Skip to content
Waynet PrestaShop Expert

FreePrestaShop technical audit

Don’t guess what’s holding back your sales. Find out!

Get a free PrestaShop technical audit in 5 days: 9 areas of your shop, a PDF report and a 30/90/365-day roadmap.

Request your audit →
PrestaShop 1.7 → 9.x CVE security Bespoke module audit Multistore Core Web Vitals performance

Why it matters

Concrete outcomes you get from the audit, whether or not you decide to keep working with Waynet.

1

Know what really threatens your shop

You see the security risks, technical faults and issues that could affect sales, SEO or GDPR compliance. You know what needs action now and what can wait.

2

Stop working in the dark

You get a concrete 30/90/365-day technical plan. No chaos, no random decisions and no “we’ll see later”.

3

Get your shop's speed and performance back

You find out what is actually slowing your shop down and which fixes can improve performance in as little as a day.

4

Regain control of your technology

You know exactly which modules, integrations and modifications your shop runs. The knowledge stays with you, not just with an agency or a developer.

Nine areas, one coherent picture of your shop

Every area is a genuine review of code, database and configuration, not an automated scan.

Core

Core technical health

PrestaShop version, upgrade path, known CVEs, manual patches in core files, readiness for migration to 9.x.

Modules

Module inventory

All modules by vendor, version mismatches between database and files, encrypted modules (ionCube), orphaned modules, vendor concentration.

Features

Feature map

What actually works, where there is redundancy, which business functions depend on which modules and which are dead.

Code

Bespoke modules

Code review of bespoke modules: raw SQL, hard-coded values, core overrides, missing upgrade procedures.

Override

Core modifications

Every change to PrestaShop core files, mapped to its business function, criticality and regression risk during migration.

Front

Theme

State of the build process, manual edits to production files, module view overrides, tangled multistore logic.

Security

Security

Core CVEs, vulnerabilities in commercial modules, data leaks, GDPR, diagnostic files exposed without authentication.

Data

Database

Size, character collations, “zombie” tables left by inactive integrations, retention policies, missing indexes.

Performance

Performance, cache and integrations

Quick wins, cache configuration, marketplace, ERP and marketing integrations, with a check that they actually work.

What the audit uncovers

Most problems aren’t “unoptimised images”. They are publicly known vulnerabilities, open doors in admin directories and modules that block migration.

Critical
CVSS 9.8 × 3

Three confirmed SQL injections in active commercial modules

Blog, quote request and product page extension modules with active CVSS 9.8 vulnerabilities. The attack requires no login: calling a front-end URL is enough. The module vendors released patches more than 2 years ago.

GDPR
Art. 32 & 33 GDPR

B2B customer documents leaking from an upload module

The file download endpoint checks neither login nor ownership. Any anonymous visitor iterating through IDs can download every customer document: in a B2B shop that means tax IDs, powers of attorney and certificates.

Blocker
Override 587 lines

A 587-line duplicate of the order validation method in an override

The critical validateOrder() method copied in full, and the only functional change is a space in an email translation. Every future core payment patch is blocked.

High
Exposure public

Diagnostic <code>phpinfo()</code> in the shop directory without authentication

A file in the root directory exposing the full PHP server configuration: system paths, extensions and environment variables (potentially database passwords). A typical first step for an attacker before a break-in.

Migration blocker
Migration blocked

Modules with encrypted code (ionCube) requiring PHP 7.4

The price feed module for comparison sites has a hard-coded PHP 7.4 requirement, which the target PrestaShop 9.x no longer supports. The code is unreadable, so without a new version from the vendor the migration cannot go ahead.

Medium
Attack surface

Three API keys active in parallel with full access to the shop

Three order integrators, each with access to 70 resources: customers, orders, employees, price lists. If only one is in use, the other two are open doors.

These are real findings from a single audit. The full report ran to 28 pages, categorised 137 modules, identified 22 groups of core overrides (4,099 lines) and mapped 11 external integrations, with a concrete 30/90/365-day schedule of recommendations.

Get in touch about an audit

How it works, from request to report

Two short online meetings: one to kick off, one to review the findings. Everything else happens on our side.

01
Stage 1 · Free · Day 0 · 90 seconds

Request

You fill in the form at the bottom of the page. We reply within 24 working hours to arrange a short kick-off meeting.
02
Stage 2 · Day 1 · 30 minutes

Kick-off meeting

A short online meeting where we explain the audit process and agree the access we need (usually read-only SFTP plus a database dump or read-only database access). On request, we sign an NDA before you share access.
03
Stage 3 · Days 2–4

Analysis

We map the technology stack, modules, core overrides, theme, database, integrations and security. This stage happens entirely on our side: we change nothing in your shop. We use AI to support the work, which is how we finish in 5 days rather than 3 weeks.
04
Stage 4 · Day 5 · 30–45 minutes

Review meeting

We walk through the audit findings and set out concrete options: what to fix first, what to tackle in the medium term and what to plan for the long term.
05
Stage 5 · Deliverable · Day 5 · after the meeting

PDF report

After the meeting we send a PDF report with 1–10 scores across 6 categories, the top 5 problems, the top 5 recommendations and a 30/90/365-day roadmap. The report is yours to keep, with no obligation.

What you get from the audit

PrestaShop technical audit

Section 1 · Category scores
  • Core technical health
    3/10
    Unsupported PS, 15 unpatched CVEs
  • Bespoke module quality
    4/10
    Hard-coded values, two ionCube modules
  • Security
    2/10
    3× SQLi 9.8, GDPR data leak
  • Performance
    5/10
    Quick wins in the admin panel, no WebP
  • Scalability
    5/10
    Architecture, not infrastructure
  • Migration readiness
    2/10
    Blocker: theme and 2 ionCube modules
  • Executive summary – Top 5 problems and top 5 recommendations on the first page
  • 1–10 scores across 6 categories – with the reasoning behind each score
  • Module map – split into native, marketplace, bespoke and orphaned
  • List of core overrides – with business function and regression risk
  • Security analysis – CVE numbers, scores, attack vectors
  • Database bottlenecks – with candidates for clean-up
  • Performance quick wins – what can be done in 1 day
  • 30 / 90 / 365-day roadmap – with priorities and a logical sequence
  • 30-minute call – to review the audit, with options for action

Your audit is carried out by the same team that looks after 50+ PrestaShop shops

We have been working with PrestaShop for over 10 years. We look after more than 50 stores and see the same situation in different forms: outdated versions, modules from vendors that no longer exist, overrides in the core.

The audit is carried out by our experienced PrestaShop developer with the support of AI. This lets us complete the audit in 5 days rather than 3 weeks. AI helps gather the data, but the conclusions and recommendations are human.

Scale
~50
PrestaShop shops under support
Experience
10+ years
in Polish ecommerce, from PS 1.5 to 9.x
Certification
official PrestaShop Expert status

Request a free audit

Once you submit the form, we will get back to you within 24 working hours with a list of what we need to get started. No obligation, no contract.

  • Delivered within 5 days of your request
  • PDF report of almost 30 pages with a roadmap
  • 30-minute call to review the audit
  • No sales pressure: the report is yours to keep
  • NDA on request

Quick form

7 fields · 90 seconds · we reply within 24 working hours

    Answers to frequently asked questions

    Is the report generated by AI? +

    The audit is carried out by our PrestaShop developer, supported by AI. AI helps us gather and pre-categorise data from the code, database and configuration, so the report takes 5 days rather than 3 weeks. AI is a tool that speeds up the work, not the author of the report.

    Why is it free? What's the catch? +

    There is no catch. For us it is a way to see the state of your shop before proposing to work together, or to tell you honestly that we are not the best fit. If after the report you decide not to work with Waynet, the report stays with you and you can do whatever you like with it.

    What access do you need? +

    As a minimum: read-only SFTP access to the shop files and a database dump (or read-only database access). Optionally: a short call with someone who knows the shop’s history. We can manage without it, but you will need to confirm how we interpret some things.

    Does the audit affect how my shop runs? +

    No. We work on a copy of the database in a separate environment. We change and restart nothing in your live shop. On request, we sign an NDA before receiving access.

    My shop is small. Is it worth it? +

    If your shop makes money, yes. Small shops are more likely than large ones to have unpatched CVEs (smaller budgets mean less frequent updates), and the report helps you plan technical investment for the next 6–12 months.

    Can you implement the fixes recommended in the audit? +

    Absolutely. It is an optional but natural next step, and by then we already know your shop in detail: modules, overrides, integrations and database.