Free PrestaShop security check
Does your PrestaShop store run modules with known holes?
Enter a store address. The check finds the PrestaShop version and the modules on the page, compares them with the published security advisories and looks for the card skimmer PrestaShop warned about in 2026.
We only read what any visitor can see. Nothing is changed in the store.
What the check looks at
Modules. Every module whose files appear on the home page is compared with more than 200 advisories published by Friends of Presta, the PrestaShop security community. Where the store shows the module version, you see whether it is older than the fix. Where it does not, you see which version fixed the issue, so you know what to look for in the back office.
The PrestaShop core. The version is told by the public files every store serves. The check lists the core issues PrestaShop itself published for that version and the release that fixed them. On PrestaShop 1.7 and 1.6 it also shows the issues fixed only in 8 and 9, because those versions get no fixes any more.
The card skimmer. In 2026 PrestaShop warned about a script written into the theme's head.tpl that swaps the payment buttons for a fake payment form. The check looks for that script in the page code, and for the two modules the same attack installs.
How to read the result
"Update" means the version the store shows is older than the version that fixed the issue. This is the one to act on first.
"Check" means the issue was fixed, but the store does not show its module version. Open Modules in the back office and compare. Many stores will already be past the fix.
"No fix" means the author never published a fixed version. The module has to be replaced or removed.
None of this proves that the store can be broken into: a module may be patched by hand, or switched off on the pages that matter. It is the list of things worth checking, in the order worth checking them.
What a check from outside cannot see
Modules that only work in the back office or on other pages, overrides, changed module files and the server itself. A store that combines its JavaScript and CSS also hides most module folders. The check says what it saw and does not guess the rest.
If a module is flagged
Update it from the author, not from a copy found elsewhere, and test the checkout after the update. If the module is no longer used, uninstall it and delete its folder: a disabled module can still be reached. If the author published no fix, replace the module. On PrestaShop 1.7 or older, plan the move to a supported version: the core holes found since 2024 are fixed only in 8 and 9.
In our check of 2,066 stores, 77% showed at least one module with a published advisory, and where the version was public, two in three were already on the fix. See the study
FAQ
Questions, answered
Is the check safe for my store?
Yes. It opens the home page and a few public files, the same way a browser does, and says who it is in every request. It does not log in, does not send forms and does not try any attack.
Where does the vulnerability data come from?
Module advisories come from Friends of Presta (security.friendsofpresta.org, CC BY-SA 4.0), which publishes the affected and fixed versions for each module. Core advisories come from PrestaShop's own security advisories on GitHub. Both are refreshed every week.
My module is listed but I already updated it. Why?
Your store does not show the module version in public files (PrestaShop 8 and 9 block them), so the check cannot tell. If your version is the fixed one or newer, the advisory no longer concerns you.
Does a clean result mean my store is secure?
No. It means nothing from the published advisories shows from outside. Back-office modules, server settings, passwords and changed files are not visible to any outside check.
Can I check a client's store?
Yes, it only reads what any visitor can see. For an agency it is a quick way to see which client stores need updates first.
Have it done for a fixed price · See how a PrestaShop 1.7.6 store was upgraded to 9.2, step by step
Free PrestaShop version check · Free PrestaShop theme detector