Flash Sale:75% Off Hosting + Free DomainEnds in13h47m14sView Plans
Hostvento logoHostvento
Get Started

How to Do a Security Check on Your osCommerce Shop

This guide gives you a simple checklist to find weak spots in an osCommerce online store and close them.

Online Stores2 min read12 steps

Why check?

osCommerce is free software for running an online shop. Many shops run old versions, and hackers look for them. A shop holds customer details, so keeping it safe matters. A regular check is like testing the locks on your doors.

Warning: take a full backup of your files and database before you change anything.

Steps

  1. Find your version. Log in to the admin area. The version number often shows in the footer or on the main page. Compare it to the newest release on the official osCommerce site.
  2. Update. If your version is old, plan an upgrade. Test it on a copy of the shop first.
  3. Rename the admin folder. Many shops use a folder called admin. Rename it in File Manager to something hard to guess. Then open includes/configure.php in the new admin folder and update the folder name in the paths.
  4. Protect the admin folder. Add a password to it with the Directory Privacy tool in your control panel. The shop then asks for two logins.
  5. Set safe file permissions. The two configure.php files should not be writable. In File Manager, set them to 444 (read only). Folders are usually 755 and files 644.
  6. Remove the install folder. If you still have an install folder, delete it.
  7. Use strong passwords. Change the admin password, database password and control panel password.
  8. Use HTTPS. Make sure your shop uses an SSL certificate (the padlock). Set the HTTPS options in configure.php. Ask Hostvento support if you need a certificate.
  9. Look for odd files. Sort your folders by "Last modified". Check recent PHP files you did not add, especially in images and includes.
  10. Check add-ons. Remove contributions (extra modules) that you do not use or that are no longer updated.
  11. Scan for malware. Use a scanner from your control panel or a security tool.
  12. Keep backups. Schedule them and store a copy off the server.
Tip: If you find a hacked file or cannot fix an issue yourself, send the details to Hostvento support using a support ticket.

Quick recap

  • Know your version and keep it updated.
  • Rename and password-protect the admin folder.
  • Lock file permissions and delete the install folder.
  • Use HTTPS, strong passwords and backups.