Secure Your PrestaShop Store

E-commerce is a sector heavily targeted by cyberattacks.
The latest PrestaShop security flaw shows us that vulnerabilities persist, and we need to be aware of this (see the article). Even though PrestaShop works to produce a sound core, the existence of vulnerabilities is not a myth, and certain add-on modules can also compromise its security.
Securing your online store should therefore be your priority. But where do you start, and what should you put in place to set up and, above all, maintain an optimal level of security?

To better understand

PrestaShop is an open source solution. As such, its maintenance and the responsiveness of its community to security issues is excellent.
However, it should be noted that any developer who has downloaded the solution (and in this case, particularly a malicious one) can read the source code (PHP), detect vulnerabilities more easily, and thus hack an open source site.
The impacts of an attack on your e-commerce site vary:

• • • your traffic could be hijacked
    • your business data or your customers’ data could be stolen
    • your site could be deindexed from search engines
    • your online reputation could decline
    • …

To avoid vulnerabilities

A few essential points should be put into practice to establish a solid security foundation.

1 . A Secure URL

from the moment you create your store (or as soon as possible!)
To secure your URL, you need to obtain an SSL certificate. SSL encrypts your users’ data. This certificate allows you to get a URL in HTTPS.
And in addition to making a potential data attack more difficult, HTTPS will improve your online search ranking. Indeed, this is one of Google’s recommendations for gaining, or rather not losing, SEO.

2 . Update regularly

your modules, login credentials, etc…
As part of open source, it’s important to stay up to date. An old module, for example, can be much more vulnerable to security flaws than its latest version. Updates include not only fixes for potential bugs but also strengthened protection against detected flaws. Please note, in the case of PrestaShop, make sure this process is carried out by your agency or developer.

3. Create frequent backups

of your site (once a day)
This isn’t a preventive method as such, as you’ve probably gathered, but rather a safety net. This will allow you to recover as much of your site as possible in the event of a hack.
This saves significant time when it comes to “repairing” the damage and getting back to normal as quickly as possible.

4. Set your PrestaShop store’s settings

Review the following settings and replicate them on your back office, under the Preferences > General Settings section (or General)

5. Limit access to your server and back office

You’re not the only one who needs to act on your online store’s settings. It’s a fact: you need to grant access (FTP, back office) to a number of people. Still, keep control by granting limited access whenever possible. Once a task is finished, change the access credentials.

Don’t wait to become the victim of an attack!!

You can carry out a security audit and have potential flaws fixed proactively, using the “Security Pack” offered by Profileo.
This pack includes a full analysis and the implementation of security measures.
The PrestaShop security analysis notably involves checking your PrestaShop modules and identifying the presence of known security flaws.

This gives you:

• a status on known potential security flaws at the time the pack is ordered,
• a status on the severity of the infection, if applicable,
• a list of proposed corrective and security actions

The actions carried out to secure your PrestaShop include:

• cleaning up files, if the PrestaShop site is infected,
• applying security patches to the PrestaShop modules affected by known flaws, as well as installing updated versions of these modules,
• updating the modules of the associated blog (WordPress) if necessary

Learn more about the SECURITY PACK

Our teams are of course available for any further questions.