PrestaShop Monitoring — What Exactly We Check

PrestaShop leaves a few places behind after installation that are easy to forget: the installer folder, configuration files holding the database password, an open webservice. MonitorWWW.com recognises a PrestaShop store automatically and checks them alongside regular availability monitoring.

Store security

• The /install/ folder — whether the installer was removed. We check the response content, not just the status code, because PrestaShop often redirects every address.
• Configuration files — public access to app/config/parameters.php (PrestaShop 1.7+) and config/settings.inc.php (1.6).
• Webservice API — whether /api/ responds from outside.
• Backups and logs — whether the /backups/ and /var/logs/ directories are reachable.
• Version in the page source — whether the PrestaShop version number is visible to every visitor.

Store environment

• PrestaShop version — when the store reveals it.
• Theme and the list of detected modules — read from the page source.
• Admin folder name — if it leaks in links or scripts.
• Session cookies — Secure, HttpOnly and SameSite flags.

How often

We check store availability every few minutes and run security probes several times a day, with random pauses between requests. Everything is done from the outside — no module to install and no admin access.

Alerts

We notify you about outages, an expiring certificate or domain and detected malware by email, SMS or Telegram. PrestaShop findings are visible in the dashboard together with a fix and count towards the security score.

What we check on every site, regardless of platform

• Uptime and response time — HTTP status, load time, redirects, maintenance mode.
• SSL certificate and domain — certificate validity and domain expiry date, with an alert ahead of time.
• DNS — SPF, DMARC, MX and CAA records.
• Security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cookie flags.
• Files that should not be visible — .env, .git, phpMyAdmin, backups, directory listing.
• Malware and PHP errors — suspicious code and error messages in the page content.
• Blacklists — whether the domain has been flagged as unsafe.
• Content changes — an optional keyword that must be present on the page.