Shopify Store Security: A 2026 Checklist

TL;DR: Shopify secures the platform: infrastructure, hosted checkout, and PCI compliance. You are responsible for everything you control: your admin account, staff permissions, the apps you install, the customer data you hold, and the traffic you let reach your store. This is a practical 2026 checklist across all of those layers, with an honest note on where each responsibility actually sits.

Merchants ask "is Shopify secure" and the honest answer is "the parts Shopify runs are, and the parts you run are up to you." Shopify handles the hard infrastructure and payment security. It cannot choose a strong password for you, decide which apps to trust, or judge who should reach your storefront. This checklist covers the layers a merchant actually controls, in the order they matter.

The division of responsibility

Before the checklist, get the mental model right. Security on Shopify is shared. Shopify owns the platform; you own your side of it.

Shopify documents its platform-side commitments in Shopify's help center. Everything in the "You" rows is what the rest of this post is about.

1. Account and access

This is the layer attackers hit first, because it is the cheapest. A stolen or reused password with no second factor is how most store takeovers start.

• Use a strong, unique password for your Shopify admin. Unique matters as much as strong: a password reused from a site that later gets breached is a working key to your store. A password manager makes this practical.
• Turn on two-factor authentication on the admin, and require it for every staff member. Prefer an authenticator app or a hardware security key over SMS, since SMS can be intercepted through SIM swapping.
• Review who has access regularly. People leave, agencies finish projects, freelancers move on. Each of those is a live door until you close it.

Two-factor authentication on every account is the single highest-value item on this entire list. If you do nothing else today, do that.

2. Staff permissions and collaborators

Not everyone who works on your store needs full admin. Least privilege means each person gets exactly the access their job requires and nothing more.

1. Give each staff member only the permissions their role needs. A fulfillment person does not need to edit payment settings. A content editor does not need customer export.
2. Remove ex-staff immediately. When someone leaves, delete their account the same day. A dormant account with admin rights is a liability that produces no benefit.
3. Audit collaborator access. Agencies and Shopify Partners request collaborator access to work on your store. Review the list periodically and revoke access for anyone whose work is finished.
4. Prefer named accounts over shared logins. Shared credentials remove accountability and cannot be revoked for one person without disrupting everyone. Give each person their own account.

The point is not distrust. It is that fewer people with high access means fewer accounts an attacker can target and fewer ways a mistake becomes a breach.

3. App hygiene

Every app you install with admin access can read or change data according to its scopes. That makes each app part of your attack surface. A well-run store keeps that surface small.

• Audit your installed apps. Open your app list and ask, for each one, "do I still use this, and does it need the access it has?" Stores accumulate apps from abandoned experiments that keep their permissions long after anyone opens them.
• Remove apps you no longer use. An unused app is pure risk: no benefit, full access. Uninstalling it revokes its scopes.
• Prefer apps that request minimal permissions. When you install something, look at what it asks for. An app that requests broad access it clearly does not need is a flag. Good apps practice scope minimization and ask only for what they use.
• Watch for apps that inject script tags into your storefront, since those run on your customers' browsers. Modern, well-built apps use theme app extensions instead, which are sandboxed and reviewable.

The principle: every integration is a trust decision. Fewer, better-scoped apps is a more secure store than a pile of half-used ones.

4. Checkout and payment

This is the layer where Shopify does the heavy lifting, and you should let it.

Shopify hosts and secures checkout and is PCI DSS Level 1 compliant, which means card data is handled on Shopify's infrastructure and never touches yours. You do not build or secure the payment page. What remains yours is the fraud decisions around orders:

• Use Shopify's built-in fraud analysis. It scores orders for risk signals like billing and shipping mismatches and flags high-risk orders for review before you fulfill.
• Enable 3-D Secure where available. It adds an authentication step on the payment and can shift liability on authenticated transactions, at the cost of some checkout friction.
• Review high-risk orders before fulfilling. The flags exist to be acted on. A flagged order shipped without a glance is the flag wasted.

Fraud analysis acts after an order exists, which is why it pairs well with visit-level prevention. The full timing argument is in our chargebacks post.

5. Data and privacy

You hold customer data (names, addresses, emails, order history, and for EU visitors, IP addresses count as personal data). Holding it is a responsibility, not just an asset.

• Know what you hold and where it goes. List the customer data your store collects and which apps and vendors receive it. You cannot protect data you have not mapped.
• Have a privacy policy, and for EU customers, a data processing agreement (DPA) with the vendors that process personal data on your behalf. This is a legal requirement under GDPR, not a nicety.
• Minimize retention. Data you do not keep cannot leak. Delete what you no longer need, and prefer vendors that hash or truncate sensitive fields rather than storing them raw.

Privacy and security overlap here: the less sensitive data you retain, and the fewer places it sits, the smaller the damage from any single breach.

6. The perimeter: who reaches your store at all

This is the layer most security checklists skip, and it sits before all the others. Every layer above assumes traffic has already arrived. The perimeter is about deciding who reaches your storefront in the first place.

The traffic hitting a Shopify store is not all customers. A large share is automated: bots probing forms, scrapers copying your catalog and prices, headless clients testing stolen credentials, and fraud traffic hiding behind VPNs, proxies, and datacenter networks. None of that is a shopper, and filtering it before it reaches your store reduces automated abuse, reconnaissance, and the noise your other defenses have to sift through.

This is where Cordon fits, and it fits as one layer among several. It filters traffic at the visit: blocking by country, IP or CIDR range, whole ASN, VPN/proxy/Tor, bots and scrapers, and datacenter networks like AWS, Alibaba, Tencent, and Huawei Cloud. Verified search engines are always allowed, allow rules always win over block rules, and the decision runs in under 50 milliseconds and fails open on any outage so it never blocks real customers during a hiccup. Specific patterns have their own guides: content scraping, VPN and proxy checkout fraud, and blocking abusive countries.

Be clear about what this layer is and is not. It filters traffic. It does not manage your passwords, your two-factor auth, your staff permissions, or your app scopes. Traffic filtering is the perimeter, not the whole castle. It reduces the volume of automated abuse reaching your store; it does not replace any of the five layers above it.

The full checklist at a glance

Work top to bottom. The account and access layer stops the most common takeover for the least effort. The perimeter layer is the one most merchants have never set up at all.

Frequently asked questions

Is Shopify secure?

Yes, at the platform level. Shopify is PCI DSS Level 1 compliant, hosts and secures checkout, and runs the infrastructure. What Shopify cannot secure for you is your admin account, your staff permissions, the apps you install, and the traffic you allow in. Those are the merchant's responsibility.

What is the single most important Shopify security step?

Turn on two-factor authentication for your admin account and every staff account, using an authenticator app or security key rather than SMS. A stolen admin password with no second factor is the most common way a store gets taken over.

Do installed apps affect my store's security?

Yes. Every app you grant admin access to can read or change whatever its scopes allow, so each one is attack surface. Audit your installed apps, remove ones you no longer use, and prefer apps that request only the permissions they actually need.

Does Shopify handle PCI compliance for me?

For payments processed through Shopify's hosted checkout, yes. Shopify is PCI DSS Level 1 compliant and card data is handled on its infrastructure, not yours. You are still responsible for the rest of your security: accounts, apps, staff access, and data handling.

Where does traffic filtering fit in a security checklist?

It is the perimeter layer that most checklists skip: deciding who reaches your storefront at all. Filtering bots, scrapers, proxy fraud, and abusive networks reduces automated abuse and reconnaissance. It is one layer among several, not a replacement for account, app, and checkout security.

---

Most of this checklist costs nothing but attention: turn on 2FA, prune your apps, tighten staff access, review flagged orders. If the perimeter layer is the gap in your setup, Cordon handles traffic filtering as one part of a fuller security posture. It is a theme app extension, decides in under 50 milliseconds, and has a 7-day free trial on paid plans. Start with the free plan and the feature list if you want to see what the traffic layer actually filters.