What Shopify secures for you, and what it leaves to you

Staff accounts are the front door

Anyone with admin access can change prices, read customer data and install apps. Shopify splits permissions by section, so give each role only what it uses.

• One account per person. Shared logins make the log useless.
• Contractors get theme access, not settings. Support gets orders, not apps.
• Remove access on the last day and review quarterly.

Two-step authentication matters most. Shopify supports it and lets the owner require it, so turn it on, prefer an authenticator app, and check old accounts. See the staff account guide.

The owner's email is the reset path: put two-factor on that mailbox.

Apps are a permission decision

A Shopify app runs on the vendor's servers, holds an API token and can read or write whatever its scopes allow. Installing one is a decision about your data.

Read scopes first: a reporting app rarely needs write access, and read_orders is not write_orders. A custom app puts the credentials on you. Scopes are listed in Shopify's developer documentation.

Keep a register of apps, owners, scopes and use. Uninstall what has no owner, ask how long data is kept, and rotate credentials after staff changes. App launch requirements are a floor, not an audit.

Theme JavaScript is the widest merchant-side opening

Your theme is code you control. Shopify renders it, but nobody reviews the snippet you pasted or the tag container that loads eleven scripts. A compromised app or tag is a common merchant-side risk.

A storefront script can read form fields, rewrite a button and send data anywhere. Shopify constrains checkout pixels more tightly; that helps at payment, not on cart or account pages.

Inventory every script: theme files, app embeds, pixels and tag containers. Remove duplicates and use integrity hashes where supported. This is OWASP Top 10 territory, code you did not write, trusted without review. A strict content security policy is hard here, so use report-only.

What you cannot do on Shopify

A review starts from what the platform lets you change, which on Shopify is less than on a self-hosted store.

• No WAF of your own inside the request path. A proxy sees only traffic you route through it, not Shopify's checkout, and is a delivery tool rather than a security layer.
• No server access, logs or file integrity monitoring. There is no shell or error log. Theme Liquid, app config and DNS are your levers.
• No fine-grained app permissions. OAuth scopes are broad and staff permissions section-based, so a support user with customer access sees every customer.
• No penetration test of Shopify itself. The platform is not yours to test; report issues through its bug bounty. Test your theme, custom app and configuration.
• Limited control of response headers. Storefront headers are set by Shopify. Some plan levels expose more options; a theme edit is not one. Check your plan first.

A 30-minute checklist, ordered by risk

Run these in order. The first three remove access; the rest reduce the chance you miss a change.

1. Require two-step authentication for every staff account. Five minutes; it closes the most common path to orders.
2. Cut each staff account to the sections its role uses and remove anyone who has left. Five minutes.
3. List each app, its scopes and owner under Settings, then Apps. Uninstall what nobody can explain. Eight minutes.
4. Search the theme for scripts and third-party domains, including app embeds and pixels. Five minutes.
5. At your registrar, turn on two-factor, transfer lock and auto-renew, then delete unexplained DNS records. Four minutes.
6. Download the theme and schedule a monthly export of products, orders and customers. Two minutes.
7. Check your DMARC record. If there is none, publish one at p=none with a reporting address. One minute.
8. Write down who contacts customers if the store is compromised. One minute.

These are checks, not fixes. If a step turns up something you do not recognize, stop.