Shopping Cart
How secure is your shop? Find out now, for free.
An external security test only sees what is visible from the outside. Many PrestaShop shops, however, are vulnerable from the inside: an old module version with a known bug, a log folder anyone can download order data from, a backup forgotten in the web root, a debug mode left switched on.
WSC Security Check looks at the shop from the inside: the PrestaShop and PHP versions, the real version of every module, log folders and backups, server settings. Anything that looks downloadable is actually tested on the shop's own address. The result is a score and a clear list of what to do.
Why it's worth it
📊 One score and a to-do list
The shop gets a score from 0 to 100, with findings sorted by severity. Every row tells you what was found, why it's a problem and what to do. You don't need to be a security expert to understand it.
🧩 Modules, with their real version
The module reads the actual version from the files, not the one shown in the interface, and compares it with the list of known module vulnerabilities – including uninstalled modules. It also shows forgotten, disabled modules quietly left on the server.
⚙️ PrestaShop and PHP
Known core vulnerabilities for your PrestaShop version and which version fixes them. Whether your PHP version is still supported, whether debug mode was left on, whether the install folder is still there, whether the admin folder name is guessable, whether webservice keys are open, and whether there are long-unused employee accounts.
📂 Leaking files, actually tested
Module logs, exports, backups, .env and .git files, error logs, directory listing, PHP execution in image folders. The module doesn't just check whether they exist, it tests on the shop's own address whether they can be downloaded from outside.
🌐 Server
HTTPS everywhere, certificate expiry, security headers, rate limiting, spam protection on the contact form, world-writable files and folders.
🚨 Signs of compromise
PHP files hidden among images, core files modified compared to the official PrestaShop release with a line-by-line diff, unknown PHP files in core folders, suspicious code patterns, scripts injected into CMS pages and product descriptions, new employee accounts. If a high or critical sign is found, a red bar appears at the top of the page.
🔒 Read-only, changes nothing
The module changes nothing in the shop: it only reads and sends test requests to the shop's own address. It works in small steps, so it runs on shared hosting too and can continue after a closed browser tab.
✋ "I know, it's fine"
If you leave a finding as it is on purpose, accept it with a note and it's removed from the score. If the situation changes – a new module version or a newly discovered issue – the finding reappears.
Fixing is one click with Pro
The free module shows the issues. WSC Security Check Pro removes the fixable ones with one click, with a backup and undo, scans the shop every night and e-mails you if something's wrong. If you'd rather leave it to us, we do the fixing as part of the WSC maintenance package.
Good to know
- The check looks for known problems. It doesn't guarantee that the shop is completely secure.
- It stores no personal data: for employees, only the ID and date; names are read only for display.
Technical details
- PrestaShop 1.7.8 – 9.1
- PHP 7.2 or newer
- No overrides, no code running on the storefront
- Hungarian and English back office
- Updates via the Webstart Updater module
One scan, and you know where your shop is vulnerable. For free.