Shop got Hacked

[leet_orange]

Hey guys...

this is my first Post here so please be nice.

In the last two months the shop i build for a costumer got hacked over and over again

they added Paypal and Creditcard information to get some money from the Costumer which tried to checkout with this payments

the store is running on version 1.8.1.0 
I modified a script so they cannot activate Paypal anymore now they only try to add creditcard informations

They also create a lot of user accounts which i deleat every time.

I allready changed the passworts of all accounts, the passwort of the Database and the Passwort from the Hoster

Is there something more i can do?

Gretings from germany.

[Mukesh Tiwari]

Hi @leet_orange 

You can do following things which may help you.

1) Inform your hosting provider to scan your application for any viruses or trojans.

2) Check the Magento files and folders permissions once and set those to recommended one.

3) stop using FTP, use SFTP instead.

4) Do not use Magento default admin url.Use a custom url for the admin panel access.

5) Change all the user names and passwords for the cPanel,FTP (better do not use it).

6) If you worked with some third party for development work on your Magento installation then change all user name and passwords. Also change all the admin access granted to them. Any users created for SOAP and REST api access.

7) Add IP restriction to your Magento admin so that it can be accesses from a particular ip address only.

8) Apply all the patches released by Magento.

Also visit https://magento.com/security check the best practices section there.

Hope all above mentioned points will be helpful for you.