Ask the OpenCart forum if the platform is secure and you’ll get the same answer every time: it’s secure, and if you got hacked, it was your fault. A weak admin password, a dodgy extension, a file you left writable. They’re not wrong. But that answer doesn’t help the store owner who’s now selling stolen card numbers to their own customers without knowing it.
OpenCart’s real problem isn’t the core code. It’s that the project is slow and prickly about security, so patches and disclosures don’t move the way they do on bigger platforms. That leaves the store owner holding the risk. Someone has to actually watch the store, check the extensions, and lock the parts the installer left open. That’s the job.
We audit three layers: the OpenCart application, the server underneath it, and the checkout path where card data flows. Then we fix what we find.
Full scope, every store
We run the same checklist on every OpenCart store, whether it's a 50-product shop or a 12,000-order catalog. No stripped-down scan that we upsell you out of.
- Core, theme, and extension versions checked against current OpenCart releases and known CVEs
- Every ocmod and vqmod modification reviewed for injected or backdoor code
- Admin folder, login hardening, and leftover install/ directory
- storage/ directory location: inside or outside the web root, and whether it's exposed
- config.php and admin/config.php permissions and exposed credentials
- Checkout and payment template files scanned for card skimmers
- Full malware and file-integrity scan against a clean OpenCart copy
- Admin user review: count, weak passwords, dormant accounts, role escalation
- SSL/TLS coverage and HTTP security headers across the store
- Backup verification: a real restore path, not just a plugin claiming to back up
Findings you can act on
You get a report in plain English, ranked by how likely each issue is to bite you, with the checkout risks called out first. Not a scanner dump. The things that matter, in order, with the fix beside each one.
Ranked findings report
Every issue scored by likelihood and impact, with payment-path risks at the top.
Extension and modification audit
Which ocmod and vqmod changes are safe, which are stale, and which are hiding something.
Fix list with priorities
What we fixed, what you should do next, and what can wait, separated clearly.
Backup and recovery note
Where your backups go, how to restore the store, and the gap if there is one.
Walkthrough call
Thirty minutes to go through the findings so the report isn't just a file you file away.
Four steps, five days
Five business days from access to a hardened store, with a full backup taken before we change anything.
Access and snapshot
You give us admin, SFTP, and database access. We take a full backup of the store before touching a setting.
Same dayThree-layer scan
Store, server, and checkout. Automated tools plus a manual read of the payment and modification files, because scanners miss injected code.
Days 1-2Harden and fix
Move storage out of the web root, lock config files, rename and protect admin, remove any skimmer or backdoor we find, and document each change.
Days 3-4Re-scan and handoff
We re-run the scan to confirm the fixes held, then walk you through the report.
Day 5Fixed price, no subscription
The audit-only tier is $390. That’s the three-layer scan, the ranked report, and the walkthrough call. You get a clear picture of where the store stands and a fix list you can hand to any developer.
Most store owners want the holes closed, not just listed, so the audit-plus-hardening tier at $690 includes the actual fixes: storage and config lockdown, admin protection, skimmer removal, patching, and a re-scan to prove it worked.
Already hacked? Start with restoration.
If your store is already compromised, redirecting customers or skimming cards, an audit is the wrong first move. You need the malware gone and the store clean before hardening means anything. That’s an OpenCart restoration job, and the hardening folds in once you’re clean. Tell us it’s an active incident and we’ll treat it as one.
- Three-layer security scan
- Extension and modification audit
- Ranked findings report
- Walkthrough call
- Everything in Audit
- storage/ and config lockdown
- Admin protection and login hardening
- Skimmer and malware removal
- Post-fix re-scan
Tooling we lean on
How this connects to the rest of the stack
This is the OpenCart version of our website security service. The platform changes the attack surface, but the three-layer pattern is the same one we run everywhere. If you want the platform view first, our OpenCart support overview covers the maintenance, upgrades, and break-fix work we do on stores day to day, including the 3.x to 4.x jump.
The store still sits on a Linux box, and a good share of the hardening lives there. Our Linux server support page covers that layer on its own. If you also run WordPress somewhere in the business, the WordPress security audit uses the same method at the application level, and the two pair well on one engagement.
If the store is already compromised, start with OpenCart malware removal and restoration, which cleans the store first and hardens after. There’s no point locking the doors while someone’s still inside copying card numbers.
On the fence about upgrading? Our take on OpenCart 3 versus 4 explains why staying patched matters more than the version number.
Need security for OpenCart sorted?
We'll triage the same day. Send context, screenshots, error messages — whatever you have. No sales calls, no chatbots.