Shopify security: what Shopify doesn't protect for you
In short
The platform is secure: Shopify protects the servers, the patches and card payments, but not your staff accounts, the apps you install, the code added to your theme or third-party scripts. That is where almost every security problem in a Shopify store starts. WebIntacta's external scan is free; the inside review, with a read-only app you create in your own store, is quoted by the hour.
“I'm on Shopify, so security isn't my problem.” I hear it often and it is only half true. Shopify takes care of the servers, the patches and the part of checkout that handles cards. But who gets into your admin, which apps are allowed to read your orders and what code runs on your pages are your decisions, and that is where problems appear.
By Jose SorianoLast updated: 4 min read
What Shopify protects and what it doesn't
| Area | Who protects it |
|---|---|
| Servers, operating system and platform patches | Shopify |
| Card processing (Shopify is PCI DSS Level 1) | Shopify |
| HTTPS certificate for your domain | Shopify (if the DNS points correctly) |
| Staff and collaborator accounts, and their two-step authentication | You |
| Installed apps and the permissions you give them | You |
| Theme code (Liquid and JavaScript) and anything added by hand | You (or whoever edits it) |
| Third-party scripts, pixels and marketing tags | You |
| Domain DNS and email (SPF, DKIM, DMARC) | You and your registrar |
The usual split of responsibilities in a hosted store.
A Shopify store has no PHP files to clean and no database to hide a backdoor in. When there is something malicious, it lives in one of three places: an account with access it shouldn't have, an app with more permissions than it needs, or a script in the theme or in an app that copies what the customer types.
1. Staff and collaborator accounts
- Two-step authentication for everyone, the owner included. In Settings → Users and permissions you can see who has it turned on.
- One user per person, with only the permissions they need. Never share the owner account with the agency or with whoever runs your ads.
- Collaborators: agencies and developers get in with a collaborator access request from their Partner account. Review the list and remove anyone who no longer works with you; a former collaborator who still has access is far more common than a platform flaw.
- Protect the owner's email. Whoever controls that inbox can recover the store account. It is the target of fake emails that imitate Shopify and ask you to “verify your store”.
2. Apps and their permissions
Every app asks for permissions when you install it: read orders, customers, products, modify the theme… An app allowed to read customers sees the data of all your customers, and if that app is abandoned or compromised, the problem is yours.
- Check your installed apps in Settings → Apps and sales channels and uninstall the ones you don't use. Uninstalling removes API access; also check that no leftover code stays in the theme.
- Before installing, look at the permissions it requests and ask yourself whether they fit what it does. A reviews app doesn't need to modify orders.
- Custom-built apps (with an API token) are the most sensitive: the token gives direct access. Give them only the permissions they truly need and delete them when they are no longer used.
3. Theme code
The theme is code: Liquid templates, JavaScript and CSS. Anyone allowed to edit it, and any app that modifies it, can add a script. A skimmer on Shopify doesn't steal the card from Shopify's payment form (which is isolated), but it can copy data from your own forms, redirect to a fake payment page or load code from another domain.
- In Online Store → Themes → Edit code, every file keeps its version history: if something changed and nobody knows why, you can see when and roll it back.
- Look for
<script src=pointing to domains you don't recognize intheme.liquidand in the sections. - Make big changes on a copy of the theme and publish it once it has been reviewed. Keep a downloaded copy of the published theme.
4. Third-party scripts, pixels and checkout
Advertising and analytics pixels, chat widgets and other widgets run on your store's pages. Custom pixels are in Settings → Customer events; checkout customizations and any additional scripts your store still has are in the checkout settings. Shopify is replacing checkout scripts with extensions and sandboxed pixels, which is safer: if you have old scripts, it is a good moment to review them and remove the ones nobody can explain.
5. Domain, DNS and email
If your store's domain is with another registrar, the security of that account matters as much as your Shopify account: whoever changes the DNS takes your traffic. Turn on two-step authentication there too and delete records that point to services you no longer use. So that your store's emails don't end up in spam and nobody spoofs you, set up SPF, DKIM and DMARC.
How I review a Shopify store
I always start with the free external scan: it detects that the store runs on Shopify, the third-party services it loads, suspicious scripts on public pages, the certificate, the headers, the domain's email setup and blacklists. To look inside, the store creates a read-only custom app with three permissions (themes, script tags and online store pages) and gives me its token: with it I review every file of the published theme, the scripts the apps load, the pages, and that the token has no extra permissions. That review and the manual review of the admin (accounts, apps, pixels, checkout) are quoted by the hour before I start.
Sources
Frequently asked questions
Is Shopify secure?
The platform is: Shopify manages servers, patches and card payments with PCI DSS Level 1 certification. What depends on you are the staff accounts, the apps and their permissions, the theme code and third-party scripts, which is where almost every problem starts.
Can a Shopify store be hacked?
It is rare for someone to get in through a Shopify flaw. The usual causes are a staff account without two-step authentication, a former collaborator who still has access, a compromised app or a script added to the theme.
Do I need a security plugin on Shopify?
Not the way you do on WordPress: there is no server to protect. What helps is reviewing accounts and permissions, uninstalling apps you don't use and watching for changes in the theme code.
How much does a security review of my Shopify store cost?
The external scan is free and needs no sign-up. The inside review with the read-only app and the review of the admin are quoted by the hour, with a fixed price agreed before I start (excluding VAT).