Incident response · 2026-07-06

Is My Magento Store Hacked? 12 Warning Signs to Check Now

Magento compromises are designed to be quiet — the attacker makes money by staying hidden while your store keeps running. Here are 12 concrete warning signs that your Magento store is hacked, what each one means, and what to do about it.

Not sure? Run a free MageArgus scan for web-reachable indicators, then confirm on-disk with the module if anything looks off.

By the numbers

Skimmers can run for weeks before anyone notices — Sansec / MageArgus incident data
Rogue admins and integration tokens are the most common persistence — MageArgus incident data

12 signs to check now

Unknown admin users or integration tokens you didn't create.
A card form that looks off at checkout — especially if you use an off-site gateway (PayPal/Amazon).
Injected <script> in Misc HTML, footer or CMS blocks.
New/modified PHP files under pub/media, pub/static or generated/.
Unexpected orders containing template syntax ({{) — a TrojanOrders sign.
SEO spam — pages or meta for pharma/casino keywords you never made.
Cloaked redirects — visitors from Google land somewhere else.
Customer complaints of fraud after buying from you.
Cron/scheduled tasks or shell-init files you don't recognise.
Spikes in traffic to /rest/, /checkout or odd URLs in logs.
Blocklist warnings from Google Safe Browsing or your host.
File-integrity alerts on core or template files.

How to confirm quickly

Check for rogue admins and recent file changes:

mysql -e "SELECT username,email,created FROM admin_user ORDER BY created DESC LIMIT 20;"
find pub/ app/design vendor/magento/module-checkout -name '*.php*' -mtime -30 -type f
grep -rIl 'atob(\|_cc_ov\|api.telegram.org\|base64_decode' pub/ app/ 2>/dev/null

A remote scan catches what's web-visible; on-disk and DB malware need a server-side scan to confirm.

What to do if you see any of these

Don't panic-delete. Snapshot the server for evidence, then follow the malware removal guide and the recovery plan: contain, find the entry point, clean files and database, rotate all secrets, patch, and re-scan. If cards were processed, notify your acquirer.

Frequently asked questions

My store scored well on a remote scan — does that mean it's clean?

Not necessarily. A remote scan can't see on-disk webshells, cloaked skimmers or database injections. A good score means no obvious external exposure; to rule out a compromise you need a file + database scan on the server.

Could my store be hacked without any visible symptoms?

Yes. Well-built skimmers and backdoors are designed to be invisible to shoppers and admins. Regular on-disk scanning and file-integrity monitoring are how you catch the quiet ones.