Shopify Security Guide: How to Protect Your Store in 2026

Check your site's security right now: Free ZeriFlow scan →

1. HTTPS Enforcement: Lock Out Insecure Connections

Shopify provisions a free SSL certificate for every store. By default, the "Redirect to HTTPS" toggle in Online Store → Preferences → Redirect all traffic to HTTPS should be ON. Verify it is.

What this toggle alone won't catch:

• Mixed content — if your theme loads external JavaScript, fonts, or images over HTTP, browsers block them and Chrome flags the page as insecure.
• HSTS header — Shopify does not set a Strict-Transport-Security header with a meaningful max-age out of the box on all plans. Without HSTS, users who manually type http:// could be downgraded before the redirect fires.

What to do: Audit your theme's layout/theme.liquid for any http:// asset URLs. Replace them with https:// or protocol-relative //. Use ZeriFlow to confirm whether your storefront returns a valid Strict-Transport-Security header and that your TLS configuration scores well.

2. Content Security Policy via Your Theme

Shopify does not give merchants a server-side header management UI for CSP. You have two practical options:

Option A — Theme meta tag. In layout/theme.liquid, add a <meta http-equiv="Content-Security-Policy"> tag inside <head>. This is weaker than a true HTTP header (it cannot protect against certain injection vectors) but it stops most XSS attack surfaces.

Option B — Reverse proxy or edge middleware. If you route traffic through Cloudflare Workers or a custom subdomain proxy, you can inject real HTTP headers before the response reaches the browser. This is the correct long-term approach for high-volume stores.

Other headers worth adding via your theme or proxy:

• X-Content-Type-Options: nosniff
• X-Frame-Options: SAMEORIGIN
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy: camera=(), microphone=(), geolocation=()

Run a free ZeriFlow scan → to see exactly which headers your Shopify storefront is currently missing.

3. Vetting and Auditing Third-Party Apps

The Shopify App Store has over 8,000 apps. Every app you install gets an OAuth token with scopes you approve — and those scopes often include write access to orders, customers, and products.

Attack surface: A compromised or malicious app can exfiltrate customer PII, inject JavaScript into your storefront (supply-chain XSS), or modify checkout flows.

Best practices:

• Principle of least privilege. When installing an app, review the requested scopes. An SEO app requesting write_orders is a red flag.
• Regular audit. Go to Settings → Apps and sales channels every quarter. Remove apps you no longer use — their OAuth tokens remain valid until explicitly revoked.
• Check app permissions after updates. Some apps silently request additional scopes during updates.
• Monitor your theme code. After installing a new app, diff your theme.liquid for injected <script> tags pointing to unfamiliar domains. Use Git-based theme development to track changes.

4. Admin Account Security: 2FA and Staff Permissions

Your Shopify admin is a high-value target. A compromised admin account can expose every customer record, every order, and every payment method on file.

[Two-factor authentication](https://zeriflow.com/blog/two-factor-authentication-setup-guide): Shopify allows store owners to require 2FA for all staff accounts under Settings → Users and permissions → Require two-step authentication. Enable this. Enforce authenticator apps (TOTP) over SMS — SIM-swap attacks are real.

Staff permission scoping:

• Use the built-in roles to give staff only the access they need. A customer service rep does not need access to Shopify Payments or billing.
• Create named accounts for every individual. Never share a single login across multiple people — you lose audit trail.
• Offboard promptly. When a staff member leaves, deactivate their account immediately from Settings → Users.

Login activity: Review the Staff activity log periodically for unexpected login locations or bulk export events.

5. DMARC for Transactional Email Security

Shopify sends order confirmations, shipping notifications, and marketing emails from your domain (if configured). Without email authentication records, attackers can spoof your domain to phish your customers.

The three records you need:

• SPF — declares which mail servers are allowed to send on behalf of your domain. Add Shopify's sending IPs and your ESP (Klaviyo, Mailchimp, etc.).
• DKIM — cryptographically signs outbound messages. Shopify provides a DKIM key when you connect a custom sender domain; add it to your DNS.
• DMARC — the policy that tells receiving servers what to do when SPF or DKIM fails. Start with p=none (monitoring), then move to p=quarantine and eventually p=reject.

Without a p=reject DMARC policy, your domain can be freely spoofed. ZeriFlow checks your DMARC, SPF, and DKIM alignment in its DNS and email security module.

6. Shopify's Built-In Fraud Analysis — and Its Limits

Shopify Fraud Analysis scores orders based on IP geolocation mismatches, billing/shipping discrepancies, and known fraud signals. It surfaces a risk level (low/medium/high) on each order.

What it does well: Catches obvious card-testing attacks and orders from high-risk regions with mismatched details.

What it misses:

• Account takeover on buyer-side accounts (Shopify's analysis is per-order, not per-account behavior).
• Friendly fraud (chargebacks on legitimate orders).
• Bot-driven credential stuffing against customer login pages.

Augment with:

• Enable Shopify Payments' automatic payment capture hold for high-risk orders.
• Add CAPTCHA to your login and registration pages (available via Shopify's bot protection settings).
• Consider a third-party fraud tool (NoFraud, Signifyd) if chargeback rates exceed 0.5%.

FAQ

### Q: Does Shopify provide an SSL certificate automatically? A: Yes. Every Shopify store gets a free SSL certificate from Let's Encrypt, auto-renewed. What you need to verify is that HTTPS redirect is enabled in your store preferences and that your theme contains no mixed content HTTP references.

### Q: Can I add HTTP security headers to a Shopify store without a proxy? A: Directly, no — Shopify does not expose server-side header configuration to merchants. Your options are a <meta> CSP tag in theme.liquid (partial coverage) or routing through Cloudflare Workers / a reverse proxy to inject real headers.

### Q: Which Shopify app permissions are the most dangerous? A: write_customers, write_orders, and read_payment_methods represent the highest-risk scopes. Any app requesting these should have a clear, legitimate reason. Review all installed app scopes quarterly.

### Q: How do I check if my Shopify store's TLS is configured correctly? A: Run a scan with ZeriFlow. It checks TLS version support, cipher suites, certificate validity, HSTS presence, and all major security headers in under 60 seconds.

### Q: Is DMARC required for Shopify stores? A: Not required by Shopify, but increasingly required by email providers. Google and Yahoo's 2024 sender requirements mandate SPF, DKIM, and DMARC for bulk senders. More importantly, without DMARC at p=reject, anyone can spoof your domain to defraud your customers.

Conclusion

Shopify's managed infrastructure removes a significant security burden — but it does not make your store secure by default. The gaps that remain (security headers, app vetting, admin 2FA, DMARC configuration) are entirely within your control and routinely exploited.

Audit your storefront externally to see exactly what attackers see before they do.

Run a free ZeriFlow scan → — 60 seconds, no credit card.

Further Reading

• Mozilla SSL Configuration Generator
• RFC 8996 — Deprecating TLS 1.0 and TLS 1.1

<!-- zf-internal-links -->