Hacked Shopify Store: What Can and Cannot Happen

By Glenn Lyvers · Updated September 21, 2026 · 4 min read

Shopify runs the servers, patches the software and handles the infrastructure, which genuinely removes most of what goes wrong on a self-hosted store. It does not make your store uncompromisable. The attacks just move to the three places you still control, and because everybody assumes a hosted platform cannot be hacked, they tend to run for longer before anybody looks.

What genuinely cannot happen

You will not find a PHP backdoor in your uploads folder, because you do not have one. Nobody is exploiting an outdated plugin version on your server, because the server is not yours and the platform is patched centrally. There is no wp-config.php to read and no database credentials to steal.

That is a real and substantial reduction in attack surface, and it is worth saying plainly because the anxiety of a suspected hack is often worse than the reality. What remains is a much shorter list than a self-hosted store, and every item on it is something you can check yourself in an afternoon.

Route one: a compromised login

The most common Shopify compromise is somebody signing in as you or as a staff member. That comes from a reused password, a password stolen by malware on a computer used to run the store, or a convincing phishing page imitating the Shopify login.

Check your staff accounts for people who should not be there, and check the login history for sessions from places that make no sense. Enable two-step authentication on every account, remove staff who have left, and review what permissions the remaining accounts actually need. My guide on stealer malware on your own machine covers the route people least expect.

Route two: apps

Every app you install gets permissions against your store, sometimes extensive ones, and those permissions persist quietly until you remove them. An app can be malicious from the start, can change hands and become malicious later, or can itself be compromised.

Go through your installed apps and uninstall everything you are not actively using — this is the single most valuable half hour available to you. For what remains, look at what each one is permitted to do, and be particularly attentive to anything requesting access to customer or order data without an obvious reason to need it.

Route three: injected code in your theme

This is where a card skimmer would live. Your theme files are yours to edit, and anyone with admin access or a sufficiently permissive app can add JavaScript to them. Checkout on Shopify is comparatively protected, but code on your product and cart pages can still capture what customers type, and the same access allows redirects and other injections.

Review your theme's code for scripts you did not add, paying attention to the layout files that appear on every page and to anything loading from an unfamiliar external domain. Check your script tags and any code added through the admin's custom-code areas. Compare against a clean copy of your theme if you have one. My guide on injected JavaScript covers how to tell a malicious script from your legitimate analytics.

Checking the store as a customer

Open your storefront in a private window with developer tools running and account for every script the page loads. Then walk through the whole purchase path — product page, cart, checkout — watching the network panel for requests going somewhere you do not recognize, particularly as you type.

Check the order records too. Unfamiliar discount codes, changed payment or payout settings, altered notification email addresses and new webhook endpoints are all signs of someone having been in the admin. Those settings are quiet, they do not break anything visibly, and they are where real financial damage is done.

Cleaning up and getting help

Rotate passwords on every staff account, enable two-step authentication, revoke sessions, remove apps you do not need, and remove injected theme code. Then check the settings that move money: payout details, payment providers, notification addresses and webhooks. Shopify's support can help with account-level questions and can see things you cannot.

If customer payment data may have been captured, that is a payment incident with obligations attached, and my guides on PCI compliance after a skimmer and breach notification cover what follows. If you want a second pair of eyes on the theme code and the app permissions, that is work I take on — see the platforms I clean.

Common questions

Can a Shopify store actually be hacked?

Not in the sense of someone exploiting the server, which Shopify runs and patches. But your admin account can be taken over, a malicious or compromised app can act with the permissions you granted it, and code can be injected into your theme. Those three routes are real and they are the ones to check.

How do I check my theme for injected code?

Review the theme code in your admin, focusing on the layout files that render on every page, and look for scripts you did not add or external domains you do not recognize. Also check any custom-code fields in settings and your script tags. Comparing against a clean copy of the theme makes anomalies obvious.

Could an app be stealing my data?

It is possible, and it is worth auditing rather than assuming. Apps hold the permissions you granted them, those permissions persist after you stop using the app, and an app can change ownership or be compromised. Uninstall what you do not use and review what the rest are permitted to access.

Is Shopify checkout safe from skimmers?

Shopify's checkout is more protected than a self-hosted one, which materially reduces the risk. It does not make injected code on your other pages harmless, and settings changes that redirect payouts or alter notifications do financial damage without touching checkout at all. Check the whole path, not just the payment step.

What should I check first if I suspect a compromise?

Staff accounts and login history, then installed apps and their permissions, then your theme code, then the settings that move money — payout details, payment providers, notification emails and webhooks. That order goes from most likely to least while catching the most damaging changes early.