PrestaShop Hacked? Malware Removal & Recovery [2026]

A hacked PrestaShop store usually shows up as redirects to foreign sites, pop-up ads, strange scripts in the code or spam sent from the server. Malicious code in a store is not just an SEO problem — it is a customer data leak, a Google block and a loss of trust. Recovery takes more than deleting files: you have to find the entry point, clean the store, rotate every credential and harden the system. Malware removal with hardening: 800–2,500 PLN net, with individual quotes for complex cases.

Key takeaway: PrestaShop recovery after a hack in 7 steps: 1) isolate the store (offline mode, traffic block), 2) make a forensic copy before cleaning, 3) find the malicious code (file comparison, access logs, scanner), 4) identify the entry point (vulnerable module, old PrestaShop, weak password, backdoor), 5) clean and patch, 6) rotate passwords, API keys and secrets, 7) harden the store and set up monitoring. Deleting files without closing the gap = re-infection within days.

• ## Step 1: Isolate the store

Before you clean anything, cut the attacker's access

• enable offline mode (panel → Shop Parameters → Maintenance) or an IP block,
• if you have server access, restrict traffic to your own IP,
• do not delete anything yet — the attacker still has access and you need the data for analysis.

If the store sends spam or makes outbound traffic, notify your host — they can block the mailbox or limit traffic before you end up on blacklists.

• ## Step 2: Forensic copy

Before cleaning, make a copy of the ENTIRE environment: files and database. This is not a restore copy (it is infected) — it is evidence for analysis:

• you will compare files against a clean installation of the same version,
• you will see exactly what was changed and when,
• in case of escalation (data leak, customer claims) you will have incident documentation.

Keep the copy off the production server.

• ## Step 3: Find the malicious code

The most effective method is comparison against a clean installation

1. download a clean version of your PrestaShop (e.g. 8.1.x) from the official site,
2. compare the modules/, themes/, override/ directories and the main files,
3. review every file that differs from the original; new .php files in img/, upload/, var/ directories are almost always backdoors,
4. additionally scan the store with a malware scanner (e.g. maldet, your host's scanner).

Look for typical traces

• encoded strings base64_decode, eval(, gzinflate, preg_replace with /e,

• hidden iframes and scripts in theme files (header.tpl, footer.tpl),

• .htaccess entries redirecting traffic (e.g. by Googlebot user agent),

• unknown cron jobs and administrator accounts.

• ## Step 4: Identify the entry point

Without finding the gap the store will be re-infected. The most common entry points

Review access logs from recent weeks: unusual POST requests to .php files in modules/, admin/ or upload directories are a classic exploitation trace.

• ## Step 5: Clean and patch

Clean deliberately

• remove the malicious files and injections found, but note the paths first,

• restore files modified by the attacker from a clean installation,

• update PrestaShop to the latest supported branch,

• update or remove modules from the vulnerability list,

• fix theme files; if the infection was extensive, upload a clean theme,

• - check the database: malicious scripts can live in ps_configuration (e.g. injected code in header/footer), in product descriptions and in the ps_hook table.

After cleaning, scan the store again — a second pass catches what the first missed.

• ## Step 6: Rotate every credential

Assume every secret in the store is in the attacker's hands

• - change passwords: admin panel (all accounts), FTP/SFTP, SSH, database, hosting,

• - change API keys: payment modules, carriers, marketplaces, SMTP,

• invalidate and regenerate keys: cookie_key in config/settings.inc.php / .env, the encryption key,

• remove unknown administrator accounts and review the permissions of the remaining ones,

• check cron jobs and webhooks — attackers leave themselves ways back in.

• ## Step 7: Harden and monitor

After the recovery, close the whole class of problems

• keep PrestaShop and modules updated (on staging, with tests),
• enable 2FA for the panel and restrict admin access by IP,
• set up backups off the server — preferably with a restore test,
• enable file monitoring (alerts on changes in store directories),
• add security headers and harden .htaccess,
• watch Google Search Console — after an infection you may receive a malware warning and drop in results.

Warning: A "This site may be harmful" warning in Google or a browser block will not disappear on its own after cleaning. Once the code is removed, request a review in Google Search Console (Security → Request Review).

How long it takes and what it costs

A typical scenario (a few infected files, a known gap) is 4–8 hours of work. An extensive infection with database backdoors and data theft takes 1–3 days. The cost from a specialist: 800–2,500 PLN net for malware removal with hardening. Ongoing security care with monitoring and backups: PrestaShop technical help.

Frequently asked questions

My store redirects to foreign sites — is it hacked?

Most likely yes. Redirects (often only for Google traffic or on mobile) are a classic symptom of malicious code in the theme or .htaccess. Isolate the store, make a forensic copy and follow the cleaning procedure — starting with a file comparison against a clean installation.

Is deleting the malicious files enough?

No. Without closing the gap (module update, password change, API key rotation) the attacker will return — backdoors and stolen credentials remain active. Cleaning without credential rotation is half the job.

Will I lose Google rankings after a hack?

Briefly, you may lose visibility if Google flags the store with a malware warning. After cleaning, request a review in Search Console — once verified, the warning disappears and rankings return within days to weeks. A fast response minimises the losses.

How do I protect PrestaShop from another hack?

Keep the core and modules updated, enable 2FA and IP restrictions for the panel, keep backups off the server, monitor file changes and learn from the logs. Outdated modules and old PrestaShop versions remain the most common vectors. More: PrestaShop support.

Sources and tools

• OWASP — Top 10 most common vulnerabilities
• PrestaShop — security advisories
• Google Search Console — security and manual actions
• CERT Polska — incident reporting

👉 Suspect your store has been hacked? Isolate it and get in touch for diagnostics — contact form or kontakt@informatix.com.pl. See also the full failure overview: PrestaShop help.

📖 See also: PrestaShop 500 error, post-update problems and PrestaShop support.