Настройки в админке такие:
.htaccess переименовал, выглядит он так:
# Подробнее на https://myopencart.com
Options +FollowSymlinks
# Запретить листинг директорий
Options -Indexes
# Закрыть доступ к файлам шаблонов
<FilesMatch "\.(tpl|ini|log|txt)">
Order deny,allow
Deny from all
</FilesMatch>
<Files robots.txt>
Allow from all
</Files>
# Необходимо для ЧПУ.
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([^?]*) index.php?_route_=$1 [L,QSA]
### Additional Settings that may need to be enabled for some servers
### Uncomment the commands by removing the # sign in front of it.
### If you get an "Internal Server Error 500" after enabling, then restore the # as this means your host doesn't allow that.
# 1. If your cart only allows you to add one item at a time, it is possible register_globals is on. This may work to disable it:
# php_flag register_globals off
# 2. If your cart has magic quotes enabled, This may work to disable it:
# php_flag magic_quotes_gpc Off
Проблема осталась. Где еще покопать?