Secure the business account before the storefront
Protect the store owner, organization administrators, staff accounts, domain registrar, email, payment, and connected social accounts with unique identities and multi-factor authentication. Avoid shared staff credentials. Grant roles according to operational need and review access after personnel, agency, or fulfilment changes.
Keep emergency recovery methods current and controlled. Document who may add apps, change payment settings, edit DNS, export customer information, or publish theme code. High-impact actions should require a second review where the organization can support it.
Govern apps and integrations
Every installed app can introduce code, data access, operational dependencies, and ongoing cost. Before installation, review the vendor, permissions, privacy terms, support model, data location, deletion process, and business owner. Decline permissions that are broader than the feature requires and remove apps no longer used.
For custom and embedded apps, follow Shopify’s current app security guidance. Use official libraries and templates where practical, validate sessions or signed requests, and protect state-changing actions against CSRF. Store access tokens only on trusted server infrastructure and separate credentials by environment.
Validate webhook signatures against the raw request body using the documented algorithm. Enforce size limits, process events idempotently, and handle retries and out-of-order delivery. Do not treat possession of a shop domain or request parameter as authentication.
Build themes without unsafe shortcuts
Keep a version-controlled copy of theme code and use a reviewed deployment process. Liquid escapes should match the destination context. Review raw output, JSON inside scripts, dynamic URLs, third-party snippets, and application blocks. Avoid injecting untrusted data into inline JavaScript or CSS.
Minimize marketing tags and external scripts. A script running in the storefront may observe visitor activity and affect performance or checkout behaviour. Record its owner, purpose, data destinations, consent category, and removal procedure. Use Shopify’s supported extension mechanisms instead of fragile checkout or theme modifications.
Protect customer and order data
Collect and retain only information required for commerce and documented business needs. Limit exports and protect files once they leave Shopify. Staff access, support workflows, spreadsheets, marketing systems, fulfilment services, and analytics platforms are part of the same customer-data boundary.
Custom apps should authorize access for the specific merchant and requested object. Encrypt sensitive data in transit and at rest, maintain deletion workflows, and avoid placing personal data in logs. Test privacy webhooks and any contractual deletion or retention obligations.
Use platform payment flows and approved providers. Do not move cardholder information into custom forms, logs, analytics, or general databases. Fraud tools can support review, but operating procedures still need clear owners for refunds, chargebacks, account takeover, and suspicious orders.
Monitor changes and plan continuity
Review staff access, app installs, theme publications, payout changes, domain settings, and unusual order or login activity. Maintain a clean theme copy and exports needed for business continuity, while recognizing that an export may not recreate every platform configuration or app dependency.
Document how the store would operate during an app outage, payment problem, domain issue, compromised staff account, or malicious theme change. Include vendor contacts, evidence preservation, token revocation, customer communication decisions, and safe restoration.
Shopify security review checklist
- Owner, staff, domain, email, and payment accounts use MFA and individual access.
- App permissions, vendors, data use, and removal procedures are inventoried.
- Themes and custom apps use reviewed code and supported extension points.
- Tokens and webhooks are verified server-side and separated by environment.
- Customer exports, support tools, analytics, and fulfilment systems follow data rules.
- Changes and suspicious activity are monitored with named responders.
- Theme recovery and continuity procedures have been tested.
