Shopify Security Tips for Merchants: How to Protect Your Store and Vet Apps Before You Install

Illustration of an online store protected by a shield and padlock next to a security checklist

Shopify secures its platform, but your store is only as safe as the accounts, apps and code you add to it. Most store compromises do not break Shopify itself; they start with a reused password, a forgotten staff login, or an app nobody checked before installing.

This guide walks through the steps worth doing first and spends extra time on the decision merchants get wrong most often: which apps to install. You will learn how to check who built an app, what the Built for Shopify badge does and does not tell you, and which permission requests should make you stop.

Most of it takes minutes and needs no developer.

1. Lock down your login

Your admin login is the front door to orders, customer data and payouts, so it gets the strongest protection first. These steps follow Shopify’s own account security guidance.

  • Turn on two-step authentication for yourself and every staff member. With it on, a stolen password alone is not enough to log in. Shopify requires it to use Shopify Payments.
  • Add a passkey. Shopify describes passkeys as a more secure replacement for passwords; you unlock one with a fingerprint, face recognition or your device PIN.
  • Save your recovery codes somewhere safe but reachable, such as a password manager. They get you back in if you lose your phone.
  • Use a unique password for Shopify, never one you use elsewhere. Shopify locks accounts whose credentials appear in public data leaks, and you can check yours at Have I Been Pwned.
  • Protect the owner’s email address too. Whoever controls that inbox can start a password reset, so give it the same two-step protection.

Never share your own login with an agency, freelancer or employee. Give each person their own staff account instead, which is the next step.

2. Give people only the access they need

Every staff and agency account is another way into your store, so each one should hold the smallest set of permissions that gets the job done. Shopify’s role examples show what that looks like in practice:

RoleTypically needsKeep out of reach
Warehouse and fulfillmentOrders (view, fulfill, ship), Inventory, view-only ProductsFinance, customer data, store settings
BookkeeperFinance (payouts and billing), Analytics, view and export OrdersEditing, refunding or canceling orders
Developer or agencyOnline store and app and channel permissions, scoped to the projectAnything outside the project, such as finance and customer data

For freelancers and agencies, use a collaborator account rather than handing over a login. The flow gives you several chances to say no:

  • The 4-digit access code is yours to control. Only Partners you give the code to can send a request. You find it under Settings > Users > Security, and you can generate a new one at any time to cancel the old one.
  • Check every request before accepting. In Settings > Users, filter by Requests and read the Partner details, such as “Partner since” and “Request sent from”. If you did not expect the request, reject it and contact the Partner directly.
  • Scope the role. Accept only the permissions the project needs, and limit access to specific apps and channels where you can.
  • Remove access when the work ends. Collaborator access also expires on its own after 90 days without a login, but do not wait for that.

Finally, put a recurring reminder in your calendar to review the Users list each quarter. Remove former employees and finished contractors, and look again at anyone with sensitive permissions.

3. Vet every app before you install it

An app can read and often edit your orders and customers, and many also add code to your storefront, so two minutes of checking before you click Install is the best security habit you can build. Work through these steps in order.

  1. Find out who built it. Open the developer’s name and website from the listing. Look for a real company with a working website, a named team, a support address on its own domain (not a free mail account) and a track record of other apps. If you cannot tell who is behind an app, do not install it.
  2. Check for the Built for Shopify badge. It is a strong positive signal, but read the table below first to see what it does and does not cover. You can filter App Store search results to show only Built for Shopify apps.
  3. Read the permissions on the install screen. Shopify groups them as “View personal data” and “View and edit store data”, and you can expand each group. Ask whether every permission makes sense for what the app does. A wishlist app that wants to edit orders, or an SEO tool that wants customer data, deserves a question to the developer. Shopify reviews apps that request access to all orders, which makes that scope worth a closer look.
  4. Open the privacy policy. Every listing must link to one explaining what data the app collects, how it is used and kept, where it is processed and how to contact the developer. A missing, copied or vague policy is a red flag.
  5. Read recent reviews, not just the average. Look for patterns in 1-star and 2-star reviews, and check whether the developer replies. Shopify prohibits fake reviews and incentivized reviews, so a burst of short, glowing reviews posted in the same week is a reason for caution.
  6. Be suspicious of installs that start outside the App Store. Shopify requires installs to begin from a Shopify-owned surface and forbids asking merchants to type in their store domain by hand. An email or chat message pushing you to install a specific app is a scam signal.
  7. Try it on a duplicate theme or development store first, and use the free trial to see what it changes. Apps that use theme app extensions leave less behind when removed.
Install an app only when every check passesInstall an app only when every check passesBuilt for Shopify badge: a plus, not a passDo you know which company built it?Do its permissions match what it does?Is the privacy policy clear and specific?Do recent reviews and support look genuine?Install and test on a duplicate themeStop hereAsk the developer why,or choose another appyesyesyesyesnononono

Any “no” ends the install. If every answer is yes, install on a duplicate theme first and add the app to your quarterly audit.

What the Built for Shopify badge tells you

The badge means an app met Shopify’s standards for performance, design and integration. Shopify reviews the status at least once a year and apps can lose it. It is not described as a security or data-protection certification, so treat it as one input, not a verdict.

The badge does checkThe badge does not promise
Storefront impact: the app may not lower the Lighthouse performance score by more than 10 pointsA security audit or data-protection certification
Good standing: at least 50 net installs from active paid-plan shops, at least 5 reviews, and no outstanding Partner Program violationsThat the app fits your store, or is fairly priced
Clean integration: latest App Bridge and theme app extensions for storefront elementsThat the app will keep meeting the standard forever
Limited theme file changes: Asset API use is restricted and auditedThat a newer app without the badge is unsafe

4. Audit your installed apps every quarter

An app you stopped using still holds access to your store, so a quarterly review matters as much as the first check. Shopify shows most of what you need in Settings > Apps.

  1. List every app and ask if you still use it. Include apps a former employee or agency installed. If nobody can explain why an app is there, it is a candidate for removal.
  2. Open each app and read “Activity and permissions”. It shows which store areas the app can view or edit and the date of its last activity in each. Permissions it has not used in the last 30 days appear under “Unused access”. This applies to third-party apps only.
  3. Check the Privacy section. It lists the personal data the app can access, grouped by category such as Customers and Staff and contributors, and links to the developer’s privacy policy.
  4. Uninstall what you do not need. Use the three-dot menu on the app’s page. Do not rely on simply ignoring an app, because its access stays active until you remove it.
  5. Look for leftovers in your theme. Apps built with theme app extensions are removed cleanly with the app, but older apps can leave code behind in theme files. In the theme editor, switch off any unused App embeds. Then work on a duplicate of your theme, search it for the removed app’s name, and ask the developer or a trusted expert before deleting lines you are unsure about.

If an app’s permissions look wider than its job, email the developer and ask why. A good developer answers clearly and may reduce the scopes; a vague answer is useful information too.

5. Recognize phishing and fake support

The easiest way into a strong store is the person running it. Shopify’s own ecommerce security guide cites IBM’s 2025 Cost of a Data Breach Report, which found phishing responsible for 16% of the breaches studied, the most common entry point. Fake messages also arrive as calls (vishing) and texts (smishing), not only email.

  • Shopify Support never asks for your password. Anyone who does is not Shopify.
  • Do not trust the sender name. Merchants have reported fake support emails that display an address on a Shopify subdomain, and one commenter in that community thread pointed out that the visible From field can be set to anything.
  • Never log in through an email link. Type the admin address yourself or use a bookmark, then check whether the same notice appears inside your admin.
  • Verify changes through a second channel. If someone asks you to change a login, a payout bank account or a payment destination, confirm it by phone or in person with someone you already know.
  • Expect collaborator requests. Only Partners you gave your access code to can send one. An unexpected request, or a stranger asking you for the code, is a scam signal.
  • Be wary of urgent “compliance” or “security patch” emails. Pressure and deadlines are how phishing works. Pause, then check your admin directly.
  • Make sure real Shopify emails reach you. Check your filters so genuine alerts do not land in spam, where you would miss them.

If you do click or enter details, act at once: change your email and Shopify passwords, review your account and financial activity and your recent orders, and contact Shopify Support, as Shopify’s account security guidance advises.

6. Treat themes and custom code with care

Any script in your theme runs for every visitor, so each pasted line deserves the same scrutiny as a new employee. Shopify’s guidance on customizing themes is to duplicate your theme as a backup copy before you edit it, and to edit code only if your theme lacks a setting for the change and you are comfortable with HTML, CSS and Liquid.

  • Start from a trusted source. Choose themes from the Shopify Theme Store or from developers with a visible company, reviews and a support channel, and check the theme’s support level. Avoid “free” or cracked copies of paid themes, which are a classic way to ship hidden malicious code.
  • Never paste code you do not understand. Snippets from forums, videos and cold emails can send visitor data to someone else’s server. If a tutorial asks for a script from an unknown domain, skip it.
  • Always work on a duplicate. Make the change on the copy, preview it, then publish. If something breaks, the original is one click away.
  • Prefer app blocks and app embeds to hand-edited code. Apps built with theme app extensions switch on and off from the theme editor and disappear with the app. Built for Shopify apps also face limits on editing theme files through the Asset API, which is audited.
  • Keep a change log. Write down every custom snippet, who added it and when. It makes the quarterly audit in step 4 much faster.
  • Limit who can edit code. Theme and Online store permissions belong only to people who need them, as covered in step 2.

One reassurance: Shopify’s ecommerce security guide notes that store owners cannot modify the underlying checkout code, which makes Shopify stores less exposed to card-skimming malware than self-hosted shops. That is a reason to keep it that way, and to be careful with any app or script that promises to change the checkout.

7. Protect checkout, payments and customer data

Shopify says it is certified Level 1 PCI DSS compliant, and that this extends by default to every store on the platform. That covers the infrastructure. What happens to card details and customer data after they reach your team, your apps and your spreadsheets is up to you.

  • Keep card data out of your own tools. Never ask customers for card details by email or chat, and never store card numbers in order notes, emails or spreadsheets.
  • Use fraud analysis on every order. Shopify rates each order low, medium or high risk. Review high-risk orders before you fulfill them. Shopify’s ecommerce security guide suggests using Shopify Flow to send them to manual review automatically.
  • Check your fraud prevention settings carefully. Under Settings > Payments > Shopify Payments > Manage > Fraud prevention you can set AVS and CVV requirements. Shopify notes that AVS is off by default and that enabling it can raise false declines, so look at your order risk reports before you change anything.
  • Limit access to customer data. Only staff who handle support or marketing need the Customers permission. Export customer lists only when you must, store the file securely, and delete it afterwards.
  • Collect only what you need. Every extra field, tracking pixel and app that touches customer data adds risk and legal duties. If you sell to customers in the EU or UK, privacy laws such as GDPR apply to the data you hold.
  • Publish a clear privacy policy for your own store that matches what your apps actually do.

If a tool promises to change or “improve” your checkout, treat it as high-risk and apply every check from step 3 twice.

8. Secure your domain and email

Whoever controls your domain controls your store address and your email, so the account where you registered it needs the same protection as your Shopify login.

  • Protect the registrar account. Use a unique password and two-step authentication, and keep its recovery email current.
  • Keep the transfer lock on unless you are actively moving the domain, and keep auto-renew and a valid payment method in place so the domain cannot lapse.
  • Authenticate your sending domain. Shopify authenticates marketing emails by default, sending from a shopifyemail.com subdomain if you have not set up your own. Authenticating your own domain is optional but recommended, and it stops scammers from sending fake messages that appear to come from your store.

To authenticate your own domain, follow Shopify’s email deliverability guide: connect the domain, add the CNAME records for SPF and DKIM, then add a DMARC record. A DMARC record tells mailbox providers what to do with messages that fail authentication and shows you how your domain is being used. A safe first record only monitors, so nothing is blocked while you check the reports:

v=DMARC1; p=none; rua=mailto:[email protected]

This is a TXT record added at _dmarc.yourstore.com. Once the reports show only your own legitimate senders, you can move to a stricter policy.

9. Prepare for the worst: backups and a response plan

No checklist makes you immune, so decide now what you will do on the day something goes wrong.

Keep your own backups. Duplicate your theme before every change, and export your products, customers and orders on a regular schedule. Exports contain personal data, so store them in a protected place and delete old copies.

Watch for signals. Review your Users list and installed apps every quarter, and pay attention to unexpected login alerts, new staff or collaborator requests, and password reset emails you did not ask for.

If you suspect a compromise, act in this order. The first three steps follow Shopify’s account security guidance.

  1. Contact Shopify Support immediately.
  2. Change your email and Shopify passwords.
  3. Review your account and financial activity, and check your recent orders.
  4. Remove any staff, collaborator or app you do not recognize, and generate a new collaborator access code.
  5. Confirm that your payout bank details and domain settings have not changed.
  6. Change passwords for connected services, such as your registrar and email provider.
  7. If customer data may have been exposed, check the breach-notification rules that apply where you and your customers are located, and write down what happened and when.

Print this list, add the location of your recovery codes, and give a copy to one person you trust.

Your Shopify security checklist

A secure store comes from a handful of habits repeated every quarter. Tick these off, then put the review in your calendar.

  • ☐ Two-step authentication is on for every account, and the owner has added a passkey
  • ☐ Recovery codes are saved in a password manager
  • ☐ The owner email and the domain registrar account are protected with two-step authentication
  • ☐ Every person has their own staff account with a limited role
  • ☐ Agencies and freelancers use collaborator accounts, and finished projects are removed
  • ☐ Each new app was checked for its developer, badge, permissions, privacy policy and reviews
  • ☐ Unused apps are uninstalled and leftover theme code has been checked
  • ☐ The theme is duplicated before every edit, and no unknown scripts are pasted in
  • ☐ High-risk orders are reviewed before fulfillment
  • ☐ The sending domain is authenticated with SPF, DKIM and DMARC
  • ☐ Products, customers, orders and the theme are backed up on a schedule
  • ☐ A printed response plan exists, with the recovery codes’ location

If you remember one thing, make it this: before you install any app, find out who built it, read what it can access, and treat the Built for Shopify badge as a good sign rather than a guarantee.

About Sezerium

Sezerium is a Shopify Partner that builds apps for merchants, and we try to follow the advice in this guide ourselves. Stamp Show Variants Collection and Stamp Custom Invoice Generator both carry the Built for Shopify badge, and our free variant-level wishlist app, Stamp Wishlist & Back in Stock, is on the App Store too. Every listing shows the permissions it asks for before you install, so you can run the checks from step 3 on our apps as well.

Sources

All Shopify pages below were opened and read for this guide.

Share this article

Recommended Articles

Create your account