Shopify security audit checklist: what to check before going live

Shopify manages the platform security — OS patching, network isolation, PCI compliance for hosted checkout. But store-level security is your responsibility. These are the eight areas that most Shopify stores get wrong before launch, and how to verify each one.

1. Password page vs. JSON endpoint exposure

Your password page does not protect /products.json, /collections.json, or /search.json. These endpoints are publicly accessible regardless of storefront password status. Draft-status products don't appear in the API; Hidden-visibility Published products do.

Verify:

curl -s https://your-store.myshopify.com/products.json | python3 -c "import sys,json; d=json.load(sys.stdin); print(f'{len(d[\"products\"])} products exposed')"

Fix: keep products in Draft status until launch day. Publish only when ready to go live publicly.

2. App Proxy exposure

Shopify App Proxies route requests like https://yourstore.com/apps/yourapp/ to an external server. If the external app server doesn't validate the Shopify HMAC signature on incoming requests, it can be reached directly — bypassing Shopify's authentication entirely.

Check any installed apps that use App Proxy. Test whether the proxy endpoint accepts requests without valid Shopify headers:

curl -s https://yourstore.com/apps/your-app-slug/some-endpoint

If you receive app data without providing Shopify proxy headers, the app may not be validating the proxy signature. Report to the app developer or remove the app if data is sensitive.

For apps you build: always verify the signature query parameter on every proxy request using Shopify's HMAC-SHA256 verification.

3. Checkout script integrity

Shopify Plus merchants can inject JavaScript into checkout via Checkout Extensions or (legacy) checkout.liquid. Non-Plus stores can inject scripts via the Order Status page and Thank You page customization. Any third-party script loaded at checkout has access to payment form fields and order data.

Audit every script loaded on checkout pages:

• Go to Shopify Admin → Settings → Checkout → Additional scripts
• Go to Shopify Admin → Online Store → Themes → Edit code → checkout.liquid (Plus only)
• List all installed apps that request access to checkout pages

Remove any scripts you don't actively use. For required scripts, verify the source domain and, where supported, add SRI integrity attributes. Check script content hasn't changed since you approved it — a supply-chain attack on a checkout script is a card-skimming event.

Orb44 monitors checkout script fingerprints and alerts you when a script loaded at checkout changes between scans.

4. Admin two-factor authentication

Every Shopify admin account — including collaborator accounts — should have 2FA enabled. A compromised admin account gives full access to order data, customer PII, payment settings, and the ability to inject malicious scripts into your theme.

Check: Shopify Admin → Settings → Users and Permissions → (each user) → Security. Look for any account without 2FA enabled.

For organizations using Shopify Plus, enable organization-level 2FA enforcement: Shopify Organization Admin → Settings → Security.

Remove collaborator accounts that are no longer active. Each active collaborator is a potential access point.

5. API key scopes and rotation

Private apps and custom apps generate API credentials. Overly broad scopes mean a leaked key can read all orders, customer data, and product information — or worse, write to them.

Audit: Shopify Admin → Settings → Apps and sales channels → Develop apps → (each app) → API credentials.

• Review the scopes granted to each app. Remove any scope not actively required.
• Check when credentials were last rotated. Keys older than 90 days should be rotated.
• Check git repositories and environment files for accidentally committed API keys: git log --all -S 'shpat_' (Shopify access tokens start with shpat_) and git log --all -S 'shpss_' (Shopify secrets).
• Revoke any keys found in version control immediately and regenerate.

6. Webhook signature verification

Shopify sends webhooks to your app or integration endpoints for events like order creation, customer updates, and fulfillment. Each webhook includes an HMAC-SHA256 signature in the X-Shopify-Hmac-Sha256 header.

If your webhook handler doesn't verify this signature, an attacker can forge webhook events — creating fake orders, triggering fulfillment logic for non-existent purchases, or injecting customer data.

# Python: verify Shopify webhook signature
import hmac, hashlib, base64

def verify_webhook(data: bytes, hmac_header: str, secret: str) -> bool:
    digest = hmac.new(secret.encode('utf-8'), data, hashlib.sha256).digest()
    computed = base64.b64encode(digest).decode()
    return hmac.compare_digest(computed, hmac_header)

Test by sending a POST with a garbage X-Shopify-Hmac-Sha256 header to your webhook endpoint. If it's processed, signature verification is missing.

7. Theme JavaScript third-party scripts

Every script loaded by your theme — from the <head> and at checkout — runs with full DOM access. Review your theme's theme.liquid, layout/theme.liquid, and all snippet files for external script URLs.

Common risky inclusions:

• Live chat widgets (Tidio, Intercom, Crisp) — significant DOM access, verify their security policies
• Marketing pixels (Meta Pixel, TikTok Pixel) — track user behavior; review data practices
• Abandoned cart scripts — often loaded from third-party domains with no SRI
• Currency converters, review widgets — long-tail apps with smaller security teams

grep -r 'script src' ./theme/ | grep -v 'cdn.shopify.com'

For each external script URL: check that the domain is the expected vendor, verify the script hasn't changed recently, and add SRI hashes where the CDN supports CORS.

8. Metafield access and customer data exposure

Shopify metafields store custom data on products, customers, and orders. If your theme renders metafields on public pages, verify that you're not exposing internal data. Common mistakes:

• Internal cost/margin metafields rendered in theme Liquid and visible in page source
• Customer notes or internal tags exposed via Storefront API metafield queries
• Order metafields containing fulfillment notes exposed through the Order Status page template

Check your theme for metafield variable rendering:

grep -r 'metafields\|metafield' ./theme/ | grep -v '.scss'

Review each metafield reference to confirm it's not exposing data you consider internal.

Pre-launch verification checklist summary

• [ ] /products.json returns 0 products or products are in Draft status
• [ ] App Proxy endpoints validate Shopify HMAC signatures
• [ ] Checkout scripts audited; SRI hashes applied where possible
• [ ] All admin and collaborator accounts have 2FA enabled
• [ ] API keys scoped to minimum required permissions; rotated within 90 days
• [ ] Webhook handlers verify X-Shopify-Hmac-Sha256 signature
• [ ] Theme external scripts inventoried; no unexpected CDN sources
• [ ] Metafields reviewed; no internal data rendered in public theme templates

FAQ

Does Shopify's built-in fraud analysis replace a security audit?

No. Shopify's fraud analysis (Shopify Protect and third-party fraud apps) evaluates transaction risk — identifying potentially fraudulent orders. It doesn't assess your store's configuration security, script integrity, API key hygiene, or data exposure. These are separate concerns requiring different tools.

How often should I repeat this audit?

Run the full checklist before launch, then after any major theme update, after installing or removing apps, and after any team membership change (adding or removing admin or collaborator accounts). At minimum, review API key rotation and script inventory quarterly.

Is Shopify PCI compliant? Do I need to worry about payment security?

Shopify's hosted checkout is PCI DSS Level 1 compliant. Card data is handled by Shopify Payments or integrated gateways, not your theme code. However, if third-party scripts are loaded at checkout — your responsibility, not Shopify's — those scripts can intercept payment data client-side. Script integrity at checkout is the primary payment security concern for Shopify stores.

Check your Shopify store's full security posture at orb44.com — Orb44 covers checkout script monitoring, catalog endpoint exposure, and admin access checks.