Magento Store Hacked? What to Do in the First 24 Hours

If your Magento store has been hacked, act in this order: contain the damage, preserve evidence, bring in your hosting provider and a Magento security specialist, and, if card data may be affected, tell your payment provider straight away. Do not start deleting files or restoring backups before logs and copies are saved, because you will need them to find how the attacker got in. Then clean from a known-good source, rotate every credential, patch, and watch closely, because Adobe warns that many sites are compromised again within hours.

Below is an hour-by-hour checklist for the first 24 hours, based on Adobe's incident response guidance. It is defensive guidance only, for store owners and their technical teams.

Signs your store may be compromised

• Customers report card fraud shortly after buying from you, or your payment provider or bank contacts you about it.
• Unknown JavaScript in your checkout, or in the HTML head and footer settings in the Admin.
• Admin users you do not recognize, or Admin logins from unfamiliar places.
• Unexpected file changes in the codebase, new files in media or pub folders, or changed cron jobs.
• Redirects to other sites, spam pages in search results, or a browser or Google Search Console security warning.
• A failed check in Adobe's free Security Scan Tool, or alerts from your host's malware scanner.

If you see any of these, treat it as an incident until proven otherwise.

Hour-by-hour incident response checklist

Hour 0 to 1: confirm, contain and call for help

1. Name an incident lead who makes decisions and keeps a timestamped log of every action taken.
2. Contact your hosting provider. They can help isolate the server, take snapshots and check for activity at the infrastructure level. Adobe Commerce on cloud infrastructure customers should also open a support ticket with Adobe.
3. Bring in Magento security expertise: your agency, system integrator or a security firm. Adobe's guidance recommends engaging your integrator and security staff immediately.
4. Decide on containment. If checkout may be skimming card data, put the store into maintenance mode or switch to a payment method that redirects off-site until the checkout is verified clean. Losing a few hours of sales is better than leaking more card data.
5. Do not wipe or restore yet. Snapshots first.

Hour 1 to 3: preserve evidence

1. Take a full snapshot or copy of the server, codebase and database before changing anything.
2. Preserve logs: web server access and error logs, Magento logs, CDN and WAF logs, SSH and SFTP logs, and database logs where available. Adobe lists preserving critical logs among its first steps.
3. On Adobe Commerce, export the Action Logs report, which records Admin actions with timestamps, IP addresses and usernames. (This report is not part of Magento Open Source.)
4. Note the time you first noticed the issue and anything customers or partners reported.

Hour 2 to 4: tell the right people

1. Payment provider and acquirer: if card data may have been exposed, tell them promptly. They will explain what investigation and reporting the card schemes require, and may require a forensic investigator.
2. Insurance: if you have cyber insurance, call early; many policies need prompt notice and have approved responders.
3. Legal and data protection: personal data breaches can trigger notification duties with deadlines (for example, under GDPR in the EU and UK). Get advice on whether, when and whom to notify. This is general information, not legal advice.

Hour 3 to 8: lock down access

1. Audit all Admin users. Remove unknown or unused accounts, and reset passwords for the rest.
2. Enforce two-factor authentication for every Admin user.
3. Review and rotate SSH keys, SFTP accounts and hosting control panel logins.
4. Reset database credentials, and confirm only the application server can reach the database.
5. Rotate integration and API keys: payment, shipping, ERP, PIM, search and email services, plus Magento integration tokens.
6. Rotate the Magento encryption key and any secrets in your environment configuration, following Adobe's documented process, so saved data stays readable.

Hour 4 to 12: find the entry point and scope

1. Compare the production codebase with your version control repository and list every difference.
2. Check HTML head and footer configuration, and other content fields that accept scripts, at every scope (default, website, store view). Remove unknown code; keep only scripts you can identify.
3. Review CMS blocks, pages and widgets for injected code.
4. Check database stored procedures and triggers for unexpected changes.
5. Review cron jobs and server crontabs.
6. Check installed extensions against vendor sources, and note any that are abandoned or outdated.
7. Check which security patches are missing for your version. Our guide to Magento security patches explains how releases and patch versions work.
8. Work out the scope: what data was accessed, for how long, and whether it was encrypted.

Hour 8 to 20: clean and rebuild

1. Prefer rebuilding over cleaning in place. Adobe's guidance warns malware can hide in unexpected places and recommends reinstalling from a known-clean source such as version control or Adobe's original distribution files.
2. Deploy clean code to a fresh server or container where possible.
3. Apply all available security patches, or upgrade to a supported version.
4. Update or remove vulnerable extensions.
5. Confirm that sensitive paths and files (environment configuration, var and setup folders) are not publicly reachable.
6. Scan the rebuilt site with malware tools and Adobe's Security Scan Tool.

Hour 20 to 24: restore carefully and monitor

1. Bring the store back online only after the checkout has been verified clean and the entry point is closed.
2. Turn on file integrity monitoring and alerting on Admin user changes.
3. Watch logs closely for days, not hours. Re-compromise often comes quickly if a backdoor was missed.
4. If Google flagged the site, request a review in Search Console after cleanup.
5. Write a short timeline and root cause summary while details are fresh.

Common mistakes to avoid

• Restoring a backup without knowing when the compromise started. The backup may already contain the backdoor.
• Deleting suspicious files before copying them. Investigators need them.
• Changing only the Admin password and not keys, database, hosting and integration credentials.
• Keeping checkout live "for now" when card skimming is suspected.
• Assuming the problem is solved because a scanner shows green.

After the first 24 hours

• Complete a root cause analysis and fix the underlying gap: patching, extension hygiene, access control or hosting configuration.
• Set a regular patch schedule and scheduled scans.
• Remove unused extensions and Admin accounts.
• Keep an inventory of every script on checkout and review it regularly; this also supports PCI DSS payment page requirements.
• Review fraud signals for the following weeks. Attackers who had access may have harvested customer accounts. Our ecommerce fraud prevention guide covers account takeover and card testing controls.

FAQ

Can I fix a hacked Magento store myself?

You can do the containment and access steps. Finding the entry point and every backdoor needs someone experienced with Magento internals, and card data incidents usually require a formal investigation.

Should I take the site offline?

If checkout or customer data may be at risk, yes, or at least disable on-site card entry until it is verified clean.

How do I stop it happening again?

Stay on a supported version, apply security patches promptly, enforce Admin 2FA, limit extensions, and monitor files and logs.

Getting help

If you are in the middle of an incident, involve your host and payment provider first. For ongoing protection afterwards, Mistri's Magento support and maintenance service covers security patches, monitoring and fixes.

Sources: Adobe Experience League: Best practices to respond to a security incident; Adobe Experience League: Security scan; Adobe Experience League: Secure your Commerce site and infrastructure.