Security checks for PrestaShop stores

A PrestaShop store handles payments and customer data. A few settings left from installation day are enough to open the way for an attack.

Start the 30-day trial How it works

Installation-day settings stay for years.

The install folder copied as install_old, a back office folder with an easy name, SuperAdmin accounts whose password is still stored the PrestaShop 1.6 way.

The 2022 attacks (CVE-2022-36408) switched the template cache to MySQL through an SQL injection, then ran code. It is a setting you can check in a moment.

What we check.

Files and folders
The install folder or copies of it on the server, a back office folder that is easy to guess.
Settings
Template cache in MySQL, HTTPS not used on every page, back office sessions not tied to the IP address, debug options that disable modules or overrides.
Accounts
Too many SuperAdmins, unused SuperAdmins or SuperAdmins with passwords stored as MD5.

Want to try it on a real site? The 30-day trial needs no credit card.

Start free trial

Frequently asked questions

From which version?

The checks cover PrestaShop 1.7.6 to 9, with agent 0.23.0 or later.

Do you look for card skimmers too?

Yes, through file and template integrity: see the page on credit card skimmers on PrestaShop.

All 69 features

Try it on your clients' sites.

Connect your first sites today and see what SitePing finds on them.

Every Complete feature except backups
Up to 10 sites
No credit card needed to start
At the end you choose a plan or move to Free, and nothing is charged

Start the 30-day trial

Already have an account? Log in. Prefer to look at one site first? Free read-only audit.

Security checks for PrestaShop stores

Files and folders

Settings

Accounts

Try it on your clients' sites.