 1.7, 8 and 9 security audit: vulnerable modules, core file integrity, employees and checkout scripts. Read-only connector, no FTP. PDF report €169.

URL: https://webintacta.com/en/prestashop-security
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-28

**In short:** A PrestaShop security audit from WebIntacta costs €169 ($169 outside the EU), excluding VAT, and the external scan before it is free. I do it myself (Jose Soriano, a PrestaShop developer): I check every module in your store, disabled ones included, against the published advisories, and review overrides, core files and checkout scripts with a read-only connector, without asking for FTP access. You get a PDF report with a grade and a concrete action for each finding. It matters because most PrestaShop break-ins come through a third-party module with a published vulnerability, not through the core.


Most PrestaShop break-ins come through a third-party module with a published vulnerability, not through the core. Every module that isn't kept up to date is an open door. I check them one by one against the published advisories.

## What I check in a PrestaShop store

- Version of the core and of every module, enabled or disabled, against the published security advisories
- Overrides (`override/`) and where they come from: a module, a developer or nobody knows
- Core files that don't match the originals for your version
- Debug mode (`_PS_MODE_DEV_`), the admin folder and the employees with access
- Scripts in the checkout and in the configuration (possible skimmers)
- Backups, exports and logs that can be downloaded from the internet

## How I do it

1. **Free external scan.** Platform, version, visible modules, exposed files, headers and reputation.
2. **Read-only connector.** A module you install from the back office, no FTP needed, that lets me see the full inventory and the integrity of every file.
3. **Report and plan.** A PDF with the grade, the priorities and a concrete action for each module: update, patch or replace.

## PrestaShop 8 and 9 security checklist

What I check first in a PrestaShop 8 or 9 store, and what you can check yourself from the back office or your hosting's file manager. Almost all of it applies to 1.7 too:

1. **An admin folder with its own name.** The installer renames it with random characters; if yours is called `admin`, `admin1` or the name of the store, rename it to something that can't be guessed and clear the cache (`var/cache/`). It doesn't replace a good password, but it takes automated attacks out of the picture.
2. **The `install/` folder must not exist.** PrestaShop asks you to delete it when the installation is done; if it's still there (or there's an `install.zip` or a copy of it), delete it.
3. **Debug mode off.** `_PS_MODE_DEV_` must be `false` in `config/defines.inc.php` (or "Debug mode: No" under Advanced Parameters → Performance). When it's on, it shows paths and errors to any visitor.
4. **No 777 permissions.** Files at 644 and folders at 755 is the usual baseline; only the folders PrestaShop needs to write to (cache, images, uploads) should be writable. A 777 lets any process on the server modify your code.
5. **`app/config/parameters.php` kept safe.** It holds the database password and the cookie keys: it must not be downloadable from the internet, and there must be no copies such as `parameters.php.bak` or `.old` on the server.
6. **One employee account per person, with only the profile they need.** Delete the accounts of people who no longer work with you, and don't share the SuperAdmin account.
7. **Back-office cookie.** Under Advanced Parameters → Administration, turn on the cookie IP address check and shorten its lifetime (480 hours by default).
8. **Modules you don't use: uninstalled and deleted.** Disabling isn't enough: a disabled module's code is still on the server and may be reachable by URL.
9. **Overrides with a known origin.** Every file in `override/` should come from a module or from your developer; one nobody can explain is the first thing I look at.
10. **A supported PHP version.** PrestaShop 8 runs up to PHP 8.1, which no longer gets security patches; PrestaShop 9 supports PHP 8.1 to 8.4 (9.0) or to 8.5 (9.1). If your store is on 8, plan the move.

## Modules with published vulnerabilities

This is the most common way in. PrestaShop publishes core advisories in its GitHub repository, and the Friends of Presta association keeps a list of vulnerable third-party modules. I check your inventory against those sources, module by module and version by version, disabled ones included. If you want to check yours, I explain how in the [guide to vulnerable PrestaShop modules](https://webintacta.com/en/guides/vulnerable-prestashop-modules). If the store already shows symptoms, go straight to [hacked PrestaShop repair](https://webintacta.com/en/hacked-prestashop-repair).

## Security audit, free scan or penetration test?

|   | Free external scan | PrestaShop security audit | Penetration test |
| --- | --- | --- | --- |
| What it sees | What anyone sees from the internet: version, visible modules, exposed files, headers | The inside of the store through a read-only connector: every module and version, file integrity, overrides, employees, checkout scripts | How far an attacker gets, by actively attacking the store with permission |
| Access needed | None | A module installed from the back office; no FTP, no passwords | A contract and a test window |
| Result | A 0–100 grade and the issues visible from outside | A PDF report with priorities and an action per finding | A report of exploited weaknesses |
| Price | Free | €169 | Quoted by specialist firms; I don't do pentests |

For most small stores, the audit answers the useful question (what is vulnerable and what to fix first) without the cost of a pentest.

## Upgrading PrestaShop is security too

A store on 1.6 no longer gets patches, and an old 1.7 carries flaws that were fixed long ago. Upgrading isn't just pressing a button: modules, overrides and the theme need checking first, on a copy. How to plan it without breaking the cart, in the [guide to upgrading PrestaShop](https://webintacta.com/en/guides/upgrade-prestashop).

## Price

The online store report includes a review of the checkout and payment. Its price is deducted if you sign up for a cleanup or maintenance within 30 days.

### External scan — Free
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
- Platform and version (WordPress, PrestaShop, WooCommerce, Shopify…)
- Visible plugins and modules with published flaws
- Files that should not be public (backups, .git, configuration files)
- HTTPS, certificate and security headers
- Domain email (SPF, DKIM, DMARC) and blocklists
- AI agent readiness (scored separately)

### Security report · online store — €169 (excluding VAT)
Everything in the website report, plus a review of checkout and the store's modules.

$169 outside the EU.
- Everything in the business website report
- Skimmers: scripts that copy cards at checkout
- Modified overrides and payment modules
- Database: scripts injected into content and settings

> Fully credited if you hire a cleanup or maintenance within 30 days.

### Maintenance · Online store — €69/month (excluding VAT)
PrestaShop or WooCommerce: everything in the business website plan, plus checkout monitoring.

$59/month outside the EU.
- Everything in the Business website plan
- Daily scan and file integrity monitoring with the connector
- Module review before updating (on a staging copy when possible)
- Monthly test purchase
- 1 hour of technical work a month
- Cleanup included if it gets infected (from the 3rd month)

> No minimum term. Annual payment: 10 months.

**+ Priority add-on: +€25/month** (+$19/month outside the EU). Your issues go to the front of the work queue and, if you get hacked, the cleanup gets priority at no extra cost.

### Report + hardening — €299 (excluding VAT)
The security report and the fix of what is urgent (up to 3 hours).

$299 outside the EU.
- Full security report
- Fix of the urgent findings, up to 3 hours of work
- A new scan to confirm it

> Tienda online: 389 € (389 US$ en Latinoamérica).

Outside the EU, the store report is $169 and the Online store maintenance plan $59/month.

## Frequently asked questions

### How much does a PrestaShop security audit cost?

€169 for one store ($169 outside the EU), excluding VAT, with the PDF report and a walk-through of the results by email or chat. The price is deducted if you sign up for a cleanup or maintenance within 30 days.

### Is there a PrestaShop security specialist who works in English?

Yes: I work with PrestaShop every day, from 1.6 to 9, and I handle English-speaking customers by email and chat (no phone calls), so every finding and decision stays in writing. I'm based in Spain and work remotely with stores in any country.

### Where are PrestaShop module vulnerabilities published?

PrestaShop publishes core advisories in its GitHub repository, and Friends of Presta keeps a list of vulnerable third-party modules. I check your inventory against both sources and against other vulnerability databases.

### Can I update the modules myself?

Yes, and you should. But in stores with overrides or a modified theme, updating without testing can break the cart. On the maintenance plan I test on a copy first whenever possible.

### Does the connector slow down the store?

No. It only runs when I ask it to from the dashboard with a signed request, and it doesn't run on your customers' visits.

### My store is on PrestaShop 1.6. Is it worth it?

Yes: it's exactly the riskiest case, because that version no longer gets patches. The report tells you what needs protecting right now and what migrating involves.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en