22 October 2026.
On 20 October Shopify shipped its first direct answer to the checkout hijack. Your store now shows shoppers a message before it sends them to another website: "Are you sure you want to leave [store name]?", with the address they're about to go to.
What the "Are you sure you want to leave?" message does
Shopify's help page says the message opens "when a link or a script on your online store sends a customer to a website outside your store". That is exactly how the hijack worked: app code took over the checkout button and sent shoppers to a fake payment page. Now they get a chance to stop.
It doesn't open for your own domains, your checkout, Shopify pages like Shop Pay, or popular social networks. And for now, the help page says, "you can't turn off the message or choose websites that skip it."
Why merchants and app developers are pushing back
Any link to a site Shopify doesn't recognise now looks suspicious, including legitimate ones: a sister store in another country, a booking tool, a partner site.
Many brands use separate Shopify stores for different reasons. Sometimes because of payment availability, sometimes because another company runs the regional store through a distributor or franchise agreement.
… I understand protecting customers from malicious redirects. But making legitimate store switching look suspicious creates unnecessary friction and risks losing customers who were trying to buy.
… At the very least, please let merchants approve and add external trusted domains.
Shopify's President also defended the wave of App Store removals the same week:
135 might sound like a lot and it is easy to pile on. But you know what would be worse? Not doing the hard things and not prioritizing making our App Store as secure and as trustworthy as possible.
We delist for lots of reasons, most of them unrelated to security. It's easier now than ever to find vulnerabilities and attacks are rising across the industry. Security is one of the most important thing any of us can work on right now.
Some removed apps are pushing back too. AfterSell, delisted on 15 October, says it was never part of the hijack:
TL;DR:
• There was no checkout hijacking • We experienced a cybersecurity attack that was patched within two hours of detection • No sensitive or PII data was exposed. The few affected merchants were contacted directly, and no one needs to take any action
Our entire engineering team is focused on security, and we’re working with Shopify on App Store relisting as soon as possible.
What it doesn't fix
- The code is still on your store. The warning helps a shopper who reads it. The app code that tried to redirect them keeps running, and the message names the website, not the app.
- Not everything is a redirect. Code that copies what shoppers type into a form doesn't need to send them anywhere, so the warning never shows.
- Delisted apps stay installed. 478 apps have left the App Store since 14 October. Delisting doesn't uninstall any of them.
So the question has moved on from "where does my checkout button go?" to "what is every app on my store doing?"
What to do this week
- Search your apps in the delisted apps tracker.
- In Online Store > Themes > Customize > App embeds, switch off anything you don't use.
- If customers mention the new message on a link that should stay on your store, treat it as a lead: an app or your theme is sending them somewhere.
- Run the free scan to see every app loading on your store and what its code can reach.
Sources: Shopify changelog (20 Oct), Shopify Help Center, Harley Finkelstein on X, Roberto Senabre on X. Background: the checkout hijack explained.
Get an email when this story changes
New delistings, vendor statements and apps coming back on the App Store. One short email when something changes, nothing else.
Free. Unsubscribe any time by replying.
