How to Clean a Hacked WooCommerce Store (Card Skimmers & Malware)

WooCommerce runs on WordPress, so a hacked WooCommerce store combines WordPress cleanup with the extra care an online shop demands. The priority is finding any payment skimmer stealing card details at checkout, removing all malware, and securing customer data. Here is how to do it safely.

Step 1: Contain and protect customers

Change your WordPress admin, cPanel, database and FTP passwords, and reset any payment-gateway API keys. Take a full backup. If checkout was compromised, follow your payment processor's breach guidance and notify customers as required.

Step 2: Look for a card skimmer

Skimmers inject JavaScript into the checkout to capture card details. This is the same threat covered in removing a Magecart skimmer — inspect checkout-related theme files, plugins, and the database for unfamiliar scripts and encoded code.

Step 3: Scan and clean WordPress

Run a scan with Wordfence and Imunify360. Then follow the full WordPress process in recovering a hacked WordPress site — reinstall core, replace themes and plugins with clean copies, and remove malicious files.

Step 4: Audit users, plugins and orders

Remove admin accounts you did not create, delete nulled or unused plugins, and review recent orders and settings for tampering.

Step 5: Harden the store

Keep WordPress, WooCommerce and all plugins updated, secure your login, and complete the hardening checklist.

Frequently asked questions

How do I know if my checkout was skimmed?

Look for injected JavaScript in checkout pages, theme files or the database. If you find it, assume card data may have been captured and follow breach-notification requirements.

Do I need to tell my customers?

If payment or personal data may have been exposed, notifying affected customers is usually both the right thing to do and legally required. Check your obligations and your payment processor's rules.

Which scanner should I use?

Use both a WordPress plugin scanner like Wordfence and a server-side scanner like Imunify360 — each catches things the other may miss, which matters most on a store.