How to Remove Malware from a Hacked OpenCart Store

OpenCart is a lightweight ecommerce platform, and a compromised OpenCart store needs the same careful handling as any shop that processes orders. Clean it in order: secure access, locate the malicious code, remove it, and patch the way in. Because payments are involved, protecting customer data is part of every step.

Step 1: Secure and back up

Change your OpenCart admin, cPanel, database and FTP passwords. Take a full backup before changing anything.

Step 2: Find the infection

Run a malware scan and inspect for recently modified files, unfamiliar PHP in the image, system or catalog folders, and injected scripts in templates. Also check the database for injected content, as OpenCart infections sometimes hide there.

Step 3: Restore or clean the files

• Restore a clean pre-infection backup where possible.
• Clean manually by removing malicious files and replacing OpenCart core files with official copies of your version, preserving your config.php, admin/config.php and database.

Step 4: Check extensions and admin users

Remove untrusted or nulled extensions and themes, delete unknown admin accounts, and review any modifications applied through the extension installer.

Step 5: Patch and harden

Update OpenCart and its extensions, secure the admin folder (renaming and protecting it is common practice), and follow the hardening checklist.

Frequently asked questions

Where do OpenCart infections usually hide?

Commonly in modified core or template files, uploaded PHP in image folders, and injected database rows. A thorough scan plus a manual check of these spots catches most of them.

Should I protect the admin directory?

Yes. Renaming the admin folder and adding directory password protection makes the admin far harder to attack, which is worthwhile after a cleanup.

The store keeps getting reinfected.

Look for a surviving backdoor and patch the original flaw. Replace core files fresh, remove any nulled extensions, and reset all credentials.