Shopify Store Security: A Self-Review Guide

A practical checklist for store owners. Work through it yourself, or ask us to do it with you.

How to use this guide

Start with the first list: it takes about an hour and covers the most important ground. Do the second list over the next month, then repeat the third list every quarter. You do not need to be technical, and you can stop at any point and ask us for help. Where a step depends on your Shopify plan, we say so.

Do today (about an hour)

Check	Where	What good looks like
Owner login protected	Your profile > Security	Passkey and two-step login (authenticator app) both on; recovery codes stored offline; owner is a named person, not a shared login
Staff use two-step login	Settings > Users	Everyone has it on, ideally with a passkey too. On Plus, require secure sign-in for all users; on other plans, ask each person and check
Leavers removed	Settings > Users	No accounts for people who have left or no longer need access
Collaborators reviewed	Settings > Users	Every agency, freelancer and app support account is recognised and still needed; collaborator request code switched on
Unused apps removed	Settings > Apps	Nothing installed that you no longer use
Storefront apps known	Online Store > Themes > Customise > App embeds	You know which apps run on your storefront and how to switch each one off
Checkout tested	Private browser window	From the product page, cart drawer and cart page, the address bar stays on your store, or on shop.app, until the card form appears
Payout emails on	Settings > Payments	You are notified every time a payout is made

Shopify's own step-by-step instructions: passkeys, authenticator app, backup methods and recovery codes and, on Plus, requiring secure sign-in.

Do this month

Make an app list. For each app: what it does, who approved it, what it can access (Settings > Apps, then the app, then Activity and permissions), whether it runs on your storefront, what customer data it holds, and a contact at the developer.
Question mismatched access. If an app can access more than its job needs (for example, a wishlist that can read all orders), ask the developer why or replace it.
Empty custom code boxes. If any app has a custom JavaScript or HTML setting you do not actively use, clear it.
Check custom apps. Under Settings > Apps > Develop apps, delete custom apps you no longer use. If an access token for one has ever been shared by email or chat, ask us to replace it.
Tidy your theme. Ask us to remove leftover code from uninstalled apps, delete any Theme Access passwords no longer needed, and keep a dated copy of your live theme as a backup.
Review staff permissions. Limit the ability to install apps, edit theme code, export customer data and change payment settings to the people who need it.
Check your email domain. Make sure your sending domain is authenticated in Shopify, and ask us about tightening your DMARC policy over time.
Check your data processing agreements. Each app that handles customer data should have one, and you should know how it will tell you about an incident.

Every quarter

Staff and collaborator accounts, including when each last logged in.
Your app list against what is actually installed, and any new access an app has asked for.
The checkout test, from every route into checkout.
Your theme, for leftover code after any app you have removed and for changes you do not recognise.
On Shopify Plus: single sign-on users and your verified domain settings.

Before you install a new app

Does it need to run on your storefront, or can it do its job in the admin?
Does the access it asks for match what it does?
Is there a named company behind it, with a privacy policy, a data processing agreement and a way to report security issues?
Has it been updated recently, and does the developer reply to reviews?

Questions worth asking the developer:

Who in your company can change what your app runs on our storefront, and is that access protected and logged?
How will you tell us if you have a security incident, and how quickly?
What data do you keep after we uninstall, and for how long?
When did you last have a security review or penetration test?
If your app can access any personal data about our customers or staff, for any reason, are your company and your app GDPR compliant, and will you sign a data processing agreement with us?

If an app you use reports a security incident

Switch off its app embed and uninstall it if it is not essential. You do not need to wait for the developer or Shopify.
Ask the developer, in writing, which dates and times your store was affected.
Decide whether customer data may have been exposed. If it may have been, you may need to notify the Data Protection Commission within 72 hours of becoming aware, and possibly your customers. Always take advice if you are unsure.
Re-run the checkout test in a fresh private window, and check your theme files for changes you do not recognise.
Keep a record: screenshots of the store activity log (it shows only recent entries and cannot be exported), the developer's emails, and what you did and when.

What Shopify covers, and what you cover

Shopify	You
Platform, hosting and SSL	Who can log in, and with what permissions
Checkout security (PCI DSS Level 1)	The apps you install and what they can access
Removing apps that break its rules	Code added to your theme and storefront
	Your data protection obligations to your customers

How we can help

We can work through this guide with you, or carry out a store security review: access and permissions, every installed app and what it can reach, your theme and storefront scripts, and your checkout. You get a short, prioritised list of findings, and we can make the fixes for you.

This guide is general guidance based on Shopify features as of October 2026. It is not legal advice or a full security assessment. Shopify changes its admin regularly, so menu names and options may differ on your store. If you think your store or your customers' data has been compromised, contact Shopify Support straight away and take advice on your data protection obligations.