Security concerns after hiring template installation

:wacko: First Zen-Cart Site Version v155e Purchased Responsive Template From Monster Template

First Post. New Member. intermediate code experience; So I downloaded and played with Zen-Cart and decided to use Zen-Cart for our E-Commerce solution. I also wanted to add a fast responsive template. I was not comfortable installing the Responsive Template myself, so I also purchased initial installation from the Template Monster.

With all that said, our site is up and running, we have successfully added and tested site, current Zen-Cart one page checkout, and Zen_cart USPS shipping module. We are using SiteLock, Our Hosting Company is BlueHost. We have SSL in place and are ready to launch the site.

My concern is once the installation service has been completed and everything is ready to go online, how do we know that they don't have background access to our site? More importantly our VeriSign payment gateway? I downloaded the site using Ipswitch WS_FTP and see no obvious hidden files or folders.

Thanking you in advance

ournicknaks:

I also purchased initial installation from the Template Monster.

how do we know that they don't have background access to our site? More importantly our VeriSign payment gateway?

1. You gave them unrestricted access to your hosting account.
   You will need to inspect everything to be sure they haven't added some back-door code somewhere.

2. After you've verified that they've not given themselves any extra undeclared privileges, you should change passwords for your hosting account.
   And you should change your token or password for your Verisign account.

You may find tools like WinMerge and BeyondCompare helpful. References in: http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks

ournicknaks:

I downloaded the site using Ipswitch WS_FTP and see no obvious hidden files or folders.

DrByte:

You may find tools like WinMerge and BeyondCompare helpful. References in: http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks

Adding to the above:
Typically, at least at the "beginning" an existing file is modified rather than adding/creating a new one... The file comparison would be prudent including comparing their template file(s) to the ZC equivalent file(s). The differences/changes made to support their template should be obvious and understood. Its when you start seeing things like encoding or decoding base64, other gibberish, or that information is being unexpectedly emailed that definite concern should be had.

In future you should never give access to your working shop to any third party...make a duplicate elsewhere for them to work on.
Use a one-off/temporary ftp account, a different admin directory name and a new admin account/password that doesn't exist on the real shop.

Many thanks to you all :) Advise all good and direct. I have a direction and some work ahead of me.
I'll be forewarned should the need to use a outside contractor on my site in the future....

Kind regards,

Douglas

Would add that in setting up a one-off site for them to do their edits, that user data be removed from the backup copy of the database (delete all customers in the one-off site after setting it up for the third party). This way your customer's information remains private.

One might suggest to use a ZC default installation with demo product, but it would seem better to use your own product to ensure that the template layout is as you expect for the production site. Though understand that such information is also business private to an extent. (not like someone/something couldn't pretty much gather the product information by crawling the page(s).)

ournicknaks:

Many thanks to you all :) Advise all good and direct. I have a direction and some work ahead of me.
I'll be forewarned should the need to use a outside contractor on my site in the future....

Kind regards,

Douglas

When hiring someone to do an upgrade or make other significant changes on your site, do your due diligence, find someone with a solid reputation. There would be a number of people (members of this forum) who fit that bill.