Guide

Shopify store security: what merchants have to do themselves

By Lucas Weber, CyberSec42 · Updated 28 Oct 2026

Shopify secures the platform: servers, hosting, encryption and the payment step at checkout. Everything you set up in your own store is your responsibility: who has access and with which permissions, how logins are protected, which apps can read your customers' data, what third-party code runs in your theme and whether a fake “Shopify” email gets you to hand over your password. This guide shows, in plain steps, what the owner of a small store can check and configure without help, and ends with a checklist.

This article is deliberately Shopify-specific. For the general 15-minute check that works for any website, whether WordPress, Wix or Shopify, see our small business website security checklist. Here we focus on the settings and habits that only matter in a Shopify store.

Who is responsible for what?

With Shopify you rent a ready-made store. Shopify runs the technical foundation, so you never patch a server or update shop software. This is called shared responsibility: part of the job sits with Shopify, and part always sits with you.

That leads to a simple rule: with Shopify, attackers rarely break “into the server”. They take over an account because a password was phished, or they use an app or script you gave access to yourself. That is where the following steps come in.

1. Staff accounts and permissions

In small businesses it is common for everyone to work under the owner's login. Shopify explicitly advises against it: the store owner should not share their login credentials with anyone, including staff. Instead, every person gets their own account.

• Create individual accounts. Invite each person under Settings, Users. Only then can you see who changed what, and only then can you revoke one person's access without locking out everyone else.
• Grant permissions by need. Shopify uses roles that define what someone can see and do, such as managing products or handling orders. Someone who only uploads products does not need access to payouts, customer data or apps. If a user has several roles, the permissions of all roles add up, so check the complete picture.
• Control partner access. Agencies and developers work through collaborator accounts. They can only send a request if you give them the four-digit request code from Settings, Users, Security. Generating a new code invalidates the old one. Before accepting, you see which permissions are requested and can narrow them down.
• Remove access nobody needs. Shopify recommends deactivating unused logins. You can suspend an account (and reactivate it later) or remove it permanently. According to Shopify, collaborators who have not logged in for 90 days lose access automatically.
• Sign out lost devices. If a phone or laptop goes missing, you can revoke that device's access on the user's page.

A good rhythm for small stores: once a quarter, open the user list and ask for each entry whether the person still needs access today and whether the permissions still fit.

2. Protect logins with a second factor

A password alone is not enough, because it can be phished, guessed or taken from someone else's data breach. With a second factor, an attacker also needs something only you have, such as your phone.

• Turn on two-step authentication. Shopify supports, among other methods, an authenticator app on your phone that generates one-time codes, and a physical security key. If you use Shopify Payments, two-step authentication is mandatory; according to Shopify, payouts might otherwise be put on hold.
• Use passkeys. A passkey replaces the password with the way you unlock your device: fingerprint, face recognition or PIN. Shopify says passkeys help you avoid phishing scams and stolen passwords. Create a second passkey on another device as a backup.
• Store recovery codes safely. During setup, Shopify offers codes to download that let you sign in if your phone is gone. Keep them separate from the phone, for example printed or in a password manager.
• Every person sets it up themselves. The store owner cannot turn on two-step authentication for other staff members. Ask everyone to do it and follow up. Only stores on Shopify Plus can require a secure sign-in method for all users.
• One password per service. Shopify recommends a unique password for each account and a password manager. If your credentials show up in a public data leak, Shopify locks the account until you reset the password.

3. Apps: the biggest risk in your store

Apps make Shopify flexible, and that is exactly why they are the most important point in this guide. According to Shopify, most apps are built by third-party developers, not by Shopify. An app that can read orders or customer data keeps that access for as long as it is installed. If the developer is compromised or the app is poorly built, your store is affected.

• Read the permissions before installing. The install screen shows which personal data the app can view, such as customers, and which store data it can view and edit, such as products, orders and discounts. Shopify advises reviewing this carefully. Ask yourself whether it fits the job: a product review app has no business touching discount codes.
• Look at the developer's privacy policy. It is linked from the install screen and explains what the developer does with your customers' data.
• Install from the App Store only. Apps listed in the Shopify App Store go through a verification and approval process. According to Shopify, apps installed via third-party links outside the App Store have not.
• Clean out installed apps regularly. Uninstall what you no longer use under Settings, Apps. Every removed app is one less party with access to your data. You can check an installed app's permissions at any time on its about page.
• Check your theme after uninstalling. Shopify notes that some apps add code to your theme that is not removed automatically when you uninstall them. Ask the developer for removal steps or have your agency do it. Export any data you still need beforehand.
• Cancel external subscriptions separately. If you also have an account directly with the app vendor, cancel it there. According to Shopify, uninstalling does not cancel external charges, and the vendor may still hold data.

4. Theme code and embedded scripts

Many stores load third-party code: tracking and advertising pixels, chat widgets, review widgets or customisations an agency wrote straight into the theme. Each of these scripts runs in your customers' browsers and can see what happens there. A sloppy or later tampered-with script is a real risk, even though Shopify itself is secure.

• Know what is embedded. Keep a short list: which script, from which vendor, for what, and who added it. Anything nobody can explain any more should go.
• Duplicate the theme before every code change. Shopify recommends a copy as a backup. The version history in the code editor only restores single files, does not go back indefinitely and cannot recover deleted files.
• Add pixels through the intended feature. Under Customer events, Shopify offers custom pixels that run in a sandbox, which gives you more control than code pasted into the theme. Shopify makes clear that legal compliance, consent and the security of that code remain your responsibility.
• Only edit code if you know what you are doing. Shopify advises editing code only if you understand HTML, CSS and the Liquid template language, and otherwise hiring a Shopify Partner. Whoever writes code in your theme should use their own staff or collaborator account, not yours.

5. Checkout and payment data

Shopify handles the payment step in its checkout, so you neither store nor process your customers' card data yourself. Shopify states that it is certified Level 1 PCI DSS compliant and publishes an annual Attestation of Compliance, which you can view in the Help Center once logged in.

Your job is not to bypass this protected path:

• No card data outside checkout. Never take card numbers by email, phone notes, contact forms or spreadsheets. What you do not hold cannot be stolen from you.
• Protect payment and payout settings. Check who in your store has permissions for payments, payouts and bank details. After an incident, Shopify explicitly recommends reviewing Payments, Balance and other financial areas for unauthorised activity.
• Keep an eye on checkout and notifications. An attacker with access likes to change contact details, notifications or discounts. Look at these settings now and then, not just at the design.

6. Email, domain and fake “Shopify” emails

Whoever controls your email inbox can use “forgot password” to get into almost any of your accounts, your store included. That is why Shopify advises changing your email password first after an incident, and only then your Shopify password. Protect the inbox with a unique password and a second factor, and do the same for the account at your domain registrar if your domain is not managed by Shopify.

Fake emails in Shopify's name are a known way to steal merchant logins. Shopify lists clear signs:

• Check the sender. According to Shopify, genuine emails come from @shopify.com, @email.shopify.com or @em.shopify.com. A message from a Gmail, Yahoo or Hotmail address claiming to be Shopify is suspicious.
• No sensitive data by email. Shopify says it never asks for passwords, ID, credit card or banking details directly by email. Support only requests documents through a secure upload page on a shopify.com address.
• Pressure is a warning sign. A typical example from Shopify's Help Center: send your username and password within 24 hours or lose access to your store permanently. Deadlines like that are designed to make you click fast.
• Spot lookalike addresses. Look at the part right before the ending. An address like example-apparel.com-aquatic.net does not belong to example-apparel.com but to com-aquatic.net.
• Log in yourself instead. Rather than clicking a link in an email, open your store admin directly in the browser. If nothing is there, the email was fake.
• Report suspicious messages. Forward them to phishing@shopify.com. The same caution applies to calls and text messages claiming to be from Shopify.

One small tip so genuine alerts reach you: Shopify recommends removing filters that send Shopify emails to spam or trash. Otherwise you might miss a notice about a login from a new device.

7. Customer data and GDPR in brief

Your store holds names, addresses, orders and often phone numbers. You are responsible for this data towards your customers, even though it technically sits with Shopify and your apps. Shopify's own Help Center points out that merchants are responsible for their own compliance.

• Limit access. Only people who need customer data for their work get the permissions for it. That applies to staff and to apps.
• Export sparingly. Every downloaded customer list is a copy outside the protected store. Delete exports once they have served their purpose.
• Customer requests. If a customer wants to know what data you hold or asks for erasure, Shopify provides “Request customer data” and “Erase personal data” in the customer profile. You have to inform other companies you shared the data with, such as app vendors, yourself.
• Data breaches. If customer data falls into the wrong hands, you may have to notify the data protection authority within 72 hours (Art. 33 GDPR). Our guide “Website hacked? What to do first” explains how to assess this.

This section is a brief orientation and not legal advice. For your specific situation, ask your data protection adviser or a lawyer.

8. What to do if something looks wrong

Typical warning signs in a Shopify store are an email about a login you do not recognise, unknown staff or collaborator accounts, new apps nobody installed, changed bank or contact details, unexpected discount codes and odd draft orders. According to Shopify, you should then:

• Contact Shopify Support immediately.
• Change passwords, email first, then Shopify, from a device you trust.
• Set up two-step authentication again and remove old devices if the attacker got past it.
• Review staff and collaborator permissions, the activity log, apps, domains, checkout, notifications and discounts.
• Check payments and orders, confirm suspicious orders with the customer and cancel them if needed.

The general sequence, from preserving evidence to the question of reporting duties, is covered in our guide “Website hacked? What to do first”. Decide today who makes the calls in an emergency and where the recovery codes are kept.

The checklist

Do it yourself or have it checked?

As a store owner you can do almost everything on this list yourself in an afternoon, without any coding skills. It gets harder where you can no longer see what is happening: many apps with broad permissions, code a former agency wrote into the theme, custom scripts on product and order pages, or connections to inventory and shipping systems.

For these cases we offer a shop security check. Within a scope agreed in writing, we go through your store's accounts, permissions, apps and embedded code and check what your store exposes publicly. If more is needed, for example for custom extensions or connected systems, a penetration test follows, with reproducible evidence for each finding. We tailor the scope to your store and prepare an individual quote.

Frequently asked questions

Further reading

• Content Security Policy and security headers
• Small business website security: the 15-minute check
• Website hacked? What to do first
• Vulnerability assessment: what it is and when you need one
• Service: penetration testing with verified findings

Sources

• Shopify Help Center: Account security best practices
• Shopify Help Center: Two-step authentication
• Shopify Help Center: Passkeys
• Shopify Help Center: Managing users
• Shopify Help Center: Collaborator accounts
• Shopify Help Center: Installing and setting up apps
• Shopify Help Center: Uninstalling apps
• Shopify Help Center: Editing theme code
• Shopify Help Center: Custom pixels
• Shopify Help Center: Phishing, vishing and smishing
• Shopify Help Center: Enabling secure connections
• Shopify Help Center: Compliance reports
• Shopify: PCI compliance
• Shopify Help Center: Processing customer data requests
• EUR-Lex: Regulation (EU) 2016/679 (GDPR), Art. 33