Quick answer
To detect and remove a WooCommerce card skimmer: review the checkout and payment files for injected JavaScript that captures form fields, check for unauthorized changes to theme and plugin files and the database, remove the malicious code and its backdoor, rotate all credentials and payment keys, and notify your payment processor if data was exposed.
Key takeaways
- Skimmers are silent — the store works normally while card data leaks.
- The malicious code usually hooks the checkout form via injected JavaScript.
- After removal, rotate payment keys and consider breach-notification duties.
Of all the ways a store can be compromised, a card skimmer is among the most damaging — and the quietest. The store keeps working while customer card details leak with every purchase. Catching it fast matters.
How skimmers work
Attackers inject JavaScript that hooks into your checkout form and captures card numbers as customers type, sending them to a server the attacker controls. Nothing looks wrong to the shopper or, usually, to you.
Signs to watch for
- Unexpected or obfuscated JavaScript in checkout and payment files
- Customers reporting card fraud after buying from you
- Your payment processor flagging suspicious activity
Find and remove the code
Review checkout and payment-related files and the database for injected scripts. Compare files against clean copies to spot changes. Remove the skimmer and the backdoor that placed it — a leftover means reinfection.
Rotate everything
Change all passwords and, critically, your payment gateway API keys. Assume anything the attacker could reach is compromised.
Handle the fallout
If customer payment data was exposed, contact your payment processor and understand your notification obligations. Then harden the store so it can't happen again.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Signs include unexpected JavaScript in checkout files, customer reports of card fraud after buying from you, or your payment processor flagging suspicious activity. A thorough checkout-focused scan confirms it.
Keep reading
Website Suspended by Your Host? How to Get It Back Online
If your host suspended your account for malware, here's how to clean the site to their standard and get it reactivated.
How to Request a Google Security Review After a Hack
Cleaned the hack but Google still warns visitors? Here's how to request a security review and get the warning lifted — the right way.
How to Remove Hacked Spam Pages From Google Search
Hundreds of spam pages indexed under your domain? Here's how to remove them from Google and recover your search presence.