How to check if a website uses Shopify (one site or a thousand)

#shopify #ecommerce #tutorial #webdev

You have a list of online stores and you need to know which ones run on Shopify. Maybe you sell a Shopify app, run an agency, or you're building a lead list. Opening every site by hand doesn't scale past a dozen.

This post covers two ways to do it: the manual check, which is fine for one site, and a bulk check that takes a list of domains and gives back only the Shopify stores.

The manual check (one site)

Shopify stores leave clear fingerprints. Open the site, then:

View the page source (Ctrl+U) and search for cdn.shopify.com. Shopify serves theme files and product images from that domain.
Search the same source for Shopify.theme. It's the global object Shopify themes define.
Look at the response headers in DevTools (Network tab → the first document request). Shopify stores typically answer with powered-by: Shopify.
Check the cookies. _shopify_y and _shopify_s are set on the first visit.

I checked allbirds.com while writing this: all four were there.

A custom domain doesn't hide any of this, and headless storefronts are the one real exception: if a brand renders its store with its own frontend and only uses Shopify behind the scenes, the page itself may show none of these signs.

The bulk check (a list of sites)

For more than a handful of sites, I use a small tool I built on Apify: Tech Stack Detector. It checks each site against 7,600+ open-source technology fingerprints (the community-maintained continuation of the Wappalyzer rules), so Shopify is one of many things it can find.

The part that matters here is the "Only websites using" field. Put Shopify in it and the results contain only the Shopify stores.

Step by step

Open the Shopify Store Checker (a preset of the tool with the filter already set) and open it in Apify Console. Signing up is free.
Paste your domains into Websites, one per line. example.com is enough, no https:// needed.
Keep Shopify in Only websites using, or change it. It also accepts categories: Ecommerce returns stores on any platform.
Click Start. Export the result as CSV, Excel or JSON.

A real run

I gave it six sites: four stores and two sites that aren't Shopify (wordpress.org and stripe.com).

The run finished with the status message "4 of 6 analyzed website(s) use Shopify." and a table with four rows. Here is one of them, trimmed:

{
  "url": "https://colourpop.com/",
  "matchedTechnologies": ["Shopify"],
  "statusCode": 200,
  "techCount": 20,
  "techNames": [
    "Amazon Web Services", "Apple Pay", "Cart Functionality", "Cloudflare",
    "Google Tag Manager", "HSTS", "HTTP/3", "Klarna Checkout", "Klaviyo",
    "Let's Encrypt", "Okendo", "OneTrust", "Open Graph", "PayPal",
    "Priority Hints", "Shopify", "Swiper", "Tolstoy", "Venmo", "Yotpo Reviews"
  ],
  "technologies": [
    {
      "name": "Shopify",
      "confidence": 100,
      "categories": ["Ecommerce"],
      "evidence": [
        { "type": "cookie", "name": "_shopify_y", "value": "64040547-..." },
        { "type": "meta", "name": "shopify-digital-wallet", "value": "/13380845/digital_wallets/dialog" }
      ]
    }
  ],
  "companyToolNames": ["Amazon Route 53", "Amazon SES", "Meta", "Sendgrid", "Zendesk"],
  "scanTimeMs": 2061
}

A few things worth noticing:

The rest of the stack comes along. You don't just learn it's a Shopify store: you also see it uses Klaviyo for email, Yotpo and Okendo for reviews, and Klarna at checkout. If you sell a competing app, that's your qualification done.
Every detection shows its evidence. Here it's the _shopify_y cookie and a shopify-digital-wallet meta tag, so you can verify any row yourself instead of trusting a black box.
companyToolNames comes from DNS records, not the website: the email and SaaS services the company has set up. It's kept separate so a DNS verification record never shows up as part of the site's stack.

Calling it from code

The same run over the Apify API, as a single request that waits for the results:

curl -X POST "https://api.apify.com/v2/acts/fagundes_victor~tech-stack-detector/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["allbirds.com", "gymshark.com", "wordpress.org"], "technologies": ["Shopify"], "includeEvidence": false}'

Or with the Python client (pip install apify-client):

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("fagundes_victor/tech-stack-detector").call(run_input={
    "urls": ["allbirds.com", "gymshark.com", "wordpress.org"],
    "technologies": ["Shopify"],
})
for store in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(store["url"], store["techNames"])

Cost and limits

It costs $20 per 1,000 websites analyzed (less on paid Apify plans), and Apify's free plan comes with monthly credits, so small lists cost you nothing.
Sites that are unreachable or answer with a bot-protection page are not charged. They're reported as blocked instead of returning a wrong, empty stack.
Sites that are analyzed but don't match the filter are charged and left out of the results, since the work of checking them was done.
It reads the page the server sends, without running a browser. That's why it's fast (about 1 to 2 seconds per site), but a technology that only appears after JavaScript runs can be missed. For Shopify this rarely matters: the cookies and meta tags come in the first response.

Wrapping up

For one store, view source and search for cdn.shopify.com. For a list, filter it in bulk and keep the rest of the stack as a bonus.

If you try the tool and something is detected wrong, tell me in the comments. Every detection comes with its evidence, so wrong ones are easy to track down and fix.

DEV Community