Is Shopify Secure? What You Still Own

Originally published on the Bug Circuit blog.

Yes, Shopify's core platform is secure — but that only covers Shopify's servers, checkout, and payment processing. Everything you install, write, or click on top of it (apps, themes, staff logins, custom code) is your responsibility, and that's where most Shopify stores actually get breached.

This is for Shopify store owners, admins, and freelancers who assume "Shopify handles security" and want to know exactly where that stops. You'll get a plain map of the shared-responsibility line, a table you can point to when a client or investor asks, and a self-check you can run in the next 10 minutes.

The short answer: yes, and no

Shopify's own infrastructure is genuinely well-built. It runs as a PCI DSS Level 1 service provider, which means the servers, checkout, and card processing meet the strictest tier of the payment card industry's security standard — the same tier as major banks and processors. You don't need to manage firewalls, patch servers, or encrypt card data yourself; Shopify does that layer for you, and merchants inherit much of that compliance automatically when they use Shopify Payments and hosted checkout (Shopify's PCI compliance guide).

But "the platform is secure" and "my store is secure" are two different claims. Shopify draws a clear line, common to every cloud platform: they secure the platform, you secure what you build on it. That's the same shared-responsibility model AWS, Google Cloud, and every SaaS vendor uses — it's just rarely explained to small merchants in plain terms.

What Shopify actually secures

• Servers and network infrastructure — DDoS protection, uptime, patching the underlying systems.
• Checkout and payment processing — encrypted card data, PCI DSS Level 1 compliance, fraud-detection signals on Shopify Payments.
• Platform-level vulnerabilities — bugs in Shopify's own core code (the admin, storefront engine, checkout) are Shopify's to find and patch.
• HTTPS on your storefront — Shopify auto-provisions and renews SSL certificates for your myshopify.com and connected domains.

That's real, meaningful security — and it's why Shopify stores don't need to worry about the things a self-hosted store (say, raw WordPress with WooCommerce) has to manage manually, like server patching or SSL renewal.

What you still own

Here's where the myth breaks. Everything below sits outside Shopify's platform boundary, and a vulnerability in any of them can expose customer data, redirect checkout, or hand an attacker your admin panel — even though "Shopify" never had a bug.

Apps

Every app you install gets a scope of permissions — often read/write access to customers, orders, or even your theme code. A poorly coded or abandoned app is a door Shopify can't close for you; it's not part of Shopify's own codebase. This mirrors the exact risk category OWASP calls out as "Vulnerable and Outdated Components" — third-party code you didn't write but now depend on.

• Audit installed apps quarterly under Settings → Apps and sales channels. Remove anything not actively used.
• Check what data scope an app requests before installing (visible on the install screen) — a countdown-timer app doesn't need customer PII access.
• Favor apps still receiving updates; an app last updated three years ago is a red flag, not a bargain.

Themes and custom Liquid

Liquid is Shopify's templating language for building themes. Custom .liquid code, injected third-party scripts (chat widgets, pixels, upsell snippets), and hardcoded API keys in theme files are all your responsibility. A common real mistake: a developer pastes a private API key into theme.liquid for a "quick fix," and it ships to every visitor's browser, publicly readable in page source.

• Never hardcode API tokens or secrets in theme files — use app proxy or backend calls instead.
• Remove old third-party scripts you no longer use; each one is an extra piece of code with checkout-adjacent access.
• If you use Checkout Extensibility or Shopify Functions for custom logic, keep that code in a private repo with a review step before deploy, not edited live in the admin.

Staff access

Every staff account is a potential entry point. Shopify supports granular admin permissions — most stores don't use them, defaulting everyone to broad access instead.

• Go to Settings → Users and permissions and give each staff member only the permissions their job needs (e.g., a support rep doesn't need "Manage settings" or theme access).
• Turn on two-step verification for every staff login — Shopify has required it for account owners since 2022, and you should require it for staff too.
• Remove access immediately when someone leaves — an ex-contractor with a live login is one of the most common, least glamorous breach paths.

Phishing and social engineering

Attackers don't need a Shopify vulnerability if they can just ask nicely. Fake "Shopify Support" emails asking you to "verify your account" or install a "required" app are a known pattern targeting merchants — CISA's general guidance on recognizing these tactics applies directly here: never click login links from email, always type admin.shopify.com directly, and verify unexpected requests through a second channel (CISA: Avoiding Social Engineering and Phishing Attacks).

• Bookmark your admin URL instead of clicking email links to log in.
• Set up SPF, DKIM, and DMARC on your sending domain so attackers can't easily spoof "you" in phishing emails to your customers — check yours with our email spoofing checker.
• Train staff that Shopify will never ask for your password by email or DM.

The shared-responsibility line, at a glance

Layer	Who secures it	Real examples
Servers, network, uptime	Shopify	DDoS protection, patching, infrastructure hardening
Checkout & payment processing	Shopify	PCI DSS Level 1 compliance, card data encryption
Storefront SSL/HTTPS	Shopify	Auto-issued and renewed certificates
Installed apps	You	Permission scopes, app vulnerabilities, abandoned apps
Theme & custom Liquid code	You	Hardcoded keys, injected scripts, insecure customizations
Staff accounts & permissions	You	Weak passwords, over-broad access, ex-employee logins
Domain, DNS, email	You	SPF/DKIM/DMARC, registrar account, domain lock
Phishing awareness	You	Fake support emails, credential theft, malicious app links

10-minute Shopify security self-check

• [ ] Two-step verification is on for every staff account, not just the owner.
• [ ] Staff permissions in Settings → Users and permissions match actual job needs.
• [ ] You've reviewed installed apps in the last 3 months and removed unused ones.
• [ ] No API keys or secrets are hardcoded in your theme's .liquid files.
• [ ] SPF/DKIM/DMARC are set up on your store's sending domain.
• [ ] You always type your admin URL directly instead of clicking email links to log in.
• [ ] Response headers on your storefront (CSP, X-Frame-Options, etc.) are reviewed — run a free check with our security headers scanner.

If you checked all seven, you're ahead of most stores. If you're not sure about several, that uncertainty is itself the finding — it usually means no one has actually looked at the store-level risks since launch. Our guide on whether your website is hackable walks through the warning signs in more depth.

When a manual look actually helps

An automated scanner can flag a missing security header in seconds, but it can't tell you that a marketing app has write access to your customer list it doesn't need, or that a staff account from a former employee is still active, or that a snippet a freelancer added two years ago is quietly loading a script from a domain that no longer exists. Those are judgment calls a human reviewer makes by actually looking at your store's configuration — the difference we cover in manual vs. automated penetration testing.

Key takeaways

• Shopify secures the platform (servers, checkout, PCI compliance) — you secure everything layered on top of it: apps, themes, staff access, and your team's judgment.
• Audit installed apps and their permission scopes quarterly; remove anything unused or unmaintained.
• Turn on two-step verification for every staff login and scope permissions to the job, not the person.
• Never click email links to log into your admin — type the URL directly, and set up SPF/DKIM/DMARC so attackers can't spoof your domain.
• A missing header or an unused app with broad access won't show up by guessing — a manual review of your actual store configuration will.

If you've read this far and you're not fully sure where your store stands on the checklist above, that's exactly what a manual audit is for. Circuit, our $49 one-time review, has a real person go through your store's apps, theme code, and configuration and hand you a plain-English report of what's actually exposed — not a certification, not a guess, just what's true about your specific store right now.