The average Shopify store has 14 apps installed. Each one writes to your theme, loads scripts on every page, and retains access to your customer data. Most merchants have never audited them.
Apps solve real problems. They also create performance problems, security risks, and ongoing subscription costs that compound over time. Here’s the direct view of what Shopify third-party app risks are actually costing you.
Key Takeaways
- Stores with 8+ app scripts have median mobile LCP above 3.0 seconds; stores with ≤3 average under 2.0s
- 64% of third-party apps access sensitive data beyond what their function requires
- “Zombie apps” — uninstalled but still loading scripts — are common and often undetected
- Some of the highest-cost apps are replaceable with 20–50 lines of custom code
The Performance Cost of Shopify Third-Party Apps
How App Scripts Load on Every Page (Even When Not Needed)
Most Shopify apps inject JavaScript into your theme via app blocks or script tags that load on every page of your store — regardless of whether that page needs the app’s functionality.
A review widget loading on your checkout page. A loyalty program script firing on a 404 error page. A chat widget loading on every product page — but your customers only use it from the homepage. Each script loads, executes, and competes for the browser’s main thread on every page visit.
This isn’t malicious — it’s how Shopify’s app architecture works. Apps get script access via theme app extensions. The simplest implementation is to load on every page. A thoughtful implementation loads conditionally. Most app developers choose simplicity.
Median LCP for Stores with 8+ Apps: Above 3.0 Seconds
Benchmark data from Shero Commerce shows the correlation clearly:
- Stores with 3 or fewer front-end app scripts: median mobile LCP under 2.0 seconds
- Stores with 8+ front-end app scripts: median mobile LCP above 3.0 seconds
The 1+ second difference in LCP doesn’t come from one bad app. It comes from the cumulative weight of 8 scripts each adding 50–150ms of main thread blocking time. At 8 apps, the cumulative effect crosses the LCP failure threshold.
For a store converting at 1.5% on $50 average order value with 300 daily visitors: a 1-second LCP improvement translates to approximately $1,575/month in additional revenue. Some of that gain is sitting in your installed apps list.
Identifying Which Apps Load the Most JavaScript
Run your store URL through Chrome DevTools > Network tab > filter by JS. Every external domain loading JavaScript is either an app or a tracking script.
Map each domain to the app responsible. Check file sizes — any single script over 50KB deserves scrutiny. Check load timing — any script taking more than 300ms to load is a meaningful LCP and INP contributor.
You’ll typically find 3–4 apps responsible for 60–70% of total script weight. Those are your priority audit targets.
Jamie ran a pet supplies store with $40K/month in revenue and 16 installed apps. A performance audit found her mobile LCP at 5.2 seconds. Script analysis identified: a review app (180KB), a loyalty program (220KB), a product recommender (150KB), and a chatbot (200KB) as the four largest contributors. Combined: 750KB of JavaScript loading synchronously before the first product image appeared. After removing the chatbot (unused by customers), replacing the loyalty program with a simpler app, and deferring the recommender script, LCP dropped to 2.4 seconds. Mobile conversions improved 18% in the following month.
The Security Risk of Shopify Third-Party Apps
What App Permissions Actually Grant
When you install a Shopify app and click “Install app” on the permission request screen, you’re granting OAuth-level API access. The most common permission categories:
- Read customers: full access to all customer names, emails, addresses, order history
- Write orders: ability to create, modify, or cancel orders
- Read/write products: full catalog access
- Write theme: ability to modify your theme code
A review app needs: product data (to display which products have reviews) and order data (to send post-purchase review requests). It does not need access to write your theme code. If it requests theme write access, ask why.
64% of Third-Party Apps Access Sensitive Data Without Justification
Security researchers have documented that a significant portion of Shopify apps request data permissions beyond what their function requires. A countdown timer shouldn’t need customer data. A size chart app shouldn’t need order history. Excess permission requests aren’t necessarily malicious — they may reflect sloppy development or permission templates used for multiple apps. But they represent risk.
Dormant App Permissions Remain Active After You Stop Using Them
This is the part most merchants don’t know: uninstalling a Shopify app doesn’t automatically revoke all its access. Script tags injected into themes by some apps persist after uninstallation. OAuth tokens may remain valid until explicitly revoked.
The “zombie app” problem: you uninstall an app because you’ve switched to a different solution. The app’s script tag remains in your theme, loading on every page visit. The app’s API access may remain active. You’re paying no subscription, but you’re still carrying the performance and security liability.
Check your theme code (Shopify admin > Online Store > Edit Code > Assets > theme.liquid) for script tags from apps you no longer use. They look like:
<script src="https://cdn.appvendor.com/tracking.js"></script>Search for any domain you don’t recognize. Then cross-reference against your installed apps list. If the domain doesn’t match an installed app, it’s a zombie script.
The Financial Cost of Shopify App Subscriptions
Average Monthly App Spend for Shopify Stores
Merchants with 14 installed apps paying an average of $15–25/month per paid app are spending $150–350/month on app subscriptions. Over 24 months, that’s $3,600–8,400 — often for functionality that could have been built once at lower total cost.
The subscription model benefits app developers significantly: recurring revenue that continues as long as the merchant doesn’t audit. The merchant benefit: lower upfront cost and maintained updates. The merchant cost: perpetual payment for functionality that could be owned outright.
Apps That Duplicate Functionality Already Native in Shopify
Shopify adds features regularly. Apps that solved real gaps in 2020 now compete with native Shopify functionality. Common examples:
- Back-in-stock notification: Now native in Shopify on Basic plan and above
- Buy X Get Y discounts: Native in Shopify Discounts
- Gift cards: Native in Shopify
- Product reviews (basic): Shopify’s native Reviews app (free, basic functionality)
- Email capture at checkout: Native checkout email capture with marketing consent
If you’re paying $10–30/month for an app doing something Shopify now does natively, that’s a straightforward cancellation.
The “Better to Build Than Rent” Calculation for High-Value Apps
For apps providing significant functionality (custom checkout upsells, complex tiered pricing, custom product configurators), the build-vs-subscribe calculation:
Annual app subscription: $20/month × 12 = $240 Custom development: 4–8 hours × $100/hour = $400–800
At year 1, building costs more. At year 2, building is neutral or cheaper. At year 3+, building is significantly cheaper. And the custom code doesn’t have a vendor dependency — it doesn’t break if the app shuts down or changes pricing.
The break-even point for replacing a Shopify app with custom code: approximately 18–24 months. For apps you’ve been running for 3+ years, you’ve almost certainly paid more than it would cost to build the functionality.
Our custom Shopify development team regularly replaces high-cost app stacks with lightweight custom code. For a comprehensive audit of your current app stack with build-vs-subscribe analysis, see our Shopify Store Health Audit at $299.
How to Audit Your Current Shopify App Stack
Step 1: Inventory Every Installed App and Its Monthly Cost
Go to Shopify admin > Apps. List every installed app, its function, and its monthly cost. Include apps on free plans — they still have performance and security implications even if they don’t have a subscription cost.
Create a spreadsheet with: App name | Function | Monthly cost | Data permissions | Last 30 days active usage.
Step 2: Check Data Permissions for Each App
For each app, click through to the app’s permission page in Shopify admin. Review what data access the app has. Ask: does this app’s function require this data access?
A loyalty program needs customer data — it manages customer points. It doesn’t need to write to your theme. If it requests theme write access, investigate why.
Step 3: Measure Script Load Per App
Use Chrome DevTools Network tab > filter by JS. Reload the page. Match each external script domain to its app. Record file size and load time for each.
Rank by impact: heaviest scripts and slowest load times first.
Step 4: Remove Apps Not Used in the Last 30 Days
Any app not actively used in the last 30 days should be removed. Check your Shopify activity log for any API calls from each app. Zero API calls in 30 days = the app is likely dormant.
Remove it. If you’re wrong, reinstalling takes 5 minutes.
After removing any app: check your theme.liquid for orphaned script tags. Remove any that remain.
Evaluating New Apps Before Installation
Check the Permission Request Against the App’s Function
Before clicking “Install,” review the permission list carefully. Every permission beyond what the app’s function requires is a risk. Common mismatches:
- Size chart app requesting order write access (no reason)
- FAQ widget requesting customer read access (no reason)
- Countdown timer requesting theme write + customer data (partial reason for theme write; no reason for customer data)
If the permission request seems excessive, look for alternatives with more appropriate permission scopes.
Review the Developer’s Update History
In the Shopify App Store, check when the app was last updated. An app not updated in 18+ months may be unmaintained — meaning security vulnerabilities discovered after that date remain unpatched.
Look for: regular updates (monthly or quarterly), a visible developer/company, and documented responses to reviews mentioning bugs or issues.
Read the Privacy Policy for Data Sharing Disclosures
Most merchants skip the privacy policy. It discloses whether the app shares customer data with third parties — advertising platforms, analytics providers, resellers. A loyalty app that shares customer email lists with “trusted marketing partners” is monetizing your customer data.
Legitimate apps have clear, limited data sharing disclosures. An app with vague “we may share with partners” language is a risk your customer data policy may not allow.
Test on a Development Store Before Production Install
Shopify offers development stores (free). Before installing any new app on your live store, test it on a development store first. Verify it does what it claims, check the scripts it loads, and confirm it doesn’t conflict with your existing theme.
Marcus acquired a Shopify store as part of a business purchase. The store had 23 installed apps accumulated over 6 years. He ran a full audit: 8 apps were completely dormant (no API calls in 90 days), 4 apps duplicated functionality now native in Shopify, and 3 apps were loading scripts not removed from theme.liquid after previous uninstalls. After cleanup, 12 apps remained. Monthly subscriptions dropped from $380 to $190. Mobile LCP improved from 4.6 seconds to 2.8 seconds purely from removing the script weight. The audit took 4 hours.
When Custom Code Beats a Shopify App
Apps Worth Replacing with Lightweight Custom Solutions
These categories are regularly over-engineered with apps when a small amount of custom code serves the same function:
Announcement bars: An HTML/CSS announcement bar with a close button is 20 lines of code. App equivalent: $8–15/month.
Countdown timers: A basic product page countdown timer is 30 lines of JavaScript. App equivalent: $10–20/month.
Size charts: A responsive size chart modal is a CSS table in a Liquid snippet. App equivalent: $8–12/month.
Free shipping progress bars: 25 lines of JavaScript calculating cart distance from threshold. App equivalent: $9–15/month.
Developer Cost vs. 24-Month App Subscription Comparison
Custom announcement bar:
- Development cost: 1 hour at $100 = $100
- App subscription 24 months: $12/month × 24 = $288
- Savings: $188 over 24 months + no script weight
Custom countdown timer:
- Development cost: 2 hours at $100 = $200
- App subscription 24 months: $15/month × 24 = $360
- Savings: $160 over 24 months + no script weight
For a store replacing 4 lightweight apps with custom code: $600–800 in development, $500–1,000 in subscription savings over 2 years, and significant reduction in script weight.
Conclusion
App audits are the highest-ROI maintenance activity for most Shopify stores. The store you built in 2022 has different app needs than the store you’re running in 2026. The apps you installed for features Shopify now provides natively are wasting money. The apps running scripts you haven’t reviewed in two years are Shopify security risks you may not be aware of.
Start with the inventory: list every app, its cost, its permissions, its last active use. Remove the dormant ones. Check your theme for zombie scripts. Run a performance test before and after.
The average store that goes through this process removes 4–6 apps, saves $60–120/month in subscriptions, and sees a measurable LCP improvement.
For a professional app stack audit with build-vs-subscribe recommendations, our Shopify Store Health Audit at $299 covers app bloat analysis, performance impact, and a prioritized replacement plan. For custom code replacements of high-impact apps, our Shopify development team handles implementation.
Frequently Asked Questions
How many apps can a Shopify store have?
Shopify doesn’t impose a technical limit on app installations. The practical limit is performance: each app that loads front-end scripts degrades page speed. Most stores see measurable performance degradation above 8 front-end apps. There’s no equivalent limit for back-end apps (apps that don’t load scripts on the storefront).
Do Shopify apps slow down your store?
Apps that load JavaScript on your storefront pages add to main thread blocking time and increase total page weight. The impact varies by app and implementation. Any app loading 50KB+ of JavaScript on every page visit is a meaningful performance contributor. The cumulative effect of many apps is more damaging than any single app.
Are Shopify apps safe?
Shopify reviews apps in its App Store for functionality and basic security standards. However, the review process doesn’t guarantee apps don’t collect more data than necessary, remain maintained long-term, or operate in compliance with GDPR/CCPA. Evaluate each app’s permissions, data policy, and update history before installation.
How do I remove apps from Shopify safely?
Uninstall via Shopify admin > Apps > [App Name] > Delete app. After uninstalling, immediately check your theme code (theme.liquid and any section files) for orphaned script tags from the removed app. Some apps leave their JavaScript loading even after uninstallation. Remove any remaining script tags manually.
What Shopify apps are worth keeping?
Focus on apps that provide functionality Shopify can’t replicate natively, that have genuine use cases for your store, and that load minimal front-end scripts. High-value categories: review apps with rich aggregateRating data (Okendo, Judge.me), email marketing integrations (Klaviyo), advanced analytics, and custom subscription management. Low-value categories: apps replicating native Shopify functionality, decorative UI apps, and apps for one-off promotions that weren’t removed afterward.