PrestaShop malware removal: hacked store, card skimmer in the checkout
Infected PrestaShop store? We clean it up, find how they got in and close the door.
PrestaShop malware removal at a fixed price: if your PrestaShop store has been hacked, sends customers to spam sites, is flagged by Google or, worse, has a skimmer in the checkout copying card details, we clean it up for €349. We look for the entry point and, when an update or a configuration change is enough, we close the hole too.
Why a store is a different target
An infected brochure site loses reputation; an infected store can lose its customers' payment details. Attacks on PrestaShop stores often aim exactly there: a small script injected into the checkout, the database or a payment module, sending elsewhere whatever the customer types. It doesn't slow the store down and throws no errors: for weeks nobody notices.
The most common ways in are modules with known vulnerabilities never updated, old PrestaShop versions, weak or reused back office passwords and admin folders left with the default name.
What we do
- Backup of the current state, before touching anything: it also helps reconstruct what happened.
- Finding the entry point: access logs, modified files, vulnerable modules, recently created accounts.
- Cleaning files and database: malicious code in modules, theme and upload folders; scripts injected into configuration tables and content, where skimmers often hide.
- Admins and access: removal of fake accounts, new passwords for back office, database and hosting.
- Closing the hole when updating or disabling a module, fixing a configuration or protecting the admin area is enough, within one hour of work.
- Google review and report: what we found, since when it was active, what we removed and what's left to do.
Price and terms
The job has a fixed price of €349 for one store, during office hours: Monday-Friday, 09:00-18:00. The same price applies to Joomla, Drupal and Magento sites; for WordPress there's WordPress malware removal.
If within 30 days the store is reinfected through the same hole we closed, we clean it again at no cost. If closing the hole takes more than an hour - an abandoned module to replace, custom code to fix - we stop and give you a quote, hourly (€75/hour), with hour packages or with the module adaptation from €180. All prices are on the PrestaShop pricing page.
A typical case
A sporting goods store receives three reports of odd charges in the same week. The store works normally, but in the configuration table we find a script that loads only on the payment page and sends the card form data to an external domain. The entry point is a product import module with a vulnerability known for two years and never updated. We remove the script, update the module, change every password and move the admin area to a non-default address. The report includes the date of the first change, useful to the client when talking to the payment provider.
After the cleanup
A store stuck on old versions stays exposed: the upgrade to PrestaShop 9 and the monthly maintenance in PrestaShop support keep core and modules up to date. If you'd like to know the store's condition before something happens, there's the check-up at €240.
Frequently asked questions
How can I tell if my PrestaShop store has been hacked?
The most common signs: customers reporting suspicious charges after a purchase, an extra card field or a payment page that looks different, redirects to spam sites, the browser's red warning, a Google Search Console security message, back office admins nobody created, new PHP files in module or image folders.
How much does PrestaShop malware removal cost?
The price is fixed: €349 for one store. It covers cleaning files and database, finding the entry point and closing the hole when an update or a configuration change within one hour of work is enough. The same price applies to Joomla, Drupal and Magento.
What if the store gets reinfected?
If within 30 days the reinfection comes through the same hole we closed, we clean it again at no cost. We don't promise it will never happen again: passwords reused elsewhere or another vulnerability remain possible, and anyone guaranteeing otherwise is selling a promise.
What if the hole can't be closed in an hour?
It happens when the entry point is an abandoned module to replace or custom code to fix. We stop, tell you what's needed and give you a quote first: hourly, with packages or with the module adaptation.
Do I have to notify anyone if card data was stolen?
If the checkout was compromised there may be obligations towards your payment provider and, for personal data, towards the data protection authority: under GDPR the notification is due within 72 hours of becoming aware of the breach, without waiting for the cleanup to finish, and it can be completed later. If card details may have been read, customers usually need to be told as well. The report states since when the infection was active and which data it could read, useful to complete the notification; the legal assessment stays with you or your advisers.
How long does it take to remove the Google warning?
After the cleanup we submit the review request from Google Search Console; review times depend on Google, usually from a few days to a few weeks. We need access to the Search Console property.
Other fixed-price fixes
Need a hand with your infrastructure?
Tell us the problem: we reply with a clear plan and a quote.