Detecting credit card skimmers in PrestaShop stores
A skimmer copies card data while the customer pays. The store works and orders come in, so it is often noticed only through customer complaints.
The code sits in a template, not in a PHP file.
On 17 February 2026 PrestaShop warned stores about a loader hidden in head.tpl: a base64-encoded address, fetched with XMLHttpRequest and run with Function.
In July 2022 an SQL injection let attackers create blm.php in the store root and insert a fake payment form into the checkout.
Signatures built on published incidents.
Templates included
The scan also reads
.tpland.twigfiles, besides PHP and JavaScript.Loader structure
We look for the encoded address, the request and the execution of the response together: a lone
atoborXMLHttpRequestis not enough.New files
A PHP file in the root or an unknown module shows up at the next scan; if it holds an executable call, the alert is critical.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Do you catch every skimmer?
No. Signatures cover documented structures. Variants obfuscated differently can slip through, and core integrity remains the second line.
Do you read whole files?
We read the first MiB of each checked file, without running it and without opening the addresses it contains.
Goes well with
- PrestaShop core file integrity checksComparison with the official package, renamed admin folder included.
- Security and backups for the stores still on PrestaShop 1.7Stores on 1.7.6, 1.7.7 and 1.7.8 with PHP 7.1-7.4, upgrades up to 8 tested.
- PHP malware in the uploads folder: how to find it quicklyPHP in uploads, including names like .php.jpg, and suspicious files.
- PrestaShop store monitoring and security for web agenciesA native PrestaShop module that checks store core, templates and modules.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.