Magento hacked store: first response checklist
What to do in the first hour if a Magento store appears hacked, including evidence preservation, containment and safe recovery.
The first hour: preserve evidence before cleaning
If you suspect a compromise, do not immediately delete files or restore a backup without thinking. Take a snapshot of code, database and available logs so you can understand what happened and avoid restoring the same entry point.
Record what triggered the concern, when it started, which checkout or admin behaviour changed and any recent deployments. This creates a useful incident timeline before timestamps and log data are overwritten.
- Snapshot the current codebase and database.
- Preserve web server, PHP, Magento, WAF and admin audit logs.
- Record suspicious URLs, users, files and payment symptoms.
- Note recent deployments, extension installs and credential changes.
Contain the Magento store without destroying evidence
Disable suspicious admin users, restrict admin access, block confirmed malicious traffic and take affected payment components offline if card data may be at risk. If checkout has been modified, protecting customers is more important than keeping the store trading normally.
Rotate credentials in a controlled order only after evidence is captured. That normally includes Magento admin, hosting, SSH, database, deployment, payment and API credentials. Use a clean device and do not send new passwords through an already-compromised channel.
Check the common Magento compromise points
Once the store is stable, find the entry point. Missing security patches, weak credentials, abandoned modules, exposed configuration and writable web roots are common causes, but the investigation should follow evidence rather than assume the first suspicious file is the whole incident.
- Compare application code with a known-good Git revision or release package.
- Review admin users, integrations, OAuth consumers and API tokens.
- Inspect checkout templates and JavaScript for skimmers or injected loaders.
- Check cron jobs, system users, SSH keys and scheduled tasks for persistence.
- Confirm the installed Magento version and outstanding security patches.
Recover to a known-good state
A safe recovery removes malicious changes, closes the original access route and rebuilds from trusted code. Restoring yesterday's backup is not enough if the attacker entered weeks earlier or the vulnerable extension remains installed.
Apply required patches, replace compromised files from a trusted source, remove persistence, rotate credentials and deploy through staging where possible. Test browse, account, basket, checkout, payment callbacks, order processing and admin workflows before reopening fully.
What to monitor after reopening
Keep enhanced logging and alerting in place after recovery. Watch admin logins, new users, file changes, checkout script requests, unusual outbound traffic, payment failures and WAF events. Document what happened, what changed and which longer-term controls still need work.
If payment data may have been exposed, involve the payment provider, acquiring bank and appropriate compliance or legal contacts. A technical cleanup does not replace the business's breach-assessment obligations.