How many apps do you really need for a sale? A checklist after the checkout attacks
In October a few compromised Shopify apps quietly sent shoppers to fake payment pages, and most merchants who ran them saw nothing. Before you add anything for Black Friday, it is worth knowing exactly what already runs on yours.
What happened in October
From around October 10, shoppers on a number of Shopify stores were sent to a fake payment page on a lookalike domain when they clicked through to checkout. The page collected card details and then forwarded them to the real checkout, so the order went through and nothing looked wrong to the shopper or the merchant. The script came in through a handful of third-party apps whose own systems or settings had been tampered with, so the stores running them served it without anyone touching their themes.
Two details matter for you as a merchant. The script fired once per browser session, so an owner clicking around their own store usually saw a normal checkout. And when an app is taken off the App Store, new installs stop, but stores that already have it keep running it until the merchant removes it.
Shopify has asked app developers to tighten their security and says it is narrowing what app code can do on the storefront. None of that removes the work on your side, and the weeks before Black Friday are when many stores add a new app or two for the sale.
Count what is running on your storefront
Open Settings → Apps in your Shopify admin and write the list down. Next to each app, note three things:
- What it does for shoppers, in a few words.
- Whether it puts anything on the storefront: a badge, a popup, a bar, a widget on the product page.
- When you last used it on purpose.
Most lists have a few apps that were installed for one campaign two years ago and never removed. Those are the easy wins. An app you are not using still has its access to your store, and if it runs on the storefront, its script still loads on every page.
Look for apps that do the same job
Sale stores tend to collect apps one problem at a time: a countdown timer before one sale, sale badges before the next, a free shipping bar after a shopper complained about shipping costs, a volume discount table for a bundle. Each was a sensible choice on the day. Together they are four vendors, four sets of permissions and four scripts competing for the same product page.
Group your list by job. If three apps are all about showing a discount to the shopper, ask whether one could cover them. Fewer vendors means fewer accounts that can push code to your store, a shorter list to check after the next incident, and usually a faster page on the busiest weekend of the year.
Check the theme for leftovers
In Online Store → Themes → Customize, open App embeds in the left sidebar. Every switch there is an app that can load on your storefront. Turn off the ones you do not recognise or no longer need, then save. App embeds go away on their own when you uninstall the app.
Older apps work differently. Some asked you, or a developer, to paste a snippet into theme.liquid or a section file, and that snippet stays after the app is gone. Open Edit code, look at theme.liquid and search for <script. For each script that loads from another domain, you should be able to say which app or service it belongs to. If you cannot, ask your developer before deleting anything, and duplicate the theme first so you can go back.
Review who has access
- Under Settings → Users, remove staff and collaborator accounts that no longer need access, including agencies from past projects.
- Make sure every remaining account uses two-step authentication.
- When you remove an app, uninstall it rather than only switching off its embed. Uninstalling is what ends its access to your store data.
Test checkout like a new visitor
Because the October script only ran once per session, a test in your usual browser tells you little. Open a private window, go to your store from a search result or a link, add a product and click through to checkout.
The address bar on the payment step should show your own store domain or a shopify.com address. If it shows anything else, even something that looks close, stop and contact Shopify Support.
Repeat on a phone, using mobile data rather than your shop Wi-Fi, and once more after every app you install between now and the sale.
Do this a few days before Black Friday and again on the morning it starts. It takes five minutes and it is the only check that sees what a shopper sees.
Before you install anything new for the sale
- Read the permissions on the install screen. A badge app has little reason to ask for access to customer data.
- Check the developer: a real website, a support contact, a privacy policy and recent replies to reviews.
- Prefer apps that use an app embed over ones that ask you to paste code into the theme. The embed can be switched off in one click, and it leaves with the app.
- Install on a duplicate theme first, test, then publish. Do it this week, not on the Thursday before Black Friday.
After the sale
Go through the list again in December. Remove whatever you installed for the weekend and did not use, switch off its embed if it is still there, and note what you would keep for next year. The shorter that list is, the faster the next check will be.