The Top 7 Shopify Security Risks

Shopify's infrastructure is secure. Your store is a different question. Shopify locks down the platform layer. Everything sitting on top of it, your passwords, your app list, your staff permissions, your theme code, is yours to protect.

This article started with an incident of our own. A wave of bot traffic hit sherocommerce.com, our agency site, which runs on Shopify, and knocked it offline in short bursts.

That pushed us to write down the seven failure points that account for nearly every Shopify security incident we've handled, along with the specific fix for each one.

Top Shopify Security Risks At a Glance

1. Weak or Reused Passwords Are the Easiest Way Into Your Store

Credential-stuffing bots don't guess passwords. They replay password lists stolen from other breaches against your login page, betting that someone on your team reused a password from a site that's already been compromised.

To secure your store, do the following:

1. Confirm two-step authentication is turned on under Settings Users and permissions, since the requirement doesn't retroactively enable it on accounts that predate the rollout.

For staff accounts, Shopify can't force two-step authentication on non-Plus stores, so each staff member has to enable it themselves. Make it a hiring-day checklist item, not an optional recommendation, and require a password manager for anyone with admin access.

Shopify Plus stores can enforce a mandatory secure sign-in method for all users directly under Settings Users and permissions.

2.Audit staff accounts quarterly for former employees or contractors who still have login access; a departed developer with an active account is a standing vulnerability, not a paperwork oversight.

2. Vulnerable Third-Party Apps Create Entry Points

Every app you install requests a scope of access. That can mean read access to customer data, write access to orders, or both. Most stores accumulate apps faster than they audit them.

A checkout upsell app installed two years ago and never removed still holds whatever permissions it was granted at install, whether or not anyone remembers it's there.

Go to Settings Apps and sales channels and review every installed app against two questions.

1. Is it still in active use?
2. Does its requested scope match what it actually does?

Uninstall anything that fails either test. For apps you keep, check the developer's update history. An app that hasn't shipped a security patch in over a year, especially one with access to customer PII or payment data, is a liability regardless of how useful it is.

3. Misconfigured Permissions Expose Admin Functions

Shopify's permission system lets you scope staff access down to individual functions: orders, products, discounts, themes, apps, finances. Most stores skip this and grant broad, store-owner-equivalent access to anyone who needs admin login at all, because it's faster at setup time. That convenience is exactly what turns a single compromised account, or one disgruntled contractor, into full store control.

Under Settings Users and permissions, assign each staff member the narrowest permission set their role requires.

• A customer service rep needs order and customer access, not theme editing or app installation rights.
• A seasonal contractor building a landing page needs theme access, not financial reports.
  

Review this list every time someone changes roles, not just when they're hired.

4. Phishing Targets Your People, Not Your Platform

Phishing campaigns aimed at Shopify merchants usually spoof one of two senders.

• Shopify itself or a payment processor.
• Staff phishing targets your admin login.
• Customer phishing targets order confirmations, using real order numbers scraped from public tracking pages to make fake delivery-issue emails convincing.
  

Rough example of what a typical phishing email looks like

How to Protect staff logins?

• Verify any email that asks you to log in or "verify your account" by going to admin.shopify.com directly. Never click the link in the email.

How to protect your customers?

• Audit your order confirmation and shipping pages, and remove any public information that doesn't need to be there. Order numbers scraped from public tracking pages are what make fake delivery-issue emails convincing.

• Add a line to your transactional emails saying you'll never ask for payment details by email. That one line gives customers a concrete way to spot the fake.

5. Unpatched Theme Code Keeps Known Vulnerabilities Live

A theme that was audited and secure at launch doesn't stay that way.

Liquid code that references deprecated APIs, third-party JavaScript pasted into theme.liquid years ago, custom app blocks nobody has reviewed since the developer left. These build up quietly and most don't notice untilvulnerability gets exploited or in the process of optimizing your website speed.

Pull up your theme code under Online Store Themes Edit code and check for two things.

1. Third-party scripts injected directly into theme.liquid rather than loaded through the app embed system.
2. Any hardcoded API keys or credentials sitting in plain Liquid or JS files.

Both are common shortcuts from past development work, and both are direct exposure. Move third-party scripts to app embeds where the vendor is responsible for maintaining them, and rotate any credentials you find hardcoded in the theme.

Example injection in Google Tag Manager script, deferred load

6. Payment Fraud and Chargeback Abuse Erode Revenue Directly

This risk is different from the others. It doesn't require a breach at all. Stolen card testing, friendly-fraud chargebacks, and refund abuse hit revenue directly through your normal checkout flow, no exploit required.

Two tools work together here, and they do different jobs.

Shopify Protect replaced the older paid Fraud Protect service in 2022. Merchants still on legacy Fraud Protect can switch, but the switch is one-way.

Once you deactivate Fraud Protect, it can't be reactivated. Neither tool covers non-fraud disputes like "item not received" or "not as described."Those go through the standard chargeback process.

Set up automation in Shopify Flow to route high-risk orders to manual review before fulfillment rather than auto-shipping them. The few minutes of manual review cost far less than the chargeback fees and lost inventory.

7. Bot Traffic Floods Can Take Your Store Down

Not every outage is caused by a hack, a bad app, or a code change. Sometimes it's just volume. A high enough wave of bot traffic hitting your storefront can push your Cloudflare-to-Shopify connection past its rate limit and produce short, self-healing 503 errors, even though nothing on your store broke.

We saw this firsthand on our website, sherocommerce.com, a few months after we migrated from WordPress to Shopify.

What happened?
A bot wave from a single country, roughly 270,000 requests, drove ten separate 503 events over two days, each lasting one to two minutes, clustered overnight.

The storefront runs through Cloudflare's proxy into Shopify's origin, and the flood pushed traffic through a shared Cloudflare egress IP past Shopify's per-source-IP rate limit.Shopify returned a 503 with a Retry-After header, Cloudflare passed it along, and each blip cleared on its own once the wave ebbed.

The graph shows normal day traffic and the day when we had the most traffic, the spike which is visible and caused the 503 event

The attack day data

This is easy to miss because none of it shows up in your analytics.
Bots that get blocked at the edge never load the page's JavaScript, so they never register as a session. Our real traffic stayed flat around 10 sessions/hour the entire time, and the outages landed in the quietest hours, not the busiest ones.

• If you see normal, steady numbers, in your dashboard that's not proof nothing is happening. Flat traffic paired with unexplained error reports is exactly what an edge-blocked bot attack looks like.
• If you're getting intermittent 503s that don't correlate with any deploy, app install, or traffic spike, check your Cloudflare analytics for a request volume spike from a single country or ASN, not just your Shopify session count.

How to protect against bot attacks?

• Add a WAF rule blocking or challenging the offending country/ASN,
• Layer in a rate-limiting rule per IP to catch rotating addresses
• Keep Bot Fight Mode on as a standing backstop, reserving "I'm Under Attack" mode for active spikes.

How To Make your Shopify Store More Secure?

None of these seven risks operate in isolation, and neither should your defenses. A store with 2FA enabled, but no app audit is still exposed. A store with tight permissions but unpatched theme code is still exposed. Layered security means each control backs up the others, so one failure doesn't cascade into a full breach.

The four main checks:

• Audit staff accounts and permissions, removing anyone who's changed roles or left

• Review installed apps against actual usage and remove anything dormant

• Scan theme code for hardcoded credentials and non-embedded third-party scripts. Helpful also for improving your website speed.

• Check fraud filter rules against your current order patterns and chargeback rate

Put this on a calendar. Security work that only happens after an incident is remediation, not prevention.

Which Security Apps Are Worth Installing?

Most of the seven fixes above you handle from the admin yourself.

Two you shouldn't try to do by hand are keeping a restorable copy of your store, and screening orders for fraud Shopify's native scoring misses.

For those, an app earns its place. Here's a few recommendations from App Store.

Run a Shopify Security Audit

Most merchants don't have the bandwidth to run this audit quarterly on top of everything else. Our Shopify security audit closes that gap. We go through your permissions, app scopes, theme code, and fraud settings line by line, then hand you a fixed list ranked by risk, not a generic checklist.

If you want someone to review your store before something forces the issue, book a call with one of our strategists. Better to have that conversation now than after an incident.

F.A.Qs on Top Shopify Security Risks