PrestaShop store audit on takeover: what to check before you change anything
A PrestaShop store audit on takeover is a description of the store's state before you start working on it: who has access, which PrestaShop and PHP versions it runs, which modules are installed, what was changed in the files, what errors are in the log and how the store looks in Google. The result is a client report and a prioritised list of risks.
Author: The TellMyShop team. A guide for PrestaShop store owners: the cause, the manual fix and the same work in a chat conversation.
Last updated: · 6 min read
Why audit when the client only wants a “small fix”?
Because you do not know the store's history. The previous agency may have changed PrestaShop files, added overrides, installed a module from an unknown source or left developer mode on. Your first small fix will run into all of that.
The audit protects both sides. The client gets a clear picture of what they are paying for. You have the starting state on record and know what not to touch without a backup. When payment stops working in the second week, you can show that the payment module was out of date from the start.
A store audit and an SEO audit are two different things. If the client only asks about visibility in Google, use the checklist in the guide PrestaShop SEO audit. This article is about a full store takeover.
The store takeover checklist
Go through it in this order. The first rows cover what can stop the store or compromise security.
| Area | What to check | Where | Warning sign |
|---|---|---|---|
| Access | who has a back office account, who has hosting and FTP access | Advanced Parameters → Team, hosting panel | a shared “admin” account, accounts of former agency staff |
| Backups | whether they exist, where they are, when a restore last worked | hosting | no backups, or backups only on the same server |
| Versions | PrestaShop, PHP, MySQL | Advanced Parameters → Information | unsupported PHP, PrestaShop without security fixes |
| Modules | list, versions, source, updates | Modules → Module Manager | modules from outside Addons with no author, modules with published vulnerabilities |
| File changes | overrides, changed core files, child theme | the override folder, the list of changed files in Information | changes to the core, a theme with no child theme |
| Errors | the log from the last few weeks | Advanced Parameters → Logs | recurring critical errors |
| Settings | developer mode, cache, SSL | Advanced Parameters → Performance, Shop Parameters | developer mode on in production |
| SEO | titles, descriptions, redirects, sitemap | product page, sitemap module | empty meta on best sellers, many 404s |
| Search Console and analytics | the client's Google account | nobody in the company has owner access | |
| Sales | a baseline from the last few months | Stats | no data to compare against after your changes |
Server requirements for PrestaShop 8 are in the developer documentation. You can check end-of-support dates for PHP versions on the PHP website. Modules with published security vulnerabilities are collected in the Friends of Presta repository. It is worth checking it for every module from outside the PrestaShop catalogue.
Day one, step by step
- Create your own employee account in the back office. Do not work on the client's account or a shared login.
- Make a full backup of the files and the database and check that it can be downloaded.
- Record the versions of PrestaShop, PHP and the theme. Take a snapshot of the module list with versions.
- Review overrides and changed files. These are the places that will be lost or break during an update.
- Read the error log from the last few weeks and group the errors by module.
- Check SEO and 404s, so you know what already works in Google and what not to break.
- Record a sales baseline from the last few months.
- Write the report in three parts: urgent, important, some day. For each point, one sentence on why it matters to the client.
When a PrestaShop update appears in the report, hand it over as a separate project. We describe the preparation in the guide upgrading PrestaShop to 9, and tidying up modules in the article on unused modules.
How does the chat collect data for the report?
Most of the time in a takeover goes into clicking through tabs and copying data into the report. The TellMyShop module lets you collect it in one conversation with your chat (Claude or ChatGPT), while you focus on the assessment.
You: New client. Give me the PrestaShop and PHP version, the theme, active and disabled modules, the technical check result, errors from the log for the last 30 days and anything risky. Don't change anything.
Your chat: PrestaShop 8.1, PHP 8.1, a theme based on Classic with no child theme. There are several dozen modules, a few disabled for a long time. In the technical check, developer mode is on. A price comparison module error keeps repeating in the log. The override folder has overrides of the Cart class from a module that is no longer on the list. Risks for the report:
You: Add the SEO and 404 audit as a separate part of the report.
Card status: waiting for your “yes”new version: urgent: turn off developer mode, investigate the orphaned cart override
new version: important: a child theme before any change to the look, update PHP to a supported version
new version: some day: tidy up the disabled modules
The versions and findings in the example are made up. The chat will give the store's real data and flag what it could not check.
What you will see in which version:
- TellMyShop Free is enough for a quick picture: store version, technical check, module list, error log, SEO, 404s and sales.
- TellMyShop Pro reads the whole store: theme and module files, overrides, settings and the database. Reading alone needs no switch to be turned on, and nothing is saved without your “yes”.
- Fixes after the audit, for example turning off developer mode or changing a file, need the Theme, Modules or Service switches, which the store owner turns on for a limited time in the module panel. Every change has a preview and goes into the change history.
What the chat will not check: employee accounts, passwords, permissions, API keys and files with database passwords. These are permanent blocks, the same in both versions. Nor will it look into the hosting panel or Search Console. You do those parts of the audit yourself.
For agencies and freelancers there is a Pro package for several domains, and test domains such as staging or dev work without limit. Details are on the pricing page. You will find the example request from this article in the use case first review of a new client's store, and the full SEO audit in the use case full store SEO audit.
What do you hand to the client after the audit?
A short report the owner will read, not just the developer. At the top, three urgent things, each with one sentence on the risk to sales. Below that, the full list from the table and the starting state: versions, modules, a backup with its date. Add a proposed order of work and what you will not do without the client's approval.
You can run the first review in TellMyShop Free, installing the module on the client's store with their permission. You will find more guides for people who run stores on the blog.
Questions and answers
How is a store audit different from an SEO audit?
An SEO audit checks how Google sees the store: titles, descriptions, URLs, redirects. A takeover audit is broader. It also covers access, PrestaShop and PHP versions, modules, file changes, errors and backups, meaning everything that can blow up in the first week.
Where do I start when taking over a store from another agency?
With your own access and a backup. Ask the client for a separate employee account in the back office, access to the hosting and to Search Console. Before you change anything, make a full backup of the files and database and record the starting state.
Can I fix errors straight away as part of the audit?
Better not. First describe the state, agree priorities with the client and only then make changes. Otherwise every failure in the first week will look like your fault, even if the problem was there before.
Is the free version of TellMyShop enough for a first review?
For a quick picture, yes. TellMyShop Free reads the store version, the technical check, the module list, the error log, SEO, 404 errors and sales. Theme and module files, overrides and the database are read only by TellMyShop Pro, still without saving anything until you approve it.
Will the chat check employee accounts and passwords?
No. Employee accounts, passwords, permissions and files with database passwords are permanently blocked for TellMyShop, in Pro too. You do that part of the audit yourself in the back office, in Advanced Parameters → Team, and with the host.
PrestaShop is a registered trademark of PrestaShop SA. Claude is a trademark of Anthropic PBC. ChatGPT and OpenAI are trademarks of OpenAI. TellMyShop is not affiliated with these companies.