How to Remove a Credit Card Skimmer (Magecart) from Your Store

A Magecart attack plants a hidden JavaScript "skimmer" on your checkout that quietly copies customers' card details as they type — sending them to the attacker while the order completes normally. It is one of the most damaging ecommerce infections because it steals payment data directly. Finding and removing it fast is essential.

Warning signs

• Customers report fraud after shopping with you.
• Your payment processor or bank flags your store as a common point of compromise.
• Unfamiliar scripts load on your checkout page.

Step 1: Contain immediately

Consider putting checkout into maintenance mode to stop further data capture. Change your admin, cPanel, database and FTP passwords, and rotate payment-gateway API keys. Take a full backup.

Step 2: Inspect the checkout

Skimmers hide in the code that runs at checkout:

• Checkout theme and template files — look for injected or obfuscated scripts.
• The database — some skimmers are stored there; see removing malware from the database.
• Third-party or externally-loaded scripts calling unknown domains.

Run a malware scan, and view the checkout page source to spot scripts loading from domains you do not recognise.

Step 3: Remove and rebuild clean

Remove the skimmer, replace affected files with clean official copies, and remove any backdoor. Restoring a clean pre-infection backup is often safest for a store.

Step 4: Meet your obligations

If card data may have been captured, follow your payment processor's breach procedures and notify affected customers as legally required. This is a core part of responsible recovery, not an optional extra.

Step 5: Harden the store

Patch your platform and extensions, remove nulled software, add a web application firewall, and follow the hardening checklist.

Frequently asked questions

How do skimmers get onto a store?

Usually through an unpatched platform vulnerability, a compromised extension (often nulled software), or stolen admin credentials. Attackers then inject the skimming script into checkout.

Do I have to notify customers?

If payment or personal data may have been exposed, notification is typically both ethical and legally required. Follow your payment processor's rules and applicable data-protection laws.

How can I prevent it recurring?

Patch promptly, avoid nulled extensions, monitor checkout for unexpected scripts, use a WAF, and scan regularly. Skimmers rely on unnoticed access, so active monitoring is your best defence.