Shopify security

Shopify secures the platform. The rest is yours.

Shopify manages hosting, certificates and the server for you. Your apps, theme scripts, domain and email settings are still your responsibility, and that’s where problems usually start.

Passive scan. Nothing is attacked without your permission.

What you control, and we check

Third-party scripts and outdated JavaScript libraries added by apps or theme edits.
Email spoofing protection: SPF and DMARC on your own domain, so nobody can send convincing fake order emails as you.
HTTPS and redirects on your custom domain and any extra domains you connect.
Cookies and headers your store sends.

What Shopify controls

On Shopify you can’t change server software, TLS settings or most response headers. If your results include a header or server finding, it is usually one Shopify sets for every store, so you can ask Shopify about it and put your own effort into apps, scripts, your domain and email.

Deep checks for Shopify stores

Verify ownership with a meta tag in your theme or a DNS record, and the deep scan watches your storefront scripts for changes, unknown sources and lookalike domains, the signals of an injected skimmer or a malicious app.

Frequently asked questions

Is Shopify secure by default?

The platform is well maintained, but apps, theme edits and email settings are still yours. Many store problems come from an app script or a spoofed sender address, not from Shopify itself.

How do I verify my Shopify store?

Add the HackGrade meta tag to your theme’s theme.liquid head, or add a DNS TXT record at your domain provider.

Why does my Shopify store lose points for headers?

Some response headers are set by Shopify for every store and can’t be changed by store owners. Treat those as information and focus on the issues you control.

Guides with copy-paste fixes

Guide

More free checks

Free · Instant · No sign-up

Find out your grade before someone else does.