Shopify Security Checklist for the Holidays

To secure your Shopify store for the holidays, turn on two-step login for every staff account, remove apps and users you no longer need, check your theme for code you did not add, and set up email authentication on your own domain.

This checklist is for small store owners who run Shopify without a security team. You will get a clear split between what Shopify protects and what only you can protect, plus steps you can finish in an afternoon. No scare stories, just the jobs that matter most before your busiest weeks.

What Shopify secures and what you must secure

Shopify runs the platform. You run your store's settings, people, apps and domain. Many holiday problems start in the second group.

Shopify publishes information about its own security and compliance on its security page. That covers the platform. It does not cover how you manage your logins or what you install.

The rest of this post covers the "You handle" column.

Step 1: Lock down staff accounts and turn on two-step login

Two-step login (also called two-factor or multi-factor authentication) asks for a second proof after your password, such as a code from an app or a passkey. It stops most attacks that rely on a stolen or reused password. CISA explains why it matters in plain terms.

Do this today:

1. In your Shopify admin, open Settings > Users. Write down every person listed.
2. Remove anyone who no longer works with you. This includes past freelancers, agencies and seasonal staff from last year.
3. For each remaining person, open their permissions and give only what the job needs. A holiday packer does not need access to payments or apps.
4. Turn on two-step authentication for your own login. Follow Shopify's guide to two-step authentication. Use an authenticator app or a passkey rather than text messages where you can.
5. Ask every staff member to do the same. Shopify's page on staff accounts explains permissions and how to review them.
6. Use a unique password for Shopify, stored in a password manager. Never reuse the one from your email or other sites.

Also check your own email account. If someone can take over the inbox you use for Shopify, they can reset your password. Turn on two-step login there too.

Step 2: Review third-party apps

Apps add features, but each one can read or change store data. Some also put their own code on every page of your shop. The OWASP guide to third-party JavaScript explains why this code deserves care: it runs inside your customers' browsers with your site's trust.

Here is a quick app review:

1. Open Settings > Apps and sales channels.
2. List every app. Mark the ones you actively use.
3. For each app you do not use, uninstall it.
4. For apps you keep, open the app and check what permissions it asked for. Ask: does a reviews app really need customer data?
5. Check the app developer is a real company with a working support page and recent updates.
6. Look for custom apps here, and open Settings > Users to review any collaborator or developer access you do not recognize. Remove what you cannot explain.

Avoid installing new apps during the holiday rush unless you must. A new app means new access and new code on your busiest days. If you do add one, test it on a duplicate theme first.

Step 3: Check your theme code for leftovers

Your theme is the code that draws your store. Uninstalling an app does not always remove the code it added to your theme. Old snippets can keep loading from services you no longer use, or no longer control.

Here is how to look safely:

1. Go to Online Store > Themes.
2. On your live theme, click the three dots and choose Duplicate. This is your backup.
3. On the live theme, choose Edit code.
4. Open layout/theme.liquid. Look for <script src="https://..."> lines.
5. For each one, ask: do I know this service? If a web address means nothing to you, search for it online or ask your developer before touching it.
6. Use the code editor's search to look for the names of apps you removed.
7. Do not delete code you do not understand. Note it, then ask the developer or app vendor. If something looks clearly malicious, see our guide on what to do if your website is hacked.

theme.liquid is only one place to look. Also search the snippets, assets, sections and templates folders in the code editor for scripts you do not recognize. Then check Settings > Customer events for custom pixels (tracking code that runs on your store), and look under Settings > Checkout for legacy Additional scripts if your store still shows that section.

Two more habits help. Never paste code from a forum or a stranger into your theme. And only give developers access through a proper staff or collaborator account that you can remove later, not by sharing your own login.

Step 4: Set up email authentication on your domain

Criminals can send emails that look like they come from your domain, such as orders@yourstore.com. Email authentication helps mailbox providers tell real mail from fake. It also helps your genuine order emails land in the inbox instead of spam, which matters when customers wait for confirmations.

Three records do the work:

• SPF lists the services allowed to send mail for your domain.
• DKIM adds a digital signature to each message.
• DMARC tells receivers what to do when a message fails those checks. It is defined in RFC 7489.

Here is what to do:

1. If you send store emails from your own domain, open Settings > Notifications in Shopify and look at the sender email. Use the domain authentication option there if it is offered, and add the exact records Shopify shows you at your registrar or DNS host (the company where you manage your domain). Copy them exactly, since they are specific to your store.
2. Keep only one SPF record per domain. Two SPF records break SPF. If you use Google Workspace for email, a typical record is a TXT record on your domain with this value: v=SPF1 include:_spf.google.com ~all. If other services also send as you, add them to that same record rather than creating a second one.
3. Add a starter DMARC record. Create a TXT record with the name _dmarc and this value: v=DMARC1; p=none; rua=mailto:dmarc@yourstore.com. Replace the address with a mailbox you read. The setting p=none only monitors and blocks nothing, so it is safe to start with.
4. After a few weeks, once your reports show your real senders passing, consider moving to a stricter policy. If you use Google Workspace, also turn on DKIM signing in its admin console before moving DMARC past p=none. Do this slowly, since a strict policy can block real mail that is not set up right.

You can test your domain with our free email spoofing checker. It shows whether someone could easily fake mail from you.

Step 5: Protect your domain and payouts

Your domain is the front door to everything, including email and your store address. If someone takes over your registrar account, they can redirect your site.

• Turn on two-step login at your domain registrar. If you bought your domain through Shopify, this is covered by your Shopify two-step login.
• Use a unique password and an email address you control for the account.
• Check that auto-renew is on and the payment card is current.
• Look for a registrar lock option and enable it if you have one.
• In Shopify, open Settings > Payments, then your payment provider's payout settings. Confirm the bank account listed is yours.

We built a quick security headers tool as well. Note that Shopify controls the server, so you cannot set most response headers yourself. Treat results there as information, not a to-do list.

Step 6: Prepare for the holiday week itself

Some habits matter more in November and December:

• Freeze changes. Pick a date to stop installing apps and editing theme code. Fewer changes means fewer surprises.
• Watch for fake Shopify emails. Phishing (fake messages that steal logins) tends to ride along with busy seasons. Do not click login links in emails. Type your admin address yourself or use a saved bookmark.
• Brief seasonal staff. Give them their own accounts with narrow permissions. Never share one login.
• Review order and login notifications. Make sure they go to an inbox someone actually reads.
• Know your plan. Write down who to call if something looks wrong: Shopify Support, your developer, and the person who can change passwords.

If you are unsure whether your store is exposed, our free website security check runs a passive look at the outside of your site, with no card and no login. For a broader read on risk, see is my website hackable.

Your printable checklist

• [ ] Two-step login on my Shopify account, my email and my registrar
• [ ] Every staff member has their own login and two-step login
• [ ] Old staff, freelancers and agencies removed
• [ ] Staff permissions trimmed to what each job needs
• [ ] Unused apps uninstalled; remaining apps reviewed
• [ ] Theme duplicated as a backup; theme.liquid, snippets, assets, sections and templates scanned for unknown scripts; Customer events and legacy checkout Additional scripts checked
• [ ] Sender domain authenticated; one SPF record; DMARC at p=none or stronger
• [ ] Payout bank account confirmed
• [ ] Change freeze date set
• [ ] Incident contacts written down

Key takeaways

• Shopify secures the platform. You secure logins, apps, theme code, domain and email.
• Turn on two-step login for yourself and every staff member, and delete accounts you no longer need.
• Uninstall unused apps, then check your theme for leftover code from them.
• Add SPF, DKIM and DMARC records for your domain so your order emails are trusted and harder to fake.
• Freeze changes before the holiday rush and keep a short list of who to call if something looks off.

Want a human to look at your store?

A checklist covers the common problems, but it cannot see what is unique to your shop. A Circuit audit is $49 one time. A real security engineer manually reviews your site and sends a written report with severity, evidence and exact fixes. It is a focused audit for small sites, not an enterprise penetration test or a compliance certificate. Start with the free check if you want to see where you stand first.