How to Clean a Hacked PrestaShop Store and Remove Malicious Code

PrestaShop powers many online shops, and because it handles orders and payments, a compromise needs prompt, careful attention. The cleanup follows a dependable pattern: secure access, find and remove injected code, restore clean files, and patch the flaw that allowed it. Protecting your customers runs through every step.

Step 1: Secure and back up

Change your PrestaShop admin, cPanel, database and FTP passwords. Take a full backup of the current state before making changes.

Step 2: Hunt for injected code

Attackers commonly inject malicious PHP into modules and controllers, or JavaScript into checkout templates to skim payments. Scan the account — see scanning with Imunify360 — and check recently modified files, the modules and override folders, and the database for unfamiliar or encoded code.

Step 3: Restore or clean

• Restore a clean pre-infection backup if available.
• Clean manually by removing malicious files and replacing PrestaShop core files with official copies of your version, keeping your configuration and database.

Step 4: Review modules, admins and payment code

Outdated or nulled (pirated) modules are a frequent entry point — remove anything untrusted. Delete unknown admin accounts, and inspect checkout and payment code closely, as covered in removing a card skimmer.

Step 5: Update and harden

Update PrestaShop and every module to current versions, then follow the hardening checklist.

Frequently asked questions

Could a free "nulled" module have caused this?

Very possibly. Pirated modules and themes frequently contain hidden backdoors and are a leading cause of PrestaShop infections. Remove them and use only official, licensed extensions.

Was customer payment data at risk?

If you find skimming code in checkout, treat card data as potentially exposed and follow your payment provider's breach process and any legal notification requirements.

It got reinfected after I cleaned it.

A backdoor likely survived, or the original vulnerability is unpatched. Replace core files fresh, remove backdoors, update everything, and reset all passwords.