Hacked Magento store recovery and upgrade in Indonesia
Lime Commerce cleans hacked Magento stores: we find and remove the malicious code, restore damaged files, close the security holes and upgrade old Magento 1 and Magento 2 stores so it doesn't happen again.
We reply within 10 minutes, Mon–Fri, 08:30–17:00 WIB. Messages outside these hours are answered on the next working day.
Outside these hours? Follow the first steps below now, then send us the details so we can start on the next working day.
Recent recovery: Mandjur, a Magento 1.7 store that was defaced. We removed the malicious files, restored the code and locked down the server. Read the Mandjur case study
- E-commerce since 2014
- Adobe Bronze Solution Partner
- Jakarta team
- 1Scan
- 2Clean and restore
- 3Patch
- 4Lock down
- 5Test
- 2014Building e-commerce since
- 320+Projects, across platforms
- 20+Brands, across platforms
- M1 → M2Upgrades delivered
How do you know a Magento store has been hacked?
Common signs are a changed homepage, admin users nobody created, redirects to other sites, unknown scripts on the checkout page, a browser or Google warning, and core files that changed without a deployment.
- Changed pages: The homepage or index.php shows content you didn't put there.
- Unknown admin users: Admin accounts nobody on your team created.
- Strange redirects: Visitors land on other sites, often only on mobile or from Google.
- Extra checkout scripts: Unknown JavaScript on the checkout page can copy card details.
- Warnings: Google or the browser warns that the site may be hacked.
- Changed or missing files: Core files changed or deleted without a deployment.
What should you do first?
Don't delete or reinstall anything yet. Take a full backup of files and database, change every password from a clean device, and call a Magento team before you change more.
- Keep the evidence
Back up all files and the database before you change anything.
- Change every password
Magento admin, database, server, hosting and email, from a clean device.
- Protect the checkout
If payment pages may be affected, pause payments and tell your payment provider.
- Don't reinstall blindly
A fresh install on top of a hacked server can keep the backdoor.
How does Lime Commerce clean a hacked Magento store?
We scan the whole code base with our own malicious-file scanner, remove the injected code, restore damaged files, apply the missing security patches, and lock down accounts, passwords and file permissions. Then we try to attack the store again before we call it fixed.
| Step | What we do |
|---|---|
| Scan | Our malicious-file scanner checks the entire code base and flags injected or changed files. |
| Clean and restore | We remove the malicious code and restore damaged or wiped files. |
| Patch | We apply the security patches the store is missing. |
| Lock down | We remove unused accounts, reset server, database and admin passwords, and set file ownership and permissions so one break-in can't reach everything. |
| Test | We attack the store ourselves to check the hole is closed. Ongoing checks continue under a maintenance contract. |
Should you upgrade after a hack?
Usually yes. Magento 1 has had no official security patches since June 2020, and an unpatched Magento 2 stays exposed. Lime Commerce upgrades Magento 1 stores to Magento 2 and brings old Magento 2 stores to a supported, patched version.
| Your store runs | Risk | Recommended next step |
|---|---|---|
| Magento 1 (any version) | No official security patches since June 2020 | Clean, then plan the move to Magento 2 |
| Old Magento 2, unpatched | Known vulnerabilities stay open | Clean, then upgrade to a supported 2.4 release |
| Current Magento 2.4, patched | Lowest risk | Clean, find how they got in, keep patching |
A Magento 1 to Magento 2 move rebuilds the theme and extensions and moves products, customers and orders. When the new Magento 2 store launches, it comes with 3 months of free maintenance.
How long does it take and what does it cost?
It depends on the Magento version, how much was damaged and how much the store is customized. Lime Commerce quotes after a short audit, and you get the scope, timeline and price in writing before work starts.
Pricing by quote: ask our sales team.
Magento recoveries and upgrades we have delivered
- Hack recoveryMandjur
Herbal medicine brand on Magento 1.7. The site was defaced and files were wiped. We removed the malicious files, restored the code, patched it and locked down the server.
Read the case study - Magento 1 to Magento 2Masari Shop
Luxury fashion store moved from Magento 1 to Magento 2, with the old Magento 1 code removed.
Read the case study - Adobe Commerce upgradeMasari Shop
Upgrade to Adobe Commerce and a move to a new server, without taking the store offline.
Read the case study
| Fact | Detail |
|---|---|
| Platforms | Magento, Adobe Commerce and Shopify, one team |
| Since | 2014 |
| Projects | 320+, across platforms |
| Partner | Adobe Bronze Solution Partner |
| Ownership | You keep the source code and data |
Hacked Magento FAQ
- Can you fix a hacked Magento 1 store?
- Yes. For Mandjur, a Magento 1.7 store that was defaced, Lime Commerce found and removed the malicious files, restored the wiped files, patched the code and locked down the server.
- Do I have to move to Magento 2?
- Cleaning the store comes first. After that, staying on Magento 1 means no official security patches, so we recommend planning the move to Magento 2.
- Will my store go offline?
- Not always. If the checkout is compromised, we may close it for a short time to protect your customers. Upgrades can be planned so the store stays online, as we did for Masari Shop's Adobe Commerce upgrade.
- Can you work on our current server?
- Yes. We work on your current server, or help you move to a better one if the hosting is part of the problem.
- How do you stop it from happening again?
- With maintenance: when Adobe releases a Magento security update, we tell maintenance clients and schedule the patch. We also remove unused accounts and keep file permissions tight.
- Who owns the code after the work?
- You do. You keep full control of your source code and data.
Start with the audit.
Send us your store URL and your Magento version. We check what happened and confirm the scope before any work begins.
Chat on WhatsAppWe reply within 10 minutes, Mon–Fri, 08:30–17:00 WIB. Messages outside these hours are answered on the next working day.
