Shopify Security Best Practices: 2026 Checklist

Many Shopify account takeovers start the same way: two-factor authentication was off. Account security is the first layer. Shopify security best practices start there but don’t end there. A properly secured account with 23 apps loaded with excessive permissions and no data compliance setup is still a security problem. Here’s the complete stack.

These practices are not a one-time setup. They’re a maintenance discipline — quarterly app audits, monthly permission reviews, regular password rotations. This checklist organizes what to do and when.

Key Takeaways

2FA via authenticator app (not SMS) is the foundational security control — enable it first

Dormant app permissions remain active after you stop using an app — remove them

GDPR fines can reach up to €20 million or 4% of global annual turnover

Shopify handles PCI DSS compliance for payments — but your app stack, forms, and data handling are still your responsibility

Account Security — The Foundation of Shopify Security

Enabling 2FA: Authenticator App vs. SMS

Enable two-factor authentication immediately if it isn’t active. In Shopify admin, go to Profile > Security > Two-step authentication.

Authenticator app (Google Authenticator, Authy, 1Password) is significantly more secure than SMS. SMS-based 2FA is vulnerable to SIM swapping attacks — where an attacker convinces a carrier to transfer your phone number to a SIM they control. This is not a theoretical threat; it’s documented in numerous high-profile account takeovers.

An authenticator app generates codes locally on your device, requiring physical access to your phone. SIM swapping cannot compromise an authenticator app-based 2FA.

Require 2FA for every staff account in your Shopify organization, not just the owner account.

Password Hygiene: Unique, Long, Never Reused

Your Shopify admin password should be:

Minimum 16 characters
Unique to Shopify — not reused from any other service
Stored in a password manager (1Password, Bitwarden, Dashlane)
Changed if there’s any possibility the previous password was exposed

“I’ll remember it” is not a password strategy. Password managers generate and store unique 20+ character passwords for every account. The cost of not using one is eventual credential reuse across a breach notification — which happens to almost everyone using the same password across multiple services.

Reviewing and Limiting Staff Account Access

Every staff account is a potential attack vector. Review your staff accounts quarterly:

Remove accounts for employees who’ve left
Reduce permissions for accounts that don’t need broad access
Never create shared login accounts for multiple people

Shopify’s staff permission system allows granular control: an order fulfillment employee doesn’t need access to products, themes, or app management. Principle of least privilege — give each account only the permissions it actually needs.

Shopify’s 2026 Granular Staff Permission Settings

Shopify updated its staff permission model in recent releases to include more granular controls by area. Review the available permission granularity for your current plan:

Order management: separate permissions for viewing, editing, fulfilling, and refunding
Product management: read vs. write vs. publish
Customer data: read vs. write vs. export
Financial reports: view-only access for reporting staff

Configure each staff role precisely. An employee who only needs to process returns does not need product write access.

Say a store owner hires a virtual assistant for customer service and gives the staff account full Shopify access because it’s faster than setting permissions. If that account is ever compromised or misused, it can process refunds on any order. A customer-service-only permission set keeps refund processing out of reach entirely.

App Security — The Most Overlooked Shopify Security Risk

Only Install From the Official Shopify App Store

The Shopify App Store applies a review process before apps are listed. It’s not a perfect security guarantee, but it filters out obvious malicious code. Third-party app installations from direct download links or custom installations bypass this review entirely.

Do not install apps from URLs shared in forums, by email, or from unknown developers requesting direct installation access to your store.

Review Permissions Before Installation

Before installing any app, read the permission request list. Every item in that list is data access you’re granting. The standard question: does this app’s stated function require this permission?

A size chart app requesting customer order history has no legitimate reason. Deny installation and find an alternative.

Uninstall Apps You No Longer Use

Dormant app permissions remain active for as long as an app stays installed, even if you stopped using it months ago. Uninstalling revokes the app’s API access, but some apps leave code in your theme that isn’t removed automatically.

Review your app list every quarter. Any app not actively used in the last 30 days should be removed. After removal, verify in your theme code that the app’s script tags are gone. For a full breakdown of app risks and how to conduct a security-focused app audit, see our guide on Shopify third-party app risks.

App Audit Cadence: Quarterly

Set a quarterly calendar reminder: app permissions audit. Takes 20 minutes. Review:

Apps installed (any new ones since last audit?)
Data permissions for each app (still appropriate?)
Apps with zero activity in last 30 days (remove them)
Theme code for orphaned scripts from previously removed apps

Data Protection and Compliance

If you offer goods to people in the EU (or track their behaviour), GDPR applies. Key requirements:

Cookie consent: You must obtain explicit consent before loading non-essential cookies (analytics, marketing, personalization). A cookie banner that says “By using this site, you agree to cookies” does not satisfy GDPR. A genuine opt-in/opt-out mechanism is required.

Data subject rights: EU customers can request access to their data, correction, deletion, and export. You must be able to respond to these requests within 30 days. Shopify’s customer export feature handles data access requests; deletion requires removing the customer record from Shopify and from any connected apps.

Data processing records: You must document what data you collect, why, and how it’s processed. This doesn’t require a lawyer — a one-page internal document suffices for most SMBs.

GDPR fines for non-compliance are real: up to €20 million or 4% of global annual turnover. SMBs aren’t immune — supervisory authorities have fined businesses with revenues under €1M for cookie consent violations.

CCPA Requirements for California Customers

California’s Consumer Privacy Act gives California residents similar rights to GDPR: right to know, right to delete, right to opt out of sale of personal data. If you serve California customers and your business meets the thresholds (annual gross revenue over $26,625,000, the CPPA-adjusted figure, OR buying, selling or sharing personal information of 100,000+ consumers or households, OR 50%+ of revenue from selling or sharing personal information), CCPA applies.

For most SMB Shopify merchants, the practical requirement: a “Do Not Sell or Share My Personal Information” link in the footer and a process to handle deletion requests.

CCPA and GDPR requirements often overlap. A privacy policy and consent mechanism compliant with GDPR satisfies most CCPA requirements for the data handling aspects.

Shopify’s native cookie consent banner is available through the Shopify admin. For more configurable options:

Cookiebot: Comprehensive consent management, auto-scans cookies, handles both GDPR and CCPA
Pandectes GDPR: Shopify-specific, handles consent categorization
OneTrust: Enterprise-grade option for stores with complex compliance requirements

Whatever solution you use, verify it actually blocks non-essential cookies before consent is given. Many “consent banners” display the banner but load all cookies immediately — which is non-compliant.

How Shopify Handles PCI DSS Compliance (and What You Still Own)

Shopify is PCI DSS Level 1 compliant — the highest level. This means Shopify’s payment infrastructure, card data handling, and transaction processing meet the strictest security standards.

What this covers: card data is never stored on Shopify’s servers after authorization. Payment transactions are encrypted. Shopify maintains security certifications.

What this doesn’t cover: your own practices around customer data outside of payment processing. If you export customer lists to a spreadsheet stored on an unsecured Google Drive, that’s your compliance gap, not Shopify’s. If your apps handle customer payment references insecurely, that’s your responsibility too.

For Shopify stores handling complex compliance requirements, every Shopify store build we do includes cookie consent implementation as standard.

Fraud Prevention Integration

Shopify’s Built-In Fraud Analysis Indicators

Every order in Shopify includes fraud risk indicators: High, Medium, Low. These are generated by Shopify’s fraud analysis system based on AVS (address verification), CVV matching, IP geolocation, and order pattern analysis.

Check every High and Medium risk order before fulfilling. Review the specific indicators flagged (billing/shipping address mismatch, IP mismatch, multiple orders with different cards) before deciding whether to fulfill or hold.

AVS and CVV Matching Setup

Shopify Payments includes AVS and CVV verification as standard. For stores using third-party payment gateways (Authorize.net, Stripe direct), verify AVS and CVV checking is configured in your gateway settings — it may not be enabled by default.

AVS matches the billing address submitted by the customer to the address on file with the card issuer. A full mismatch is a strong fraud indicator. CVV verification confirms physical possession of the card. Both should always be enabled.

Shopify Flow Automations for High-Risk Orders

Shopify Flow (available on all plans as of 2023) can automate responses to fraud indicators:

Auto-cancel orders flagged as high-risk with a specific card testing pattern
Send internal notification for manual review when risk score exceeds threshold
Auto-capture payment for low-risk orders to speed up fulfillment

These automations don’t require code — they’re configured through Shopify Flow’s visual editor. Setting up basic fraud automations takes approximately 30 minutes.

Backup and Recovery

Shopify Doesn’t Have Native Version Control — What That Means

Shopify doesn’t offer a “restore to yesterday’s state” feature. If a theme update breaks your store, if a staff member accidentally deletes a product category, or if an app modification damages your theme code, recovery requires:

A manually saved theme backup
Manual data export backups
Or a third-party backup app

This is a real gap in Shopify’s infrastructure. Build backup processes around it.

Manual Data Export Schedule

Shopify admin provides manual export options for:

Customers (CSV)
Products (CSV)
Orders (CSV)

Export frequency recommendations:

Products: after any major catalog change, minimum monthly
Customers: monthly
Orders: weekly for active stores, monthly for lower volume

Store exports in an encrypted cloud storage location (Google Drive, Dropbox, or similar) with access restricted to store owners.

Theme Backup Before Updates

Before any theme update (whether Shopify’s automatic theme updates or manual edits), duplicate your current theme:

Shopify admin > Online Store > Themes > Actions > Duplicate

This creates a backup version you can reactivate immediately if the update causes issues. Keep the last 2–3 theme backups.

Imagine a store with no formal backup process. A developer installing a new app edits theme.liquid incorrectly and breaks the navigation across the whole store. Without a theme backup, recovery means rebuilding the navigation from memory. A 5-minute theme duplication before the installation turns that into a quick restore.

Monitoring and Incident Response

Shopify Activity Log: What It Captures and How to Review It

Shopify admin > Settings > Activity log (or search “activity” in admin). The log records: admin logins, product edits, order changes, app installations, theme modifications, permission changes.

Review the activity log weekly. You’re looking for: logins from unrecognized locations, changes made outside of business hours, app installations you didn’t authorize, and mass product or order modifications.

Shopify sends email notifications for new device logins by default. Verify these notifications are enabled and going to an email address actively monitored.

For stores with multiple staff accounts, consider Shopify Flow automations that trigger notifications for bulk operations: more than 10 order modifications in an hour, unusual order cancellation volume, or product bulk edits.

Steps to Take If Your Store Is Compromised

If you suspect a breach:

Immediately revoke all staff account access (disable accounts you didn’t create or don’t recognize)
Change the Shopify owner account password
Review all installed apps and remove any you didn’t install
Check Shopify activity log for the past 30 days
Review orders for fraudulent refunds or address changes
If customer data was accessed: consult your GDPR obligations for breach notification (72 hours in the EU)
Contact Shopify Support to report the incident and get assistance

Don’t wait to assess the full scope before taking protective action. Revoke access first, investigate second.

Security Audit Schedule

These are the core Shopify security best practices organized by maintenance frequency. Build these tasks into a calendar:

Weekly (15 minutes):

Review Shopify activity log
Check for High-risk orders not yet reviewed

Monthly (30 minutes):

Review staff permissions — any changes needed?
Rotate passwords if any staff changes occurred
Verify 2FA is active on all staff accounts

Quarterly (2 hours):

Full app audit: permissions, usage, cost, script weight
Review GDPR/CCPA compliance status
Test data export backup process
Review fraud indicators and Shopify Flow automations
Update all admin passwords

Conclusion

Shopify security is not a configuration you complete once and check off. It’s an ongoing maintenance practice. The stores that get breached aren’t typically those that never set up security — they’re the ones that set it up in 2021 and never reviewed it again as staff changed, apps accumulated, and the store grew.

The three highest-priority Shopify security best practices for most stores: enable 2FA via authenticator app, audit and trim your app stack, and implement a GDPR-compliant cookie consent mechanism. Everything else in this guide is important, but those three changes close the most common vulnerabilities.

If you need a systematic security review for your Shopify store, talk to us about reviewing account security, app permissions, and data compliance. Our Shopify agency team includes cookie consent in all store builds as standard.

Frequently Asked Questions

Is Shopify secure for selling online?

Shopify’s infrastructure is highly secure — PCI DSS Level 1 compliant, SSL/TLS encryption on all storefronts, DDoS protection, and regular security audits. The security risks for Shopify merchants come from the application layer above that infrastructure: weak account credentials, overpermissioned apps, unpatched third-party code, and inadequate data handling practices. Shopify protects the platform; merchants are responsible for their own accounts and configurations.

Does Shopify protect customer payment data?

Yes. Shopify Payments and Shopify’s checkout handle card data in a PCI DSS Level 1 compliant environment. Card numbers are never stored on Shopify’s servers after authorization. Payment tokens are used for recurring charges. This protection applies to payments processed through Shopify Payments — stores using third-party gateways should verify those gateways’ PCI compliance independently.

How do I enable two-factor authentication on Shopify?

In Shopify admin, click your profile picture (top right) > Manage account > Profile > Security > Two-step authentication > Turn on. Select “Authenticator app” (recommended over SMS). Download Google Authenticator or Authy. Scan the QR code displayed in Shopify. Enter the 6-digit code to confirm. Save your backup codes in a secure location. Require all staff accounts to enable 2FA through Shopify’s staff management settings.

What happens if my Shopify store is hacked?

First: disable or change credentials for all staff accounts. Second: change the Shopify owner account password and verify 2FA. Third: review the activity log for the past 30 days. Fourth: audit installed apps and remove any you didn’t install. Fifth: review recent orders for fraudulent modifications. Sixth: contact Shopify Support to report the incident. For GDPR-regulated stores with EU customers: you may have a 72-hour data breach notification obligation to your relevant supervisory authority.

If you offer goods to people in the EU (or track their behaviour), GDPR applies to your processing of their personal data. Shopify’s infrastructure is GDPR-compliant, but your responsibilities extend to: cookie consent implementation, privacy policy accuracy, data subject rights response, app data handling, and marketing consent management. These are merchant responsibilities, not platform responsibilities.