E-shop security audit · WooCommerce · Magento · PrestaShop · custom

Security audit for your e-shop. Cookies, GDPR, payments.

We know how WooCommerce, Magento and PrestaShop behave — and where custom-built e-shops most often fail. We'll find out whether your customers have an exposed session, whether the payment redirect holds HTTPS, and whether your cookies are GDPR-compliant.

Passive scan · no signup · results in 30 seconds

https://

Scan takes 30 seconds. You can request the PDF report with a button on the results page.

How it works

3 steps · 30 seconds

Enter your e-shop domain

We detect the platform — WooCommerce, Magento, PrestaShop or custom.

E-shop-specific checks

Cookie attributes, GDPR/ePrivacy, payment redirect, mixed content, exposed configuration files.

Report with concrete steps

For each finding we explain what's happening and where the developer needs to look to fix it.

What we check on e-shops

E-shops deal with different things than blogs. Sessions, payments, cookies, GDPR. Here are 6 problems we see most often on e-shops.

Cookiescritical

Session cookie without Secure

The cookie with the session ID travels over HTTP. On public Wi-Fi an attacker takes over the customer's account.

Set-Cookie: PHPSESSID=…; Path=/

Paymentscritical

Payment redirect over HTTP

Between the cart and the payment gateway there's one step over HTTP. An attacker in the network can redirect it elsewhere.

301 http://gateway/pay (downgrade)

GDPRwarning

Cookies set before consent

Third-party cookies (Google Analytics, Meta Pixel) are set before the consent banner is shown. A regulator fine is almost certain.

Set-Cookie: _ga, _fbp (before consent)

Cookieswarning

Cookie without SameSite

Older browsers (Safari < 13) are vulnerable to CSRF. An attacker will send you an order in the customer's name.

SameSite: not set

Mixedwarning

Mixed content on a product page

An image from http:// is blocked by a modern browser. The visitor sees a broken page; the owner knows nothing.

img src: http://cdn.example/foto.jpg

Headerswarning

HSTS missing

Without HSTS the first visit often goes over HTTP. An attacker in a hotel or café exploits it.

Strict-Transport-Security: (missing)

892

E-shops checked

247

With insecure session cookie

With downgrade in the payment flow

About Vulscan

We've worked with e-shops for years and know how WooCommerce, Magento and PrestaShop handle cookies and redirects — and where custom-built e-shops most often go wrong. For an e-shop it's not just about the GDPR fine — a session leak means a customer lost on the spot.

hello@vulscan.app LinkedIn

Passive scan

No invasive tests. We behave like a visitor — your site won't notice we're there.

European context

We know local hostings, CMSes and registrars. Recommendations are concrete, not generic.

Real help

If you don't understand a finding, write us — a human replies, not a bot.

Frequently asked questions

Do you scan the payment gateway too?+

We only scan the redirect chain from your site to the gateway (e.g. https://gpwebpay.cz). The gateway itself is monitored by the bank.

Does it work for a custom-built e-shop too?+

Yes. With custom builds the number of findings is usually highest — default protections that platforms handle automatically are missing. In the report we say specifically what your developer needs to change.

Is the scan safe? Won't it damage the site?+

Yes. The scan is passive — it behaves like an ordinary visitor. We don't try exploits, don't crack passwords, don't send invasive payloads. The site won't notice we're there.

What do you do with the data? Where do results go?+

You'll see the results right on the site and can then email yourself the PDF report with one click. We keep your email so we can alert you if a new serious finding appears on your domain. You can unsubscribe at any time.

What if you find a critical problem?+

You'll get a report where every problem is explained with a concrete remediation step. Most things your webmaster can handle. If not, write us — we're happy to take a look.

Free e-shop scan. Cookies, payments, GDPR.

The PDF report tells you exactly where your e-shop has holes — and what specific step leads to a fix. Works on open-source platforms (WooCommerce, Magento, PrestaShop) and custom-built e-shops.