The store has stopped working. The first thing to do is not to rush: half of the irreparable damage is done in the first few minutes, when files start getting deleted at random.
Step 1. Establish the nature of the problem
- A blank page — execution stopped with error output disabled. The cause is usually in the code or in exhausted memory.
- A 500 error — the details are in the web server log; often a configuration error or a broken modification.
- A database connection error — the database is not responding, or the connection limit has been reached.
- A redirect to somebody else's site — almost always an infection, not a failure.
- The site opens but very slowly — that is not an outage but overload, and the procedure is different.
Step 2. Recall what changed
In the overwhelming majority of cases a specific action preceded the failure: a module was installed, a version updated, a hosting setting changed, the disk filled up. Answering "what was done just before this" shortens the search dramatically.
Step 3. Read the logs
Not one log but all of them: the store's, PHP's, the web server's. The most common mistake is opening the store log, seeing an empty file and concluding there is no cause. Fatal errors never reach it, because execution stops earlier.
What NOT to do
- Do not delete suspicious files at random — it is easy to remove a working core file along with the backdoor.
- Do not restore blindly from an old backup if you suspect an infection: it may be older than the copy.
- Do not change every password at once during an infection — first establish the entry point, or the new credentials will leak the same way.
- Do not clear the modification cache by hand: in OpenCart it is not a cache, and without those files the store stops working entirely.
When you need urgent help
If the store is down during business hours, every hour is lost orders. For those cases there is emergency recovery with a 24-hour response: restore service first, find the cause second.
If it is specifically an infection, the procedure is described in detail in the article on what to do in the first hours after a compromise. So that next time recovery takes an hour rather than a week, you need backups with verified restores.
