Shopify Store Security Checklist for Owners and Teams

Most Shopify stores that get into trouble are not hacked through Shopify itself. Someone shares the owner password, a former freelancer still has access, an old app keeps permissions nobody remembers granting, or a convincing phishing email asks for a login. This checklist covers the settings that close those gaps, how to review who and what can touch your store, and what to do in the first hour if you think your account has been compromised.

Every Shopify setting described here was checked against Shopify's Help Center on 5 November 2026. Menus move around, so if a step looks different in your admin, search the Help Center for the feature name.

Why is Shopify store security mostly about people, not code?

Shopify runs the servers, the checkout and the payment processing. You do not patch a web server or update a plugin the way a WordPress store owner does. What you do control is who can log in, what each person and app is allowed to do, and how carefully your team treats emails and calls that ask for access.

Shopify's own account security guidance is blunt about this. The store owner should not share their login credentials with anyone, including staff, and every person accessing the store should have a unique staff account with specific permissions. Shopify's terms of service make keeping those credentials secure the account holder's responsibility.

In our experience, the stores most exposed are not the biggest ones. They are fast growing D2C brands where the founder's login was handed to an agency, an intern and a marketing freelancer during launch, and nobody took it back.

Is two-step authentication on for everyone who logs in?

Two-step authentication means a password alone is not enough to log in. Shopify supports several second steps: an authenticator app, a security key, or a built-in authenticator on your device. Shopify also supports passkeys as a secure sign-in method.

Three details matter for Indian teams:

• SMS can no longer be set up as a new method. Shopify says SMS text messages cannot be added as a new two-step authentication method. Accounts that already use SMS can keep it, but move to an authenticator app when you can, because SIM swap fraud targets exactly this.
• Shopify Payments requires it. Shopify states that two-step authentication must be active to accept payments with Shopify Payments, and that without it your payouts might be placed on hold.
• Each staff member sets up their own. The store owner cannot switch on two-step authentication for another staff member. You have to ask every person to do it and then check. On Shopify Plus, the organisation can require a secure sign-in method for all users.

Also add a backup method and store the recovery codes somewhere safe that is not the same phone. Losing the only device with your authenticator app is a common way founders lock themselves out.

Who has access to your Shopify admin right now?

Open the users section of your admin and go through every account, one by one. Ask three questions about each:

1. Does this person still work with us? Remove anyone who has left, including agencies whose project ended.
2. Do they need everything they can see? Shopify assigns permissions through roles, and some permissions are classed as sensitive. A customer support executive needs orders and customers, not payout settings or the ability to install apps.
3. Is it a person or a shared login? An account named "Marketing" or "Store Team" means several people share a password. Replace it with individual accounts so every action can be traced to one person.

Developers and agencies should come in through collaborator accounts rather than as staff on your plan. Collaborator access is requested by the partner and approved by you, and it can be limited to the areas they need. We explained the setup in detail in our guide to giving a developer collaborator access. The security point is simple: when the project ends, remove the collaborator the same day.

Which apps can read or change your store data?

Every app you install is granted access to parts of your store data when you approve it. That access usually stays until the app is uninstalled. An app you tried for a week two years ago may still be able to read your customer list.

Go to the apps section of your settings and list every installed app. For each one:

• Is it in active use? If not, uninstall it. Remember that uninstalling does not always remove code an app added to your theme, so check the theme as well.
• Who installed it, and does anyone know what it does? Unknown apps are a red flag.
• Does its access make sense? A countdown timer has no obvious reason to read customer data.
• Is the developer still active? Apps that have stopped updating are a risk as Shopify's APIs change.

An app review also usually cuts your monthly bill. We cover the cost side in our Shopify app stack audit guide.

How do you spot phishing aimed at Shopify merchants?

Shopify's guidance warns about phishing by email, vishing by phone and smishing by SMS, all designed to get your login details. The messages can look like they come from a reputable source. Typical Shopify themed lures include a "store suspended" notice, a "copyright complaint" with a link, a "payout on hold" email, or a caller claiming to be from Shopify Support asking for a code.

Rules worth printing for your team:

• Never share a two-step authentication code with anyone, by phone, WhatsApp or email.
• Log in by typing the address yourself, not through a link in a message.
• Check where documents are requested. Shopify says its support team asks for sensitive documents only through a secure upload page on app.shopify.com or a .shopify.com address.
• Do not put private files in Content > Files. Shopify warns that this section is meant for public storefront files. Never upload invoices, ID documents or customer exports there.
• Be suspicious of urgency. Real account problems do not require you to act within ten minutes on a phone call.

What should you check in payouts, domains and settings?

An attacker who gets in does not always steal data. Often the aim is money or traffic. Look at the settings that would be changed first:

• Payout bank account. Confirm the account number on file is yours. Changes to payout details are the classic sign of fraud.
• Store owner email and phone. If these change, recovery gets much harder.
• Domains and DNS. Check that your domain still points to Shopify and that no unfamiliar domain has been connected.
• Theme code. Look for theme edits nobody on your team made, especially new script tags in the layout file.
• Notification emails. Check that order and staff notifications still go to addresses you control.

A monthly ten minute look at these is enough for most stores. A backup of your theme and product data also helps you recover faster, as we explained in our post on what Shopify backups actually restore.

What do you do in the first hour if your store is compromised?

Shopify's advice is to contact Shopify Support immediately and secure the compromised account. In practice, we work through this order so nothing is missed while you wait for a reply.

1. Secure the owner account from a device you trust. Change the password and sign out other sessions.
2. Check two-step authentication and the recovery methods on the owner account. Remove anything you did not add.
3. Review staff, collaborators and apps. Remove unknown accounts and recently installed apps you do not recognise.
4. Check payouts, domains and recent setting changes from the list above.
5. Contact Shopify Support and keep a written timeline of what you found and when.
6. If money has moved, report it quickly. In India, the national cyber fraud helpline is 1930, operational since April 2022 according to the Ministry of Home Affairs, and complaints can be filed on the National Cybercrime Reporting Portal. Tell your bank the same day.

Businesses can also report cyber security incidents to CERT-In, India's national computer emergency response team. If customer data may have been exposed, take legal advice on your reporting obligations, because they depend on what was accessed.

How often should you repeat this checklist?

Run the full review once a quarter, and a short version whenever someone leaves the team or an agency project ends. The quarterly version takes under an hour for most stores: users and roles, collaborators, apps, two-step authentication status for each person, payout details, domains and a quick look at recent theme edits.

If you would rather not do this alone, or you think something is already wrong, a second pair of eyes helps. Our emergency Shopify support post explains how we handle urgent cases.

Want your store's access checked? Write to us at hello@exactwhy.com with the subject "Store security review". Approve a collaborator request with limited permissions and we will go through staff, collaborators, apps, theme code and key settings for free and send you a list of what to remove or change. If cleanup needs development work, we quote it after that review, and ongoing store support is available on a monthly retainer.