Shopify Third-Party App Risks: What to Check

Most Shopify stores collect apps over the years. One for reviews, one for a sale, one someone recommended. Each can add code to your storefront, hold access to your store data and bill you every month. Few merchants go back and check what each one still does, and that is where the risk sits.

We build Shopify stores through our Shopify development service, so weigh that. Every fact below about Shopify and Google was checked against their own documentation in October 2026.

Short answer: Third-party apps carry three kinds of risk. Speed, because app JavaScript runs on the same main thread as your theme. Data, because an app keeps the access you approved for as long as it stays installed. Cost, because subscriptions bill whether or not anyone uses the app. Each app’s page in Settings > Apps shows its permissions, recent activity, unused access, privacy details and billing. Remove apps that aren’t earning their place, check your theme for leftover code, and measure speed before and after.

What Shopify Documents About Apps

As of October 2026, from Shopify’s developer and help documentation and Google’s web.dev:

Sources: Shopify access scopes, App Store requirements, Protected customer data, ScriptTag, Uninstalling apps, Theme app extension configuration, Privacy law compliance, Built for Shopify requirements, Web Vitals.

The Performance Cost of Shopify Third-Party Apps

Shopify says each feature you add to your online store, apps included, can affect its web performance (source). Its theme performance guide explains why: JavaScript, whether theme code or scripts from installed apps, runs on the main thread and competes with the browser’s ability to render content and respond to taps (source).

How App Scripts Load on Every Page (Even When Not Needed)

An app can reach your storefront in a few ways:

• App blocks: content placed inside a theme section, such as a review widget on the product page.
• App embed blocks: code Shopify injects before the closing head or body tag, used for chat bubbles, badges, analytics and tracking pixels (source).
• Script tags: remote JavaScript loaded into storefront pages or the Order status page, now limited to vintage themes (source).
• Direct theme edits: code pasted into theme files, by the app or by someone following its setup guide.

App embeds sit in the page head or body, so they load store-wide. Developers can make blocks conditional (source), but whether an app limits itself to the pages that need it depends on how it was built. A chat widget may run on pages where nobody chats.

Theme app extensions are the cleaner route. Shopify says apps built this way don’t edit theme code, which lowers the risk of breaking your theme (source).

Core Web Vitals Targets: What Counts as Slow

No app count reliably tips a store into slow territory. What matters is what each app loads and when. The target is clear, though. Google says Largest Contentful Paint should happen within 2.5 seconds, Interaction to Next Paint should be 200 milliseconds or less, and Cumulative Layout Shift 0.1 or less, measured at the 75th percentile of page loads (source).

Shopify ties app quality to speed too. To earn Built for Shopify status, an app must not reduce the storefront Lighthouse performance score by more than ten points (source). That’s a per-app limit, and several apps that each pass it can still add up.

Shopify’s theme guide ranks these fixes as high impact: remove or defer app scripts that block HTML parsing, audit and remove unused scripts including apps and pixels, and use defer or async on non-critical scripts (source).

Identifying Which Apps Load the Most JavaScript

Google’s web.dev guide recommends Chrome DevTools, PageSpeed Insights and WebPageTest to see which third-party scripts take longest to run (source). Two DevTools features help most:

1. In the Performance panel, record a page load, open Bottom-up and group by product. Third-party scripts sort by time taken.
2. In the Network panel, right-click a request and choose Block request URL, then reload to see the page without that script.

Map each external domain to its app. The heaviest are your first audit targets.

The Security Risk of Shopify Third-Party Apps

Google’s guide says third-party scripts can slow your site, cause privacy or security issues, and behave in unexpected ways (source). On Shopify there’s a second layer: many apps also read and write your store data through Shopify’s API.

What App Permissions Actually Grant

When you install an app, you approve its access scopes (source). Common ones:

• read_customers / write_customers: customer records.
• read_orders / write_orders: by default, orders from the last 60 days. Older orders need read_all_orders, which Shopify must approve.
• read_products / write_products: your catalog.
• read_themes / write_themes: your theme. A public app that modifies theme files also needs an exemption from Shopify (source).

Customer data has a separate gate. Apps get no protected customer data by default. Public apps must request it, and request names, addresses, emails and phone numbers field by field. Shopify approves access if the data is the minimum the app needs to work (source).

Do Apps Request More Access Than They Need?

We won’t put a number on how many apps over-ask. The rule is what helps you. Shopify’s App Store requirements say an app must request only the scopes it needs, and Shopify may ask the developer for proof. For scopes not every merchant needs, Shopify strongly recommends optional scopes (source).

So a mismatch deserves a question. A size chart app shouldn’t need customer records. A countdown timer shouldn’t need orders. An extra scope isn’t proof of bad intent, but it widens what that app can see if anything goes wrong.

Dormant App Permissions Remain Active After You Stop Using Them

An app you stopped using still holds every scope you approved, for as long as it stays installed. Each third-party app’s page in Settings > Apps has an Activity and permissions section showing which areas it can view or edit and its most recent activity in each. Permissions unused in the last 30 days appear under Unused access (source).

Uninstalling has its own catch. Shopify says some apps add theme code that isn’t automatically removed when you uninstall (source). Blocks from theme app extensions are removed automatically and entirely (source); code pasted into theme files isn’t.

Before and after you uninstall:

• Check the App Store listing or ask the developer about extra removal steps.
• Export data you need. Some apps store data you can’t recover later.
• Cancel billing outside Shopify. Uninstalling doesn’t cancel external charges (source).
• Search your theme code for leftover script tags.

Leftovers usually look like this:

<script src="https://cdn.appvendor.com/tracking.js"></script>

Search for external domains you don’t recognise and compare them with your installed apps. A domain that matches no installed app is a likely leftover. Edit a duplicate of your theme, not the live one.

The Financial Cost of Shopify App Subscriptions

Finding Your Monthly App Spend

An industry average won’t help you. Your own number will. Each app’s page in Settings > Apps has a Billing and usage charges section with its plan, recurring charge and any usage charges (source). Add them up, then add apps that bill outside Shopify, because those don’t appear on your Shopify bill. Uninstalling a paid app stops future charges, but you might still be billed for the current cycle (source).

Apps That Duplicate Functionality Already Native in Shopify

Shopify keeps adding features, so an app that once filled a gap may now overlap with something built in:

• Gift cards: Native in Shopify. Sell gift card products or create gift cards from your admin (source).
• Buy X Get Y discounts: created on the Discounts page of your admin (source).
• Email collection at checkout: Checkout settings control how you collect emails for promotional marketing (source).

Compare features before you cancel. A native feature may cover the basics but not the one thing you installed the app for.

The “Better to Build Than Rent” Calculation for High-Value Apps

For a feature you rely on daily, such as a product configurator or tiered pricing, ask whether to keep renting it or have it built once. Do the sum with your own numbers:

1. Monthly subscription x the months you’ll keep the feature = cost of renting.
2. A developer’s quote to build it, plus yearly upkeep = cost of owning.
3. Add what no invoice shows: script weight, data the app holds, and the chance it changes price or shuts down.

Custom code isn’t always the answer. A good app spreads development and security work across many stores and keeps up with Shopify’s changes for you.

How to Audit Your Current Shopify App Stack

Step 1: Inventory Every Installed App and Its Monthly Cost

Go to Settings > Apps. Include free apps, because they can still load scripts and hold data. Record for each:

• Name and what it does for you
• Monthly cost, including billing outside Shopify
• Areas it can view or edit
• Most recent activity
• Whether it loads anything on your storefront

Step 2: Check Data Permissions for Each App

Read each app’s Activity and permissions and Privacy sections. The privacy section lists the personal data the app can access and links to the developer’s privacy policy (source). For every area, ask whether the app’s job needs it. A loyalty program needs customer data. It shouldn’t need to edit your theme.

Step 3: Measure Script Load Per App

Run PageSpeed Insights on your homepage, a collection page and a product page, and note the results. Use the DevTools steps above to tie each script to its app. Then check Theme settings > App embeds in the theme editor: embeds are off by default and switched on there (source), so the list shows what runs site-wide. Rank apps by impact.

Step 4: Remove Apps Not Used in the Last 30 Days

Start with apps whose permissions all sit under Unused access, meaning no use in 30 days (source). Confirm nobody relies on them, export data, then uninstall. Automations and features that depend on an app stop working once it’s gone. You can reinstall most apps, but previous settings or data might not come back (source). Afterwards, check your theme for leftover code and rerun your speed tests.

Evaluating New Apps Before Installation

Check the Permission Request Against the App’s Function

Read the permission screen before you click Install. Every scope beyond the app’s job is extra exposure. Mismatches worth questioning:

• A size chart app asking to edit orders
• An FAQ widget asking to read customers
• A countdown timer asking for customer data

If the request seems excessive, ask the developer why, or pick an alternative that asks for less.

Review the Developer’s Update History

App Store apps are reviewed against Shopify’s requirements before they’re published (source), and Shopify’s App Excellence Team runs regular quality checks as requirements change (source). Review is a floor, not a guarantee. Look for signs of upkeep: recent reviews mentioning fixes, a changelog, a named company and clear support. For theme features, prefer apps built on theme app extensions over ones that ask you to paste code.

Read the Privacy Policy for Data Sharing Disclosures

The privacy policy says whether the app shares customer data with third parties, such as advertising or analytics providers. Vague “we may share with partners” language is a risk your own privacy policy may not allow.

Shopify sets a baseline. Every App Store app must handle three mandatory compliance webhooks, customers/data_request, customers/redact and shop/redact, and complete requests within 30 days unless legally required to keep the data (source). You can’t see whether a developer meets that, which is why the policy matters.

Test on a Development Store Before Production Install

Shopify dev stores are testing environments that don’t affect a live store. Creating one needs a Shopify Partner account or a merchant store with developer permissions (source). If you have a developer, have them install the app there first and check what it loads and whether it conflicts with your theme. At minimum, test on a duplicate of your live theme.

When Custom Code Beats a Shopify App

Apps Worth Replacing with Lightweight Custom Solutions

Some features are small enough for a theme section or snippet, with no subscription and no outside script:

• Announcement bars: many themes include one already.
• Countdown timers: a short script loaded only where the timer shows.
• Size charts: a table in a Liquid snippet, shown in a modal or tab.
• Free shipping progress bars: a small script comparing the cart total with your threshold.

Shopify’s theme guide backs this: render content with Liquid and HTML where you can, and load JavaScript only when it’s needed (source).

Developer Cost vs. 24-Month App Subscription Comparison

Use a fixed window so the comparison is fair:

• App: monthly price x 24, plus the script weight it adds.
• Custom: the build quote plus 24 months of upkeep, with no subscription or outside script.

Get a real quote first. If the feature is simple and stable, custom often wins. If the app does a lot and changes often, renting may still be the better deal.

Conclusion

Apps installed for an old campaign, or for features Shopify now provides, may still be loading code and holding your data. That’s the real shape of Shopify third-party app risks: not one bad app, but many unchecked ones.

Start in Settings > Apps: list every app, its cost, permissions and last activity. Remove the dormant ones, check your theme for leftover code, and test speed before and after. Then repeat on a schedule. For custom replacements of high-impact apps, our Shopify development team can scope the work.

Related Posts

• Shopify app stack optimization: trimming the stack after an audit
• Shopify security best practices: the wider security checklist
• Shopify store speed optimization: fixes beyond apps
• Shopify Core Web Vitals optimization: LCP, INP and CLS on Shopify

Frequently Asked Questions

How many apps can a Shopify store have?

The count matters less than what each app does. A back-office app that never touches your storefront adds no front-end script, while one app embed running on every page can matter more than several apps that load nothing. Judge each app by its storefront impact, its data access and its cost.

Do Shopify apps slow down your store?

They can. Shopify says app scripts run on the main thread and that too much JavaScript is a primary cause of poor INP and delayed LCP. The impact depends on the app. Load your pages with an app’s scripts blocked to see its real cost.

Are Shopify apps safe?

App Store apps are reviewed, must request only the scopes they need, and get no protected customer data without approval. That lowers the risk but doesn’t remove it. Check permissions, privacy details and upkeep before you install, and again over time.

How do I remove apps from Shopify safely?

In Settings > Apps, choose the app and select Uninstall. First check for extra removal steps, export data and cancel any billing outside Shopify. Afterwards, search your theme for leftover scripts, because some apps add code that isn’t removed automatically.

What Shopify apps are worth keeping?

Keep apps that do something Shopify doesn’t do natively, that you use and can measure, that ask only for the access they need and that load little on pages where they aren’t used. Cut apps that duplicate native features, sit under Unused access, or served a one-off promotion.

Does uninstalling an app delete my data from the developer’s systems?

Not instantly. Shopify sends App Store apps a shop/redact request 48 hours after you uninstall, so the developer can erase your store’s data. That’s the developer’s job, and you can’t check it from your admin, so read the privacy policy and ask how they handle deletion.