Your Shopify security checklist

Shopify is a hosted platform, so a lot of the technical work is done for you. You don't patch servers, renew certificates or build a checkout.

What Shopify can't do is decide who gets into your admin, which apps you trust, or whether a convincing email fools you on a busy afternoon. This checklist covers those parts. None of it needs code, and most items take a few minutes.

What does Shopify handle, and what's left to you?

Shopify looks after hosting, the HTTPS connection and the card checkout. Its help center says TLS certificates (often called SSL certificates) are provided free for every domain added to Shopify. Visitors who type an http:// address are sent to the encrypted version automatically. You can't install a certificate from another provider, so there's nothing to buy or renew.

For payments, Shopify says its platform is certified to Level 1 of PCI DSS, the card industry's security standard. That certification is about Shopify's systems. It doesn't cover a staff member who reuses a password, or an owner who types a login code into a fake page.

The split looks like this:

• Shopify runs the hosting, issues the certificates and operates the checkout.
• You control logins, staff access, the apps you install, your domain's email records and how you respond to suspicious messages.

You also can't change the security headers your storefront sends. Shopify's help center doesn't describe a setting for them. If a CyberVigil report flags a missing header on a Shopify store, treat it as a platform choice and spend your time on the items below.

How do I turn on two-step authentication in Shopify?

Two-step authentication, a form of multi-factor authentication (MFA), asks for a code from an app or a security key after your password. Shopify puts the benefit plainly: even if someone learns your password, they can't log in without the second step.

If you use Shopify Payments, it's required. Shopify warns that without it, your payouts might be placed on hold.

To turn it on with an authenticator app:

1. Install an authenticator app on your phone, such as Google Authenticator or Duo Mobile.
2. In your Shopify admin, click your store name, then click your profile, then Security.
3. In the Two-step authentication section, click Turn on two-step.
4. Enter your password, click Next, and choose Authenticator app.
5. Scan the QR code with the app, enter the six-digit code, and click Turn on.
6. Add a backup method if offered, and save your recovery codes in a password manager or another safe place.

Shopify is rolling out a refreshed admin design, so your store name may sit somewhere slightly different. The steps after that stay the same. Text messages can't be added as a new method, so choose an app or a security key.

Do this for your own account today, then move on to your staff.

How should I set up staff accounts and permissions?

Give each person their own login and only the access their job needs. Shared logins make it impossible to tell who changed what, and they keep working after someone leaves.

Shopify groups permissions into roles, such as its predefined Merchandiser role for someone who manages products. You'll find roles under Settings → Users → Roles, and you can assign more than one role to a person if their job spans areas.

Require two-step authentication for staff

Each staff member sets up their own method. Shopify doesn't let the owner turn it on for someone else, but you can require it:

1. Go to Settings → Users and click the staff member.
2. In the Secure sign-in method section, choose the option that requires two-step authentication.
3. Click Save.

Shopify Plus stores can require it for every user at once.

Review access every few months

• Remove former employees, contractors and agencies who've finished their work.
• Check collaborator accounts, which Shopify Partners such as developers use, and remove the ones you no longer need.
• Open Settings → Users → Security and look through the login history for anything you don't recognize.

The FTC's small business guidance makes the same point about outside vendors: "Limit access to a need-to-know basis, and only for the time the vendor needs to do the job." Put a reminder in your calendar for this review.

Which Shopify apps should I remove?

Remove any app you no longer use. Apps are built by outside developers, and each one you keep is another company you trust with your store.

To uninstall an app:

1. In your Shopify admin, go to Settings → Apps.
2. Check the app's documentation or ask its developer whether extra steps are needed. Shopify notes that some apps add code to your theme that isn't removed automatically.
3. Export any data from the app that you want to keep.
4. Open the menu next to the app, click Uninstall, and confirm.
5. If the app billed you outside Shopify, cancel that subscription with the developer directly.

Before you install a new app, check who makes it, read recent reviews, and confirm a built-in Shopify feature doesn't already do the job. Fewer apps means fewer companies with a way into your store.

Check your Shopify store from the outside

Run a free scan to see your HTTPS setup, certificate, security headers and email protection records in one plain-English report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I protect email sent from my store's domain?

Customers trust emails from your domain, and scammers know it. Without email authentication records, someone can send a fake "problem with your order" message that appears to come from yourbusiness.com.

The FTC recommends three records: SPF, DKIM and DMARC. They live in your domain's DNS settings, and where you add them depends on who manages your domain.

• If you bought the domain through Shopify, go to Settings → Domains, click the domain, and click Manage in the DNS settings section. Shopify lets you add custom TXT records there, and its help center says you can edit DMARC settings for Shopify-managed domains.
• If your domain is registered somewhere else, such as GoDaddy or Namecheap, add the records in that company's DNS settings. Leave alone the records that point the domain to Shopify.

A sensible first DMARC record turns on reporting without blocking any mail yet:

SPF and DKIM come from whoever sends your email, such as Google Workspace or Microsoft 365, plus any marketing tool that sends as your domain. Keep a single SPF record and add each service to it. Our guide to SPF, DKIM and DMARC walks through each one.

If your domain has CAA records, which limit who can issue certificates for it, Shopify's help center says they must include letsencrypt.org, pki.goog; cansignhttpexchanges=yes and ssl.com. Check this before you add CAA records, so you don't block your store's own certificate.

How do I spot phishing aimed at Shopify store owners?

Store owners get phishing emails dressed up as Shopify: a policy violation, a payout problem, a store about to be closed. The goal is your password or your login code.

Shopify publishes rules you can check against:

• Real Shopify emails come from domains such as @shopify.com, @email.shopify.com and @em.shopify.com. A "Shopify" message from a Gmail address is fake.
• Shopify doesn't ask for sensitive documents by email. It only collects them through secure upload pages on a .shopify.com address.
• Anyone asking for your two-step code is trying to get into your account.
• Urgent or threatening language is a warning sign, not a reason to hurry.

When a message worries you, type admin.shopify.com into your browser and log in yourself instead of clicking the link. Forward the suspicious email to phishing@shopify.com.

If you already clicked and entered details, change your password, turn on two-step authentication, and contact Shopify Support. Those are Shopify's own recovery steps.

The same tricks show up as fake supplier invoices and "updated bank details" requests, a scam called business email compromise. Before you pay or change payout details, call the sender on a number you already have, not one from the email.

What should you do next?

Start with two-step authentication on your own account, then work down the list. Most stores can finish everything here in an afternoon.

1. Run a free website security scan to check your store's HTTPS, certificate, headers and email records.
2. Test your domain with the DMARC checker, and follow the DMARC fix guide if the record is missing.
3. Read how to stop email spoofing to protect customers from fake messages sent in your name.