Magento Hacked? Malware Removal and Clean-up Steps
If your Magento store has been hacked, put it into maintenance mode, take a full copy for evidence, then reset every admin password, credential and API key before you start removing anything. Malware on Magento usually means a card skimmer in the checkout's JavaScript, a backdoor file left on the server, or a rogue admin user, and the way in is usually an unpatched Magento version or a stolen password. Then scan, clean, patch, and keep watching, because no scanner finds everything.
- Maintenance mode on
- Copy taken for evidence
- Passwords and keys reset
- Scanned and cleaned
- Magento patched
Signs your Magento store has been hacked
Some compromises are obvious; card skimmers are designed not to be. Look for:
- Customers reporting card fraud after buying from you, or your payment provider asking questions.
- Unfamiliar JavaScript on checkout or payment pages, including scripts loaded from domains you don't recognise.
- Injected scripts in the admin, in CMS blocks and pages, or in the HTML Head scripts setting under Content > Design > Configuration.
- Admin users you don't recognise, under System > Permissions > All Users.
- Unexpected or modified files, especially PHP or other executable files in
pub/media, or changes to Magento's own files. - Odd scheduled tasks, in the server's crontab or among Magento's cron jobs.
- Security warnings from Adobe's Security Scan, a browser or a search engine.
First steps if your Magento store is hacked
Work through these in order, and keep notes of what you find and when.
- Put the store into maintenance mode, allowing your own IP address so you can still check it:
bin/magento maintenance:enable --ip=<your IP address>. Adobe says to stop any message queue consumer processes once maintenance mode is on. - Take a copy before you change anything: files, database and logs. Adobe's incident guidance says to preserve critical logs; they are your evidence of how the attacker got in.
- Audit the admin users. Remove any you don't recognise and reset every admin password.
- Reset every credential. Adobe lists the database, file access, payment and shipping integrations, web services, and integration and API keys. Include SSH and SFTP logins.
- Change the encryption key. On Magento 2.4.8, or 2.4.7-p2 and later,
bin/magento encryption:key:changegenerates a new key andbin/magento encryption:data:re-encryptre-encrypts stored data. Adobe's steps put the store in maintenance mode and pause cron first, and the change signs out every admin and customer session. Older versions need Adobe's isolated patch first. - Check two-factor authentication is on for the admin. It has been on by default since Magento 2.4.0.
- Change the admin URL from anything guessable.
If card or personal data may have been taken, speak to your payment provider, and check whether you need to report the breach to the ICO.
How to scan a Magento site for malware
Adobe's Security Scan is free and covers Magento Open Source as well as Adobe Commerce; use it, but don't rely on it alone.
Adobe describes Security Scan as a way to "Monitor your Adobe Commerce and Magento Open Source sites for security risks and malware". It runs over 21,000 security tests and can scan weekly or daily, with reports. You sign in to your Magento account, choose Security Scan, and confirm you own the site by adding a code in the Magento admin.
Alongside it:
- Compare your code with a clean copy. Install the same Magento version and extensions from Composer in a separate folder and compare the two. Any difference in Magento's own files needs explaining.
- Use a file scanner. Open-source malware scanners look for known malicious code patterns in PHP and JavaScript files. They are useful, but they only know about patterns that have already been seen.
- Check the database, not just the files. Card skimmers are often stored in CMS blocks, CMS pages or configuration settings such as HTML Head scripts, where file scanners never look.
- Check
pub/mediafor executable code. Adobe's guidance calls this out, because it is a common place for attackers to leave files.
No scanner, ours or anyone's, finds everything. A clean scan means nothing known was found, not that the store is clean.
Cleaning up and patching
Removing the malware is only half the job. The other half is closing the way in.
- Replace, don't edit. Restore Magento and extension code from version control or Composer, rather than trying to cut bad code out of infected files.
- Clean the database of injected scripts in CMS content and configuration.
- Patch Magento. Apply the latest release and security patches for your version line, ideally on staging first. See Magento upgrades and security patching.
- Check recent attacks against your version: for example the StyleSmuggler zero-day and the APSB26-138 security update.
- Scan again once the clean-up is done, then keep scanning.
Magento's own defences against injected payment scripts have improved. From Magento 2.4.7, the Content Security Policy runs in restrict mode on payment pages, and Subresource Integrity checks scripts on payment pages; Subresource Integrity also shipped in 2.4.4-p9, 2.4.5-p8 and 2.4.6-p6. Staying on a supported version keeps them. More on payment pages in PCI DSS and Magento hosting.
After the clean-up: keeping it clean
- Patching on time. Our Fully Managed plan, £169 a month + VAT, includes Magento security patching, staging first and then production, plus Bastion off-site backup up to 50 GB, so a clean copy sits away from the server.
- Server-side monitoring. Sentinel, on every plan, reads your server's logs and blocks abusive sources at the server firewall, with our engineers reviewing the blocks. Sentinel Plus on Managed VPS adds bot protection, file integrity monitoring and stricter blocking; Sentinel Pro on dedicated and high availability adds active tuning during an attack and priority response. Sentinel is not a web application firewall, a malware scanner, a CDN or DDoS protection.
- A web application firewall. If you want one, we recommend Cloudflare, on your own Cloudflare account.
- Regular scans with Adobe's Security Scan, and two-factor authentication for every admin.
- Bots and card testing. If your checkout is being used to test stolen cards, see how to stop card testing on Magento 2.
How EveryHost helps stores we host
For stores hosted with EveryHost:
- Every plan includes server-side investigation of hosting incidents, through 24/7 UK support by ticket.
- Fully Managed adds priority server-side clean-up after a compromise: IP blocks, guidance on rotating credentials, and a restore from Bastion if needed. Cleaning malicious code out of your store stays with your developer.
- Malware clean-up beyond that, finding and removing malicious code in your store, is out-of-plan work: quoted, or £85 an hour + VAT. We agree the scope with you before we start.
We can't promise how long a clean-up will take, because it depends on what we find, and no one can honestly promise a store will never be compromised again. What we can do is clean up carefully, close the way in, and keep watching. Our roots in UK Magento hosting go back to 2008.
Frequently asked questions
Store hosted with us and think it's been hacked?
Raise a ticket through our support portal straight away. Not hosted with us yet? Talk to us about moving your store.