A web skimmer is malicious code that intercepts visitor information, for example during checkout.
Definition source: Sansec: What is Magecart?. Read on 24 October 2026. The practical questions on this page help you define the issue with your administrator.
What does a digital skimmer do?
Here, skimming concerns websites rather than a device attached to a payment terminal. Sansec describes web skimming as intercepting transaction information during checkout. The code can collect information while the order proceeds normally.
A successful payment therefore says nothing about who else could read the information entered.
FormjackingFormjacking is the interception of information visitors enter into a web form without their permission. emphasizes the interception of form input. MagecartMagecart is a collective name for attacks that intercept payment information during an online checkout. is a name you will encounter in research about this type of theft. These terms help explain a warning, but they do not establish which entry route was used on your website.
Which observations matter?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
A notice from your payment provider or an unexpected checkout change deserves attention. Ask for the specific observation and affected page. A new external connection could also serve an approved payment feature.
Have a specialist assess its purpose and origin without using real customer information as test material.
Record which page was involved and when the observation was made. Ask whether the check covered the page visitors actually receive, including external scripts. A review of stored server files has a different scope.
Avoid concluding that nothing happened simply because you cannot see an unfamiliar field yourself.
What should you do about a suspicious checkout?
Contact your administrator and payment provider through their established channels. Have them determine how to limit further exposure and what investigation is needed. Preserve the original notice.
Do not place card numbers, customer names or screenshots containing payment information in a public support request.
A Content Security PolicyA Content Security Policy (CSP) is a rule your site sends to browsers that lists where scripts, styles and images on a page may come from. All else is blocked. can be part of script management. It does not certify that an existing checkout contains no malicious code. Ask which scripts are necessary, who approves changes and how the agreed configuration is checked.
Keep those answers with the website’s maintenance records.
When is specialist help needed?
Suspected interception of payment information calls for a discussion with your payment provider. Ask it to identify the expertise and next steps needed for your situation. Ordinary website maintenance is not a specialist payment card investigation.
Do not infer a recovery deadline or reporting obligation from this definition page.
Removing PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. does not automatically remove JavaScript received from third parties by the browser. Ask about the route examined rather than only the server language. Keep the checkout investigation separate from routine CMSA content management system (CMS) is software that lets you edit the pages, texts and images of your website by logging in, without writing any code. maintenance.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHP site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Does a successful payment rule out a skimmer?
No. A normal payment and interception of information can happen alongside each other. Have the payment page assessed and contact your payment provider about the suspicion.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.