S Shopify Owners NewsletterDaily operational intelligence for Shopify store owners

A Shopify Store Security Checklist Every Owner Needs

Published · Last reviewed

A Shopify security checklist is the short list of controls that shrink your store’s breach surface: strong admin access, least-privilege staff and app permissions, and a recoverable theme. Most store compromises don’t come from Shopify itself — they come from reused passwords, phishing, over-permissioned or abandoned apps, and stale staff accounts. Run the checks below to close the common gaps.

Where store compromises actually come from

The platform is hardened; your configuration is the soft target. In practice, stores are compromised through reused or weak admin passwords, phishing that captures an admin login, apps granted broad access to customer and Orders data (especially ones no longer maintained), and staff or contractor accounts that were never removed. Each is an entry point you control.

The security checklist

Action
Enable two-factor authentication (2FA) on the owner account and every staff account.
Why it protects you
2FA stops a password-only takeover cold — the single highest-value control you can turn on.
Verification
Every active account shows 2FA enabled in its security settings.
Action
Audit staff accounts and permissions: remove ex-staff and contractors, and grant each remaining person only the access their role needs.
Why it protects you
Least privilege limits the blast radius if any one account is compromised, and stale accounts are a common back door.
Verification
Every active account maps to a current person with a justified permission level.
Action
Review installed Apps and their permissions; remove unused ones (see app vetting and app bloat).
Why it protects you
Every app with access to customer or order data is part of your exposure if it’s breached or abandoned; fewer apps means a smaller attack surface.
Verification
Each remaining app has a purpose and its permissions match what it needs.
Action
Back up your theme and watch for unexpected theme code (unknown scripts can indicate tampering or a card skimmer).
Why it protects you
A dated backup lets you restore instantly if code is tampered with, and knowing your theme helps you spot injected scripts.
Verification
A dated backup theme exists and your live theme contains no unfamiliar scripts.
Action
Use unique, strong passwords with a password manager, and treat unexpected ‘verify your account’ emails as phishing.
Why it protects you
Reused passwords and phishing are the most common route to a compromised admin login.
Verification
Admin logins use unique manager-generated passwords and you log in only via the known Shopify URL.

Signs something is wrong

How it works

Security here is surface reduction: every account, every app, and every script is a potential entry point, so you enumerate them and either remove them or reduce what they can do. The three levers are least privilege (nobody and no app has more access than they need), strong authentication (2FA plus unique passwords on the front door), and recoverability (a theme backup so tampering is reversible). You’re not trying to make the store un-hackable — you’re removing the cheap, common ways in.

It works because attackers favor the easy path: a reused password, an abandoned app with broad scope, a forgotten admin account. Closing those turns your store from low-hanging fruit into a hard target, which is most of the protection for a fraction of the effort.

Worked example

An owner runs the checklist for the first time. They find a staff account for a contractor who finished months ago — still active, with full access — plus two unused apps that hold customer-data permissions, and an admin password reused from another site.

They remove the contractor account, uninstall the two apps, enable 2FA on every remaining account, and rotate the admin password to a unique manager-generated one. Nothing about the storefront changed, but the store’s breach surface shrank materially in under an hour — three of the most common compromise routes closed in a single sitting.

Frequently asked questions

How do Shopify stores get hacked?

Most commonly through weak or reused admin passwords, phishing that captures a login, or over-permissioned and abandoned apps, not through Shopify's platform itself. Your configuration and access hygiene are the real targets.

Should every Shopify staff account have 2FA?

Yes. Two-factor authentication on the owner and every staff account is the single highest-value control, because it stops a stolen or guessed password from being enough to take over an account.

How do I check what a Shopify app can access?

Review each app's requested permissions in your admin, and remove apps you no longer use. An app with access to customer or order data is part of your exposure if it is breached or stops being maintained.

What is a card skimmer and can it affect my store?

A skimmer is malicious code injected into a site to steal payment data. Keeping a theme backup and watching for unfamiliar scripts in your theme helps you detect tampering and restore a clean version quickly.

How do I recover if my Shopify theme is tampered with?

Republish a known-good dated backup theme, since publishing only changes which theme is live. This is why keeping recent theme backups is part of a security routine, not just a development one.