{"id":38,"date":"2026-07-29T12:36:55","date_gmt":"2026-07-29T10:36:55","guid":{"rendered":"https:\/\/go-onagency.es\/modulos\/prestaward-snapshot\/"},"modified":"2026-10-16T19:03:09","modified_gmt":"2026-10-16T17:03:09","slug":"prestaward-snapshot","status":"publish","type":"page","link":"https:\/\/go-onagency.es\/en\/modulos\/prestaward-snapshot\/","title":{"rendered":"PrestaWard Snapshot"},"content":{"rendered":"<section class=\"section product-hero product-hero--prestaward\">\n<div class=\"container product-hero__inner\">\n<div class=\"product-hero__copy\">\n<p class=\"eyebrow\">PrestaShop module<\/p>\n<h1>PrestaWard Snapshot<\/h1>\n<p><strong>Integrity monitoring for PrestaShop shops.<\/strong> Creates a file baseline, compares changes and sends an email alert when anything sensitive is moved.<\/p>\n<p><strong>Exclusive distribution on the PrestaShop Marketplace (Addons).<\/strong><\/p>\n<div class=\"product-hero__actions\">\n        <a class=\"button button--ghost\" href=\"https:\/\/go-onagency.es\/prestaward-snapshot\/changelog\/en\/\">Changelog<\/a><br \/>\n        <a class=\"button button--ghost\" href=\"https:\/\/go-onagency.es\/prestaward-snapshot\/prestaward-snapshot-user-guide.pdf\" target=\"_blank\" rel=\"noopener\">PDF guide<\/a><br \/>\n        <a class=\"button button--ghost\" href=\"\/ayuda\/prestaward-snapshot\/\">Help Guide<\/a>\n      <\/div>\n<div id=\"snapshot-gallery\" style=\"margin-top:20px\">\n<p style=\"margin:0 0 8px;font-size:13px;font-weight:600;color:#b6bcc7\">Screenshots<\/p>\n<div style=\"display:flex;flex-wrap:wrap;gap:12px\"><a href=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-snapshot-gallery\/v018-es-01-resumen.png\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:block;width:150px;text-decoration:none;color:inherit\"><img decoding=\"async\" src=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-snapshot-gallery\/v018-es-01-resumen-thumb.png\" alt=\"PrestaWard Snapshot 0.1.8: summary of the latest snapshot, the latest scan and recent changes\" width=\"150\" height=\"125\" loading=\"lazy\" style=\"display:block;width:150px;height:auto;border:1px solid #dce4eb;border-radius:6px\"><span style=\"display:block;margin-top:4px;font-size:12px;color:#b6bcc7\">Status summary<\/span><\/a><a href=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-snapshot-gallery\/v018-es-02-trabajos.png\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:block;width:150px;text-decoration:none;color:inherit\"><img decoding=\"async\" src=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-snapshot-gallery\/v018-es-02-trabajos-thumb.png\" alt=\"PrestaWard Snapshot 0.1.8: baseline job history and comparison\" width=\"150\" height=\"125\" loading=\"lazy\" style=\"display:block;width:150px;height:auto;border:1px solid #dce4eb;border-radius:6px\"><span style=\"display:block;margin-top:4px;font-size:12px;color:#b6bcc7\">Job history<\/span><\/a><a href=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-snapshot-gallery\/v018-es-03-comprobaciones.png\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:block;width:150px;text-decoration:none;color:inherit\"><img decoding=\"async\" src=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-snapshot-gallery\/v018-es-03-comprobaciones-thumb.png\" alt=\"PrestaWard Snapshot 0.1.8: core file checks and security configuration audit\" width=\"150\" height=\"125\" loading=\"lazy\" style=\"display:block;width:150px;height:auto;border:1px solid #dce4eb;border-radius:6px\"><span style=\"display:block;margin-top:4px;font-size:12px;color:#b6bcc7\">Security audit<\/span><\/a><a href=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-snapshot-gallery\/v018-es-04-configuracion.png\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:block;width:150px;text-decoration:none;color:inherit\"><img decoding=\"async\" src=\"\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-snapshot-gallery\/v018-es-04-configuracion-thumb.png\" alt=\"PrestaWard Snapshot 0.1.8: email alert settings, cron health and retention\" width=\"150\" height=\"125\" loading=\"lazy\" style=\"display:block;width:150px;height:auto;border:1px solid #dce4eb;border-radius:6px\"><span style=\"display:block;margin-top:4px;font-size:12px;color:#b6bcc7\">Alerts and cron<\/span><\/a><\/div>\n<p style=\"margin:7px 0 0;font-size:11px;color:#b6bcc7\">Spanish interface \u00b7 version 0.1.8<\/p>\n<\/div><\/div>\n<div class=\"product-hero__card\">\n      <img decoding=\"async\" src=\"https:\/\/go-onagency.es\/wp-content\/themes\/go-on-agency\/assets\/img\/prestaward-snapshot-logo.svg\" alt=\"PrestaWard Snapshot\"><br \/>\n      <span>Baseline + comparison + alerts<\/span><\/p>\n<ul class=\"product-hero__checks\">\n<li>Jobs with saved progress<\/li>\n<li>Sensitive files under control<\/li>\n<li>PrestaShop 1.7, 8 and 9<\/li>\n<li>Multi-version laboratory<\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<\/section>\n<section class=\"section product-page-main product-page-main--prestaward\">\n<div class=\"container product-page-layout\">\n<article class=\"product-page-content product-page-content--editable\">\n<h2>What it does<\/h2>\n<p>A shop is constantly changing. PrestaWard Snapshot creates a technical snapshot and highlights files that have been added, modified or deleted, so you can distinguish between a planned change and an unexpected one.<\/p>\n<p>It also analyses suspicious code in new or modified files, assigns a risk level to each change and groups module and theme updates together, so that anything requiring attention is not lost amongst routine changes.<\/p>\n<p>It also scans the JavaScript of the active theme and payment modules for signs of card skimmers, monitors the size of media folders and checks 14 security configuration points. A tabbed dashboard, with a concise summary, tells you in a single line what needs attention. It operates in read-only mode on your files: it does not modify, restore or delete them, and only writes to its own workspace and database.<\/p>\n<h2>How it works<\/h2>\n<ul>\n<li>It stores a SHA-256 fingerprint of each file, along with its relative path, size and modification date. It does not store copies of the files or their contents.<\/li>\n<li>Compares the shop with the latest baseline and classifies each change as routine, suspicious or critical. Executable files and those containing sensitive configuration data are always monitored.<\/li>\n<li>Scans modules, payment gateways, themes, core classes, administration, configuration, <code>override<\/code>, <code>src<\/code>, <code>vendor<\/code>, <code>upload<\/code>, <code>download<\/code>, <code>img<\/code>, <code>js<\/code> and root files. PrestaShop\u2019s temporary folders, such as <code>img\/tmp<\/code> and theme resource caches, are not scanned.<\/li>\n<li>Exclusions are defined by exact name or relative path. A preview is required before they are activated, and excluded folders continue to be monitored for executable files.<\/li>\n<li>Run the comparison from the Back Office or via a token-protected cron job. In shops with a very large number of files, a job may require the command-line process <code>bin\/snapshot-worker.php<\/code>, which the server administrator runs manually: the module never initiates this on its own.<\/li>\n<li>If an analysis fails or is cancelled, the last valid baseline is retained. The results of a comparison are only displayed once the job has finished completely.<\/li>\n<li>It sends an email alert when it detects significant changes. The recipients are configured within the module and, by default, are the shop\u2019s email address. Your shop\u2019s logo appears in the email header, whilst the footer features the GO ON Agency logo and the signature \u2018PrestaWard by GO ON Agency\u2019.<\/li>\n<li>It retains the history for as long as you set (90 days by default) and does not delete reviews that are still pending.<\/li>\n<li>The dashboard is divided into tabs (Summary, Changes, Jobs, Checks, Settings and Activity Logs) and only loads the one you have open, so it loads faster in large shops. A final tab, Support, brings together the GO ON Agency support panel, whilst the Integrity status appears at the very end. The Summary tab displays the baseline, the latest comparison, a main action (Create snapshot if there is no baseline and Compare now if there is one) and, at most, one line: the job in progress or the most important alert, with \u2018and N more\u2019 if there are others.<\/li>\n<li>Completed jobs are retained for 90 days and can be viewed in the \u2018Jobs\u2019 tab, in a table with filters by type, status and dates. Each job has its own details (timeline, files, maximum memory usage, notifications with sample folders and diagnostic download) and, when the file details are cleared, a summary of what happened is retained.<\/li>\n<li>A job requiring a command-line process is highlighted in amber, with the reason explained in plain language and the exact command displayed alongside a button to copy it. There is no \u2018Resume\u2019 button in the browser.<\/li>\n<\/ul>\n<h2>Requirements<\/h2>\n<ul>\n<li>PrestaShop 1.7, 8 or 9, including multi-shop installations, and the version of PHP required by your version of PrestaShop (PHP 7.1 or later for PrestaShop 1.7).<\/li>\n<li>Database tables using the InnoDB engine. The module checks this and converts its own tables when updating.<\/li>\n<li>Following installation, only the administrator profile has access. Other profiles are authorised with PrestaShop\u2019s native permissions for reading, creating and modifying.<\/li>\n<li>Control panel and messages in nine languages.<\/li>\n<\/ul>\n<h2>What it does not do<\/h2>\n<ul>\n<li>It is not a backup tool and does not restore files: it detects when something has changed, but does not recover it. It complements your backups and version control, it does not replace them.<\/li>\n<li>It is not an antivirus programme or a malware scanner. It searches for common patterns of web shells and obfuscated code in new or modified PHP and JavaScript files (up to 512 KB each) and pays particular attention to executable files, including those that hide PHP code behind a misleading extension. A match means \u2018check this file\u2019, not proof of an attack, and a file with no matches is not proven to be safe.<\/li>\n<li>Card skimmer indicators in JavaScript are heuristic: they indicate a reason to examine the file, they do not prove a breach, and a URL that the code constructs whilst running is not detected. The URLs of the shop itself and those of the payment gateways do not count as other websites.<\/li>\n<li>It does not analyse the database.<\/li>\n<li>It does not send files, paths or content to any external service. The connection to PrestaWard Integrity transmits the installation and shop identifiers, the domain, the fingerprint of the installed package and the summary fingerprint of each snapshot, without any customers\u2019 personal data.<\/li>\n<li>It does not prevent or block changes to the shop: it alerts you after they have taken place.<\/li>\n<li>The footer of the module\u2019s emails does not contain any links, contact details or images hosted outside your shop: the GO ON Agency logo is a file from the module itself that is served from your shop.<\/li>\n<\/ul>\n<h2>Key features<\/h2>\n<ul>\n<li>Snapshots of modules, payment gateways, themes, core, administration and configuration.<\/li>\n<li>Analysis of suspicious code in new or modified PHP and JavaScript files: look for patterns typical of web shells and obfuscated code, and explain the results in plain language. A file that exceeds the size limit is marked as only partially reviewed.<\/li>\n<li>Detection of disguised images (with incorrect headers or containing PHP code) in all folders, including excluded ones, and \u2013 subject to time and size constraints \u2013 in temporary folders such as <code>img\/tmp<\/code>.<\/li>\n<li>Risk level for each change (high, needs review or low), visible and filterable during the review, included in the audit CSV and in alert emails.<\/li>\n<li>Module and theme updates are grouped into a single element showing the previous and new versions, and any PHP changes within a detected update are considered low-risk and do not trigger alert emails.<\/li>\n<li>Core files panel: compares them against the official checksum list for your version of PrestaShop, in resumable batches. Only the official list is downloaded; no files are uploaded. A difference does not prove an intrusion, and if the list is unavailable, the panel indicates that the core has not been verified.<\/li>\n<li>Security configuration audit with a score from 0 to 100 and 14 checks: debug mode, administration folder, configuration permissions, installation folders, dumps and compressed files in the web root, PHP version, HTTPS, visible PHP errors, PHP hardening (allow_url_include and expose_php), version control folders and environment files (.git, .svn, .hg, .env and variants) in the web root and within modules and themes, web service keys with write access to numerous resources, cookie IP checks, and inactive accounts retaining the SuperAdmin profile. For the keys, only the number is counted \u2013 without reading or displaying them \u2013 and for the accounts, only the number is counted \u2013 without names or addresses. Each point is accompanied by an explanation and a solution, and anything that cannot be verified is marked as \u2018not verified\u2019 and does not count towards the score.<\/li>\n<li>Card skimmer heuristics in new or modified JavaScript within the active theme and payment modules: code that reads the card number, expiry date or security code and sends them to another website (high risk), data sent to another site from order or payment code, and heavily obfuscated code alongside the order or payment code (both need review). Each finding is explained in the change review.<\/li>\n<li>Multimedia volume report: for each folder (img, upload, uploads and download), it counts files and bytes in each baseline and comparison, without accessing further files or storing data per file. \u2018Checks\u2019 displays the total per folder and the increase from the baseline, whilst \u2018Settings\u2019 allows you to set a maximum number of files, a maximum size in GB and a maximum increase in percentage (50% by default; 0 disables the limit). Any limit that has been exceeded appears in the \u2018Summary\u2019 and in the alert email.<\/li>\n<li>Visible monitoring limit: if a scan reaches the limit of 250,000 names read in the excluded folders, the Summary and Checks sections indicate how many folders remain unmonitored, and the multimedia volume is marked as partial.<\/li>\n<li>Notification of a cron job that has never run and a custom alert for any backup folders and module copies located in the web root.<\/li>\n<li>Maintenance window of 1 to 4 hours: silences alert emails but continues to log changes, and when it closes sends a consolidated summary with the options \u2018Accept these changes\u2019 or \u2018Dismiss\u2019. Snapshot never creates a baseline on its own.<\/li>\n<li>Change review optimised for very large results: pagination by windows with the option to jump to a specific page, summary grouped by folder, status and risk level, and a pending queue where each file appears once per baseline.<\/li>\n<li>Fast baseline in large shops: the publication only reads the rows relating to its own job, and temporary data from completed jobs is deleted in bounded batches, without accumulating.<\/li>\n<li>Comparison from the Back Office or token-protected cron job.<\/li>\n<li>Email alerts with a summary, affected categories and a link to the dashboard.<\/li>\n<li>Tabbed panel with a \u2018Minimum Summary\u2019, a 90-day job history with filters and details, coverage, recent changes, activity logs and a \u2018Support\u2019 tab containing diagnostics, which is always the last tab.<\/li>\n<li>Common filter bar in the change review and job history: the selectors are arranged in a grid of equal width, the search box and the \u2018Filter\u2019 button are in the same row, and secondary actions, such as exporting the audit to CSV, are right-aligned.<\/li>\n<li>Unified design of the dashboard across the four PrestaWard modules: section headers, form cards with neutral borders and standard collapsible blocks, statistics displayed on a single line, and a larger GO ON Agency logo in the header. The main button is now a solid brand colour, without a gradient.<\/li>\n<li>Emails with your shop\u2019s header: the shop\u2019s logo at the top and, in the footer, the GO ON Agency logo with the signature \u2018PrestaWard by GO ON Agency\u2019. The subject line no longer repeats the shop\u2019s name.<\/li>\n<li>Baseline and comparison jobs that resume from the saved progress.<\/li>\n<li>Configurable exclusions with preview and new secure baseline.<\/li>\n<li>Mandatory monitoring of executables and sensitive configuration files, even within excluded folders.<\/li>\n<li>Automatic connection to PrestaWard Integrity, without blocking the shop, with signed and chained receipts containing the fingerprint of each snapshot. On the module screen, the \u2018Synchronise\u2019 button updates the connection.<\/li>\n<li>Heartbeat and cron status to detect delayed or failed runs.<\/li>\n<li>Incremental scanning with mandatory rehash of critical areas and periodic full scans.<\/li>\n<li>Sorting, filtering, pagination, change review and CSV export of changes.<\/li>\n<li>Secure metadata diff, configurable retention and protected cleanup.<\/li>\n<li>GO ON Agency support panel with a downloadable diagnostic report. It is downloaded by an employee with editing permissions, having selected a shop. It contains only versions, statuses and counters; it does not include paths, file contents or credentials, and is not sent automatically.<\/li>\n<\/ul>\n<h2>Compatibility verified<\/h2>\n<p>Version 0.1.8 passed laboratory testing on PrestaShop 1.7, 8 and 9 on 15 October 2026, both on a clean installation and when updating from version 0.1.7. Version 0.1.7 passed laboratory testing on 13 October 2026; it was tested with a real-world volume of 151,440 files and used as a canary in a live production shop. Version 0.1.3 also passed installation, uninstallation, reinstallation, authenticated access, adversarial exclusion tests and cryptographic validation on PrestaShop 1.7.8.11 with PHP 7.4, PrestaShop 8.2.7 with PHP 8.1 and PrestaShop 9.1.4 with PHP 8.5.<\/p>\n<h2>Secure use<\/h2>\n<p>Create a baseline only once the shop has been checked and is clean. Compare after each intervention and do not commit changes that you have not yet identified. The module complements, but does not replace, backups or version control.<\/p>\n<h2 id=\"registro-de-cambios\">Changelog<\/h2>\n<h3>0.1.8<\/h3>\n<ul>\n<li>The panel is divided into tabs (Summary, Changes, Jobs, Checks, Settings and Activity Logs) and only loads the currently open tab, so it opens more quickly in large shops. The GO ON Agency support panel has its own tab, \u2018Support\u2019, which is always the last one, and the Integrity section appears at the very end of all the tabs.<\/li>\n<li>Minimum summary: the current baseline, the latest comparison and its result, one main action and, at most, one line detailing the most important work in progress or alert (changes pending review, new or previously unaccounted-for folders requiring a new baseline, a maintenance window due to close, a cron job that has never run or is running late, backups in the web root). If there are further alerts, the line adds \u2018and N more\u2019.<\/li>\n<li>\u2018Jobs\u2019 tab: the job in progress is displayed as a card showing its stages (discover, calculate fingerprints, validate, compare or publish, attestation), file count, elapsed time, last update and who is running it (Back Office, cron or command line). A job requiring a command-line process appears in amber, with the reason stated in plain language and the exact command accompanied by a button to copy it; in the browser, there is no \u2018Resume\u2019 button.<\/li>\n<li>A 90-day job history in a single table (type, source, employee, start date, duration, status, result and notifications) with filters by type, status and dates, and pagination, instead of the previous limit of the last 20 jobs or 7 days. The result of a comparison links to the changes it found, and a kernel file check links to the Checks tab.<\/li>\n<li>Details of each job: timeline, files, maximum memory, policy hash, linked baseline and comparison, notifications with sample folders, a translated error message if it failed, and a diagnostic download. When the file details for a completed job are cleared, a summary is retained (alert counts with example folders and folders not fully covered) and the page indicates that the details have been cleared.<\/li>\n<li>Coverage by category has been moved to the end of \u2018Changes\u2019; shop checks (backups, core files, configuration audit and module health) are now grouped together under \u2018Checks\u2019; and settings for email, cron, analytics policy, maintenance window and storage are under \u2018Configuration\u2019.<\/li>\n<li>The security configuration audit now comprises 14 checks. New: PHP hardening (allow_url_include and expose_php), version control folders and environment files (.git, .svn, .hg, .env and variants) in the web root and within modules and themes, web service keys with write access to numerous resources (only the number of such files is counted; keys are never read or displayed), cookie IP checks, and inactive accounts retaining the SuperAdmin profile (these are only counted, without names or addresses). Each has an explanation and a solution, and anything that cannot be read is listed as \u2018not checked\u2019. .git, .svn and .env files in the web root are moved from the \u2018installation files and copies\u2019 check to the new one, so as not to count them twice.<\/li>\n<li>Card skimmer heuristics for JavaScript: new or modified JavaScript in the active theme and payment modules is also checked for three indicators: code that reads the card number, expiry date or security code and sends data to another website (high risk), data sent to another site from order or payment code (needs review) and heavily obfuscated code alongside order or payment code (needs review). The shops\u2019 own URLs, payment gateways and, for weaker indicators, known analytics servers do not count as a third-party site. A match is a reason to examine the file, not proof of compromise, and a URL that the code constructs whilst running is not detected.<\/li>\n<li>Multimedia volume estimate: for each baseline and comparison, it counts, for each multimedia folder (img, upload, uploads and download), the files and bytes already processed, without accessing further files or saving data per file. \u2018Checks\u2019 displays the total per folder, the growth since the baseline and whether a limit has been exceeded. \u2018Settings\u2019 has three limits: maximum number of files, maximum size in GB and maximum growth since the baseline as a percentage (50% by default; 0 disables a limit). Any limit that has been exceeded appears in the Summary and in the alert email, which is also sent when no single file has changed enough to trigger the alert on its own.<\/li>\n<li>Visible monitoring limit: a scan reads a maximum of 250,000 names in the excluded folders, and subsequent folders were recorded as not covered but were only displayed within the job. Now, this is indicated by an alert line in the Summary and a warning in Checks showing the number of unmonitored folders, and the multimedia volume is marked as partial if it was measured below that limit.<\/li>\n<li>Fixes an issue where the connection with Integrity would fail in the Back Office within the \u2018all shops\u2019 context or when a shop other than the first one was serving the registration test: the connected shop would change to \u2018registration pending\u2019 and the test could not be signed. The installation ID is now read as a single unit from the global scope (or from the shop where it is stored) in any context; the update passes an ID stored in a shop to the global scope without regenerating it, and if it cannot be read, Integrity\u2019s status is left as it was.<\/li>\n<li>New: shared filter bar. The change review and work history use this layout: the selectors are arranged in a grid of equal width, the search box and the \u2018Filter\u2019 button are in the same row, and secondary actions, such as exporting the audit to CSV, are right-aligned. Previously, the filters were crammed together and the buttons overlapped.<\/li>\n<li>Alert, maintenance summary and test emails display your shop\u2019s logo in the header (with the shop name as alternative text) and a standard footer featuring the GO ON Agency logo and the signature \u2018PrestaWard by GO ON Agency\u2019, without any links or contact details. The footer logo is a file from the module itself, served from your shop.<\/li>\n<li>Corrects the issue where the subject line of emails included the shop name twice.<\/li>\n<li>Unified design of the dashboard across the four PrestaWard modules: section headers, form cards with neutral borders and standard collapsible blocks, statistics displayed on a single line, and a larger GO ON Agency logo in the header. The main button is now a solid brand colour, without a gradient.<\/li>\n<li>Fixes an issue where, in PrestaShop 9, the admin theme displayed tabs with underlines as links and section titles in capital letters. The common styles override this only within the PrestaWard panel, so PrestaShop 1.7 and 8 look the same as before.<\/li>\n<li>Fixes an issue where, in PrestaShop 1.7, the module\u2019s stylesheet was ignored when registered with the version number in the URL. The file is now checked and registered without parameters, so that the new styling appears in versions 1.7, 8 and 9.<\/li>\n<li>Fixes an issue where, in PrestaShop 9, dashboard actions (job requests and downloading the support report, as well as synchronisation with Integrity) would check the security token using a method not supported by PrestaShop 9, which could result in them being rejected. Validation now takes place via the PrestaShop 9 service; in PrestaShop 1.7 and 8, the validation process remains unchanged.<\/li>\n<li>When the connection to Integrity cannot be updated at that moment, the panel displays a single message: the saved connection remains valid and will be retried automatically. The labels on all tabs have been translated into all nine languages.<\/li>\n<li>The product header once again displays the GO ON Agency logo and the signature \u2018PrestaWard by GO ON Agency\u2019, without any links. The baseline format, the manifest bytes and the contract with the Integrity API remain unchanged; the update adds columns (two to the jobs table and those for media volume by folder, job and baseline).<\/li>\n<\/ul>\n<h3>0.1.7<\/h3>\n<ul>\n<li>It analyses suspicious code in new or modified PHP and JavaScript files (up to 512 KB each) for patterns typical of web shells and obfuscated code, and explains the result in plain language. A match means \u2018check this file\u2019, not proof of an attack; a file with no matches is not proven to be secure, and one that exceeds the limit is marked as only partially checked.<\/li>\n<li>Detects disguised images (with an incorrect header or containing PHP) in all folders: included, excluded and, subject to time and size constraints, temporary ones such as img\/tmp, which the scan has not yet processed.<\/li>\n<li>Assigns a risk level to each change (high, needs review or low), which is visible and filterable in the change review and included in the audit CSV and alert emails.<\/li>\n<li>Groups module and theme updates into a single item, including the previous and new versions. The modified PHP code within a detected update is low-risk and no longer triggers alert emails. Requires a baseline created with this version.<\/li>\n<li>New core files panel: compares them against the official checksum list for your version of PrestaShop, in resumable batches. A difference does not prove an intrusion; if the list does not exist or cannot be downloaded, the panel indicates that the core has not been verified and never presents it as having passed.<\/li>\n<li>New security configuration audit with a score from 0 to 100 (debug mode, administration folder, configuration permissions, installation folders, dumps and compressed files in the web root, PHP version, HTTPS and visible PHP errors, amongst other points). Each point includes an explanation and a solution; items that cannot be checked are listed as \u2018not checked\u2019 and do not count towards the score.<\/li>\n<li>It alerts you to a cron job that has never been run and, via a separate alert, to any backup folders and module copies present in the web root.<\/li>\n<li>New installations exclude module backups and the downloads folder by default. In existing installations, these exclusions are available in the dashboard and are only applied if you enable them, which creates a new baseline.<\/li>\n<li>Maintenance window of 1 to 4 hours: silences alert emails but continues to log changes, and when it closes sends a consolidated summary with the options \u2018Accept these changes\u2019 or \u2018Dismiss\u2019. \u2018Accept\u2019 simply marks them as reviewed; Snapshot never creates a baseline on its own.<\/li>\n<li>When analysis coverage increases between versions, files in folders that were not covered by the previous baseline are reported as new coverage rather than as thousands of added files with critical alerts.<\/li>\n<li>The change review feature handles very large result sets: pagination with page navigation, summaries grouped by folder, status and risk, and pending changes from previous baselines marked as superseded.<\/li>\n<li>Reduces the time taken to create the baseline and validate directories in large shops with retained previous jobs (minutes rather than tens of minutes) and deletes the temporary rows of completed jobs in bounded batches.<\/li>\n<li>Fixes several warnings: Snapshot no longer detects its own files as high-risk changes; PrestaShop\u2019s standard protection file index.php is no longer flagged as a suspicious executable; \u2018Recent Changes\u2019 displays the totals from the last comparison; and, after creating a baseline, the dashboard no longer displays the previous comparison as current.<\/li>\n<li>The Back Office displays \u2018Processing from the console\u2019 whilst the console process is running; refreshing the page after clicking a button no longer resubmits it, and a rejected start indicates which job is in progress. The console process outputs a brief progress message rather than one per step.<\/li>\n<li>Back Office consistency: the jobs panel and its buttons have the same appearance as the rest of the panel, and the status messages for the cron and activity log are displayed in the Back Office language across all nine languages.<\/li>\n<li>The support and diagnostics panel is positioned just before the Integrity section, as in all other PrestaWard modules, and in the \u2018all shops\u2019 context it no longer disappears: it indicates that a shop must be selected.<\/li>\n<li>The style sheets are loaded with the module version, so the new look appears after updating without clearing the browser cache.<\/li>\n<li>Synchronise with Integrity every time you open the dashboard, using a background request that never slows down the page, and no more than once per minute per shop.<\/li>\n<\/ul>\n<h3>0.1.6<\/h3>\n<ul>\n<li>A symbolic link no longer interrupts the scan: it is skipped without being followed or having its fingerprint calculated (and therefore does not form part of the baseline) and is reported in the dashboard, with an alert when it points outside the shop or to a non-existent destination.<\/li>\n<li>During the scan, exclude any files that cannot be included in the manifest.<\/li>\n<li>It never scans PrestaShop\u2019s volatile folders (img\/tmp and the theme\u2019s combined resource caches), which are constantly regenerated and could interrupt a scan with directory_changed.<\/li>\n<li>Apply the exclusions before entering each folder: excluded folders are no longer part of the integrity check and are only monitored for executable files in a separate pass that never halts the process and is limited to 250,000 filenames per job.<\/li>\n<li>It re-reads an included folder that changes during the analysis up to three times. If it continues to change, the core, configuration, administration, payment gateway modules and active theme folders halt the job as before; the rest are skipped with a warning and the job ends.<\/li>\n<li>The cron job processes several consecutive batches per call (up to around 20 seconds) and reports the status cli_required with an HTTP 409 response when a job requires the command-line process. A monitoring tool that treats any response other than a 2xx as a failure will flag this, as is to be expected. This process is run manually by the server administrator: the module never initiates it on its own.<\/li>\n<li>Strengthens the lock that prevents simultaneous cron runs, even if the first two runs coincide.<\/li>\n<li>Moves the temporary manifest files to a private directory within the shop, compatible with open_basedir and with the system\u2019s temporary directory clean-up. In Nginx, it is advisable to block access to var\/prestaward-snapshot\/.<\/li>\n<li>Detects tables that do not use InnoDB, displays a clear message in all nine languages and converts the module\u2019s tables upon updating, logging each conversion.<\/li>\n<li>Adds a read-only status check panel in the Back Office: private staging folder, database storage engine, cron frequency and jobs awaiting processing via the command line.<\/li>\n<li>Corrects the totals in the jobs report: links are counted separately from excluded files.<\/li>\n<li>Each module is analysed only once, either within the payments scope or the modules scope, so that a module which is not a payment gateway and changes during the analysis no longer halts the job.<\/li>\n<li>If a job cannot fully cover a folder, the snapshot is shown as having partial coverage and the comparison marks the files in those folders as \u2018unverified\u2019 rather than \u2018deleted\u2019.<\/li>\n<li>The jobs panel shows the folders affected by each type of alert and what to do, in all nine languages. Uninstallation also removes the jobs tables.<\/li>\n<li>PrestaShop 9: the command-line process and cron no longer fail due to confusion between the core\u2019s \u2018admin-api\u2019 folder and that of the Back Office.<\/li>\n<li>When the command-line process fails, it ends with a diagnostic line containing a fixed reason code, without paths or internal messages.<\/li>\n<li>Reduces the cost of analysis in shops with a large number of files.<\/li>\n<li>PHP 7.1 and 7.2: Integrity\u2019s registration, attestation and heartbeat are no longer halted by a syntax error.<\/li>\n<li>Fixes the update from version 0.1.5 when the snapshots table is missing.<\/li>\n<li>Tested in-house on PrestaShop 1.7, 8 and 9, including a test with 300,000 files that change during the analysis.<\/li>\n<\/ul>\n<h3>0.1.5<\/h3>\n<ul>\n<li>Resets automatic Integrity attestation retries, pending heartbeats and retention following asynchronous cron responses. Maintenance is carried out in limited batches and is coordinated separately from scan progress.<\/li>\n<li>If a previous baseline included several administration folders, the next comparison may show additional entries: check the differences and create a new baseline where appropriate, without automatically deleting the previous one.<\/li>\n<li>Allows valid filenames containing consecutive full stops and maintains Protection against insecure paths.<\/li>\n<li>Retains all files in the additional administration folders without confusing them with those in the active Back Office.<\/li>\n<li>Saves the progress of baselines and comparisons so that you can continue after closing the panel or cancelling a request.<\/li>\n<li>Processes and verifies files in batches; results are only displayed once the job is complete, and the last valid baseline is retained if the job is cancelled or fails.<\/li>\n<li>Corrects the comparison of administration files against previous baselines and retains the exclusions for unchecked folders.<\/li>\n<li>Adds a downloadable diagnostic report to be manually attached to a support request, without automatically sending any data. It is only downloaded by an employee with editing permissions and with a selected shop, and does not include paths, file contents or credentials.<\/li>\n<li>Completes the dashboard statuses, notifications and alert templates in nine languages.<\/li>\n<li>Retains the registration and update fixes from version 0.1.4.<\/li>\n<\/ul>\n<h3>0.1.4<\/h3>\n<ul>\n<li>Corrects Integrity registration errors in PrestaShop 9 and preserves the existing registration when updating shops that are not multi-shop.<\/li>\n<li>Resets automatic registration retries and logs the actual cause of the failures.<\/li>\n<li>Updates the standard Back Office design and adds information on data processing.<\/li>\n<li>Adjusts number and duration formats to the administrator\u2019s language and translates the dashboard statuses and labels.<\/li>\n<li>Corrects the version number of the installed version during the update.<\/li>\n<li>Prepares the AFL-3.0 package for Addons: removes the update checker and calculates the identity from the installed files.<\/li>\n<\/ul>\n<h3>0.1.3<\/h3>\n<ul>\n<li>Security patch: the scan now covers the entire PrestaShop installation, including the folders <code>override<\/code>, <code>src<\/code>, <code>vendor<\/code>, <code>upload<\/code>, <code>download<\/code>, <code>img<\/code>, <code>js<\/code> and the files in the root directory.<\/li>\n<li>Security patch: files with security implications are always monitored, regardless of their file extension.<\/li>\n<li>Security patch: strengthens the verification of remote attestations and stops automatic retries when the shop\u2019s registration key changes.<\/li>\n<\/ul>\n<h3>0.1.2<\/h3>\n<ul>\n<li>Automatic heartbeat without cron, triggered non-blockingly by the shop\u2019s normal traffic.<\/li>\n<li>The browser request remains within the same domain and Integrity credentials are used solely on the server.<\/li>\n<li>Per-shop locking, a six-hour interval and a delay following failures to prevent duplicates.<\/li>\n<li>Manual synchronisation with Integrity also updates the installation\u2019s presence.<\/li>\n<\/ul>\n<h3>0.1.1<\/h3>\n<ul>\n<li>Integrity heartbeat and cron health monitoring.<\/li>\n<li>Secure incremental hashing with periodic full checks and critical areas always recalculated.<\/li>\n<li>Classification of routine, suspicious and critical changes.<\/li>\n<li>Filters, pagination, review with notes and CSV export of audit reports.<\/li>\n<li>Metadata diff without stored content and retention with protected cleanup.<\/li>\n<li>Dashboard visually aligned with the PrestaWard ecosystem.<\/li>\n<\/ul>\n<h3>0.1.0<\/h3>\n<ul>\n<li>Automatic, non-blocking registration in the PrestaWard Integrity API.<\/li>\n<li>Local queue with retries to attest each manifest without sending files or content.<\/li>\n<li>Remote receipts signed, chained and verified within the shop.<\/li>\n<li>Connection and delivery status visible from the Dashboard.<\/li>\n<\/ul>\n<h3>0.0.9<\/h3>\n<ul>\n<li>Contextual help links from the configuration fields to the public guide.<\/li>\n<li>Public guide reorganised by objective and field, with a practical explanation of each setting.<\/li>\n<li>The redundant display of the update source has been removed from the settings.<\/li>\n<\/ul>\n<h3>0.0.8<\/h3>\n<ul>\n<li>Configurable exclusions by exact name and relative path, with an immutable policy and SHA-256 hash.<\/li>\n<li>Mandatory preview before activating a policy and creating its new baseline.<\/li>\n<li>Blocking comparisons between different policies.<\/li>\n<li>Non-configurable monitoring of executables and configuration files within excluded zones.<\/li>\n<li>Limited detection of PHP headers and dangerous interpreters in files with misleading extensions.<\/li>\n<li>Fully tested on PrestaShop 1.7, 8 and 9, including a mixed test with 100,000 files.<\/li>\n<\/ul>\n<h3>0.0.7<\/h3>\n<ul>\n<li>The full product and technical module identity has been renamed to PrestaWard Snapshot.<\/li>\n<li>Initial access restricted to the administrator profile.<\/li>\n<li>Explicit authorisation of additional profiles using PrestaShop\u2019s native permissions.<\/li>\n<li>Read separation, snapshot creation and configuration using READ, CREATE and UPDATE permissions.<\/li>\n<li>Hiding of settings, cron tokens and sensitive actions for read-only profiles.<\/li>\n<li>Clarification to the documentation: the module monitors integrity, but does not store or restore backups.<\/li>\n<\/ul>\n<h3>0.0.6<\/h3>\n<ul>\n<li>Product, guide, supplier and support links remain intact after a clean installation.<\/li>\n<li>Metadata update from the public manifest.<\/li>\n<li>GO ON Agency logos linked in the Back Office and emails.<\/li>\n<li>Alternative URL visible in HTML and plain text emails.<\/li>\n<li>Test email action and reproducible release tooling.<\/li>\n<\/ul>\n<h3>0.0.5<\/h3>\n<ul>\n<li>Legacy controller autoload fixed.<\/li>\n<li>Access moved to the PrestaWard Snapshot root section.<\/li>\n<\/ul>\n<h3>0.0.4<\/h3>\n<ul>\n<li>Clickable Back Office menu.<\/li>\n<li>Full validation of the clean installation and uninstallation cycle.<\/li>\n<\/ul>\n<h3>0.0.3<\/h3>\n<ul>\n<li>Explicit multi-shop context.<\/li>\n<li>Support for dynamic properties in PHP 8.5.<\/li>\n<\/ul>\n<h3>0.0.2<\/h3>\n<ul>\n<li>Authorisation roles and explicit access permissions.<\/li>\n<\/ul>\n<h3>0.0.1<\/h3>\n<ul>\n<li>Baseline, comparison, alerts, cron, logs, update checks and initial dashboard.<\/li>\n<\/ul>\n<\/article>\n<aside class=\"product-page-aside\">\n<div class=\"product-page-aside__card product-page-aside__card--cta\">\n<h2>Guide and support<\/h2>\n<p>Please refer to the user guide for instructions on how to install and configure it correctly.<\/p>\n<p><a href=\"https:\/\/go-onagency.es\/prestaward-snapshot\/prestaward-snapshot-user-guide.pdf\" target=\"_blank\" rel=\"noopener\">Open the user guide<\/a><\/p>\n<\/p><\/div>\n<div class=\"product-page-aside__card product-page-aside__card--contact\">\n<p class=\"eyebrow\">GO ON Agency<\/p>\n<h2>Do you need a meticulous implementation?<\/h2>\n<p>We can help you with installation, change review and getting started.<\/p>\n<p><a class=\"product-page-contact-link\" href=\"mailto:hola@go-onagency.es\">hola@go-onagency.es<\/a><\/p>\n<\/p><\/div>\n<\/aside><\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>PrestaShop module PrestaWard Snapshot Integrity monitoring for PrestaShop shops. Creates a file baseline, compares changes and sends an email alert when anything sensitive is moved. Exclusive distribution on the PrestaShop Marketplace (Addons). Changelog PDF guide Help Guide Screenshots Status summaryJob historySecurity auditAlerts and cron Spanish interface \u00b7 version 0.1.8 Baseline + comparison + alerts Jobs [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"parent":27,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"template-product-page.php","meta":{"_joinchat":[],"footnotes":""},"class_list":["post-38","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages\/38","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/comments?post=38"}],"version-history":[{"count":24,"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages\/38\/revisions"}],"predecessor-version":[{"id":207,"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages\/38\/revisions\/207"}],"up":[{"embeddable":true,"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/pages\/27"}],"wp:attachment":[{"href":"https:\/\/go-onagency.es\/en\/wp-json\/wp\/v2\/media?parent=38"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}