Shopify does a lot of the security heavy lifting for you. It hosts your store, keeps the platform patched, and runs a locked-down checkout that it certifies to the payment card industry's highest standard (PCI DSS Level 1). That is a big part of why merchants choose it.
But some parts of store security are yours: who can log in to your admin, which apps you install, and what code runs on your storefront before a shopper reaches checkout. Recent confirmed reports of a number of Shopify apps being misused to redirect shoppers to a fake payment page are a useful reminder that, these days, most of the risk comes through the tools around a store rather than through Shopify itself.
None of this calls for panic. Most of the checks below take a few minutes, and the rest are worth doing once a quarter.
What Shopify looks after, and what it leaves to you
Shopify looks after the platform, hosting, SSL certificates and the checkout itself, where only Shopify-approved code runs. You look after your logins and staff permissions, the apps you install and what they can access, anything added to your theme, and your own data protection obligations as the business your customers buy from.
1. Lock down the store owner account
The store owner login is the most powerful account on your store: only the owner can transfer the store, change payout bank details or transfer your domain. It should belong to a named person, never a shared login, and it should be protected with both a passkey and two-step login with an authenticator app. Shopify treats these as separate: a passkey replaces your password, while two-step login adds a second check, and Shopify recommends having both. Its Help Center explains how to set up a passkey and set up an authenticator app. Keep the recovery codes somewhere safe and offline.
2. Turn on two-step login for everyone
Every staff member can turn on two-step login under their own profile, in Your profile > Security. On Shopify Plus you can make secure sign-in compulsory for all users; on other plans you cannot force it, so ask your team to switch it on and check that they have. Passkeys are the strongest option, so encourage everyone to add one as well.
3. Tidy up staff and collaborator access
Agencies, freelancers and app support teams usually access your store through collaborator accounts. Review Settings > Users regularly, remove anyone who no longer needs access, and keep the collaborator request code switched on so that only people you have given it to can ask for access. When a request comes in, trim the permissions to what the job needs before you approve it.
Practical note: be wary of unsolicited offers of help from "Shopify experts" asking for access. Shopify will never ask you for your password.
4. Keep fewer apps, and know what each one can reach
Every app is a supplier with a key to part of your store. Settings > Apps now shows, for each third-party app, which areas of your store it can access, how often it has used that access in the last 30 days, and any access it has not used. If a wishlist app can read all your orders, or a pop-up app can edit your theme, ask why.
It is worth knowing that App Store approval and the Built for Shopify badge are about quality and performance. They are not a security certification. Before installing, check who is behind the app, whether it has a privacy policy and a data processing agreement, whether the company and the app are GDPR compliant if it can access any personal data, and whether you really need it.
5. Know how to switch off your storefront apps
Many apps add features to your storefront through app embeds, which you can see and switch off under Online Store > Themes > Customise > App embeds. Know where that is before you need it. If an app offers a box for custom JavaScript or HTML, leave it empty unless there is a clear reason to use it.
6. Clean up after uninstalling an app
Uninstalling an app removes its access, but Shopify notes that some apps leave code behind in your theme. After removing an app, check your theme for leftover snippets, or ask your developer to. If the app held customer data, ask the developer to confirm it has been deleted.
7. Test your checkout regularly
Once a month, open a private browser window, add a product to your cart and click through to checkout from the product page, the cart drawer and the cart page. Your own store's address should stay in the address bar until the card form appears. Note, if using ShopPay, you may be taken to the shop.app URL. If you ever land on an unfamiliar web address, switch off your storefront apps one at a time, then contact Shopify Support and get in touch with us straight away.
8. Keep your paperwork in order
As the business your customers buy from, you are responsible for how their data is handled, including by the apps you use. Keep a simple list of your apps, what customer data each holds and who to contact there, and make sure each one that handles customer data has a data processing agreement. If a supplier has a security incident that affects customer data, you may have 72 hours to notify the Data Protection Commission, so it helps to know who decides that in your business before it happens. Always take advice if you are unsure.
The Bottom Line
Shopify gives you a secure platform. Keeping your store secure on top of it is mostly good housekeeping: strong logins, tidy access, using fewer apps you understand well, and a regular look at your checkout. An hour today and a short review every quarter covers most of it.
If you would like a second pair of eyes, our team can review your store's access, apps, theme and checkout and give you a short, prioritised list of what to fix. Get in touch.
This article is general guidance based on Shopify features as of October 2026. It is not legal advice or a full security assessment, and Shopify changes its admin regularly, so check Shopify's Help Center for current steps. If you think your store or your customers' data has been compromised, contact Shopify Support straight away and take advice on your data protection obligations.
