Magecart is a collective name for attacks that intercept payment information during an online checkout.
Definition source: Sansec: What is Magecart?. Read on October 24, 2026. The practical questions on this page help you define the issue with your administrator.
What does the name Magecart tell you?
You may encounter Magecart in a research report, a supplier warning or a news story about an online store. Sansec uses the term for theft of transaction information during checkout. The name is not a diagnosis of your store and does not identify a particular attacker without further evidence.
A skimmerA web skimmer is malicious code that intercepts visitor information, for example during checkout. is the malicious code that intercepts information. FormjackingFormjacking is the interception of information visitors enter into a web form without their permission. describes hijacking input from a form. Magecart is the broader name a source applies to such an attack.
Read beyond the headline of a warning and establish which observation the source actually describes.
Is this limited to one shopping platform?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
No. The name has historical links to Magento, but Sansec describes web skimming on other shopping platforms too. For your own situation, examine the checkout and the software loaded into it.
Comparing your CMSA content management system (CMS) is software that lets you edit the pages, texts and images of your website by logging in, without writing any code. name with a news headline is insufficient to establish or exclude involvement.
A supply chain attackA supply chain attack reaches you through a supplier or supplied component, rather than only through your own website. may affect an external supplier or supplied component. That raises a different investigation question from a change in your own website files. Ask the source or investigator where the code originated.
PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. is not the only possible route; browser code can also be supplied from outside your server.
What should you do with a Magecart warning?
Preserve the original message and verify the sender through a known contact channel. Ask which domainA domain name is the address people type to reach your website, such as yourcompany.com. It points visitors to wherever your site is hosted., checkout page and period it concerns. Share the notice with your administrator and payment provider.
Have them establish the measures needed to protect visitors and the records that must remain available for investigation.
A headline is not a sound basis for deleting files yourself or rebuilding your store. First have the relationship with your installation assessed. If the notice specifically names your store, do not wait for a general news article describing the same situation before contacting the responsible people.
What help fits this situation?
Ask your payment provider which investigator and records are needed if payment information may be affected. Separate website recovery from specialist payment card investigation. Making the visible store work again does not establish the scope of any possible information theft.
Have the report identify sources, affected components and uncertainties. Do not repeat victim counts or attacker names from a short summary. The established connection with your own store is what matters for your decision, together with the limits of the investigation that produced it.
Product and company names on this page belong to their respective owners. We use them to describe the subject. We are not affiliated with those parties.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHP site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Does Magecart identify the group that attacked my store?
No. The name alone does not identify an attacker. Ask for concrete observations from your environment and have the origin of the warning checked.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.