If you run a store on WooCommerce, OpenCart, PrestaShop or Magento, the uncomfortable truth of the last two years is this: attackers are no longer looking for you. They are looking for the software you run, and once a weakness is public, every store that has not patched it gets hit automatically within hours.
Why open-source stores are the favourite target
Open-source e-commerce platforms power a huge share of small and medium online shops. That popularity is exactly what makes them attractive:
- One vulnerability, thousands of victims. A flaw in a popular plugin or module is worth far more to an attacker than a flaw in one custom shop. Scanners crawl the internet for the vulnerable version string and exploit every match.
- Plugins and modules are the weak link. The core of WordPress, OpenCart or PrestaShop is maintained by large teams. The 40 plugins a typical store has installed are not. Many are abandoned, some are sold to new owners who ship malicious updates, and most are never audited.
- Payment data is on the page. Card-skimming scripts (the “Magecart” family) inject a few lines of JavaScript into the checkout and quietly copy card details for months before anyone notices. The shop keeps working, so nobody looks.
- Supply-chain attacks are now routine. Compromised CDN scripts, hijacked npm packages and trojanised theme updates mean you can be breached without a single bug in your own code.
- Old PHP and unpatched servers. A surprising number of stores still run PHP versions that stopped receiving security fixes years ago, on servers nobody has updated since launch.
What an attack looks like today
It rarely looks like the movies. Typical incidents we have cleaned up recently:
- An outdated form plugin let anyone upload a file. The uploaded file was a web shell. Two weeks later the server was sending spam and the domain was blacklisted.
- A checkout page loaded a third-party script from a domain whose owner had changed. The script started collecting card numbers. The store owner found out from the bank.
- Admin passwords reused from a leaked database elsewhere. No exploit needed: the attacker simply logged in and created a hidden administrator.
- A bot network placing thousands of fake orders and account registrations, exhausting the server and the payment provider’s fraud limits.
The common thread: none of these stores had anyone looking. Backups were untested, logs were unread, updates were postponed “until after the season”.
What actually protects a store
Good news: most of this is preventable with unglamorous discipline rather than expensive products.
- Inventory and prune. List every plugin, module and theme. Remove what is not used. What remains must be actively maintained.
- Patch on a schedule. Security updates within days, not months, tested on a staging copy first so nothing breaks in production.
- Supported PHP and platform versions. If your platform version is end-of-life, you are running known, documented holes.
- Harden the admin. Unique passwords, two-factor authentication, admin URL restricted by IP or VPN, no shared accounts.
- Lock down the checkout. Content Security Policy, integrity checks on third-party scripts, and monitoring for unexpected script changes.
- Web application firewall and bot control in front of the store to filter the automated noise before it reaches PHP.
- Backups you have actually restored at least once, stored off the server.
- Monitoring that pages a human when files change, error rates jump or the admin is accessed from a new country.
Offer: a security check for your store
We audit WooCommerce, OpenCart, PrestaShop, Magento and custom Laravel stores regularly, and we host and maintain several of them. A security check takes a few days and gives you a short, prioritised report: what is exposed today, what to fix first, and what it costs. If you prefer, we implement the fixes and keep the store patched and monitored under a support agreement.
Request a security check or read more about our security, hosting and support service.
