Shopify store security

Several apps that load JavaScript on the storefront were used to hook the checkout button and redirect shoppers to lookalike payment pages. In the case first traced in public, by developer Roman Zipp, the app's script fetched its settings from the vendor's servers and ran extra code that came back with them. The store stayed online and the fake page loaded cleanly, so nothing looked broken.

Our full write-up, kept updated: The Shopify checkout hijack and how to check your store.

Earlier in 2026, Qikify (July) and Orichi (September) each reported incidents where malicious code went out through app settings.

Every app that adds a script to your storefront runs code its vendor can change at any time, from their servers, without a new version or your approval. Our own monitor sees storefront app code change most weeks on most stores. That is normal and usually harmless. It also means a compromised vendor account or settings tool can reach thousands of stores at once.

Delisting stops new installs. It doesn't remove the app from stores that already have it. If a delisted app's script is still on your theme, it keeps running until you uninstall the app and remove any leftover code.

1. Compare your installed apps against the delisted apps list.
2. Uninstall apps you no longer use, then check your theme's app embeds and code for anything they left behind.
3. Look at custom JavaScript fields inside app settings for code your team didn't add.
4. In a private window, add a product to cart and click your real checkout button. The address bar should show your own domain or Shopify's checkout.
5. If checkout goes anywhere else, note the address and time and contact Shopify Support.

Revenue Shield runs the purchase journey on your live store on a schedule, desktop and mobile, in a fresh browser each time. Every run now records where checkout actually landed and shows it next to the run, with a video. Our app monitor lists the third-party scripts loading on your storefront and logs when one appears or changes.

The Revenue Shield app installs nothing on your theme and only reads products. It is monitoring, not protection: it doesn't block anything and can't promise to catch a targeted attack, but it shortens the time between something going wrong and you knowing. Run a free scan to see what your checkout does today.