Security Scan: setup and help

Requirements

Requires PrestaShop 1.7 or later and PHP 7.1 or later.

Security Scan is licensed under AFL-3.0. Install the release ZIP through Modules > Module Manager > Upload a module. Open Security Scan > Scan & Report. The module adds History and Settings, including Configuration and System Check.

The scanner detects issues and supplies manual fix steps. It does not block requests, patch shop files, change security settings or remove malware. Running a scan saves its report and summary in the module's database table.

Open Security Scan > Settings > Configuration.

Click Save settings, then Back to scan.

The static-code sample limit is 1,200 PHP files with deep scan on and 300 with it off. The malware sample limit is 2,500 files with deep scan on and 600 with it off. These are bounded scans, not complete inspections of every file.

First scan

1. Open Security Scan > Scan & Report.
2. Click Run scan now.
3. Review the score, date, scan duration and findings.
4. Read Critical and High findings first, then Medium and Low.
5. Inspect each affected item and follow the applicable manual fix steps.
6. Click Re-scan now after making corrections.

The report is grouped as follows:

The scanner does not compare all core files against official release hashes. Its malware patterns and code checks can miss issues and can flag legitimate code. A clean result means these checks found no problem of the kinds they look for.

Score and history

The score starts at 100. Findings subtract their assigned weights, with the result limited to 0 through 100.

Open Security Scan > History to compare the latest 30 stored summaries. Each row shows its date, score, grade, issue counts and trigger. History is a summary list; the scan page displays the latest report.

Use the score to decide what to review first. It does not certify that the shop is secure, and it is not a penetration test or an incident-response report. If you suspect an active compromise, preserve evidence and arrange an incident investigation before removing files.

Local operation

The normal scan reads local files, configuration and database data through a read-only query guard. It stores its results locally. When public URL checks are enabled, it also makes guarded requests to the shop itself. The local scan path does not upload its report to mypresta.rocks.

Managed fleet

Fleet enrollment is optional and is not needed for local scans. The Fleet Connector controller exists but is hidden from the sidebar menu. Open it through the connection link supplied by your fleet workflow.

On that screen, enter Hub URL and Enrollment token from your Security Revolution hub, then click Connect this shop. After enrollment, use Poll hub now to check the connection and review Connector status, Last poll and Last error.

Enrollment connects the shop to a remote reporting workflow and allows signed, consented scan requests. Findings shared through that workflow are outside the local-only operation described above. Protect the enrollment and polling tokens.

There is no bundled scanner CLI command or automatic scan schedule in the module. If you manage the server, you can bootstrap the intended shop and call the service from your own PHP script:

require '/var/www/html/config/config.inc.php';
require _PS_MODULE_DIR_ . 'mprsecurityscan/vendor/autoload.php';

$run = \MPRSecurityScan\Service\ScanRunner::runAndStore('cron', null, [
    'allow_network' => false,
    'deep_scan' => true,
]);

echo 'Scan #' . (int) $run['id_scan'] . ' stored' . PHP_EOL;

Replace the bootstrap path with your shop's actual path. Run it with an account that can read the shop files and access its database. The cron argument labels the saved trigger; it does not create a scheduled task.

Confirm the first run

Check that the report date changes, a score appears and History gains a row. Review any reported check errors as well as findings. After a manual fix, run another scan and compare the affected check.

Common problems

• Exposure checks show no result. Check the Confirm exposure by self-checking public URLs switch, the shop domain and whether the server can reach its own public address. With that switch off, the scan cannot tell whether a file is reachable from outside.
• The scan takes too long. Turn off Deep scan (code & malware heuristics) and retry. Review the hosting execution limit and file access if it still fails.
• A code or malware warning looks wrong. Compare the listed file with a known-clean source. A pattern match alone does not justify deleting it.
• No history or module table error. Open Security Scan > Settings > System Check and inspect the module infrastructure result.

Save any reports you need before uninstalling through Module Manager. Uninstall removes the module menu, its declared tables, including scan history and connector records, and its configuration. Reinstalling does not restore that history.

• Tool page
• Scanner guide
• Security Revolution