Security is easy to ignore when it’s just you logged into Shopify admin. It becomes a genuine risk the moment your store grows past solo-founder management, more staff logins, more apps installed by different people at different times, more integrations quietly holding API access nobody remembers granting. The attack surface grows quietly, and most stores don’t think about it until something goes wrong.
This isn’t about scaring you into paranoia. It’s a practical rundown of where Shopify stores actually get exposed as they scale, what Shopify handles for you at the platform level, and what remains genuinely your responsibility, with a checklist you can work through directly.
Why Security Risk Grows With Store Size
A solo-founder store has one login, a handful of trusted apps, and one person who knows exactly what’s installed and why. A growing store might have five or six staff accounts, a dozen or more apps accumulated over a year or two (some no longer actively used), a marketing agency with admin access, a developer who did a one-off project eighteen months ago, and multiple integrations pulling customer and order data. Each of those is a legitimate access point, and each one is also a potential point of failure if it’s not managed deliberately.
Staff Account and Permission Management
Shopify’s staff access controls live under Settings > Users and permissions in your admin. Every staff account should be set up with the minimum access that role actually needs, not full admin access by default because it’s easier.
Practical rules worth applying:
- Use role-based permissions properly. Shopify lets you restrict staff access to specific areas, orders, products, finances, apps, theme code, and so on. A customer service team member generally doesn’t need access to financial reports or theme code; a marketing team member generally doesn’t need to see full payment details.
- Limit who can access financial reports and payout information. This is sensitive data that should be restricted to owners, finance staff, and anyone with a genuine operational need.
- Restrict theme code editing access. Not every staff member who needs product or content access should also be able to edit theme files, a mistake or a compromised account with theme access can take your storefront down or introduce a vulnerability.
- Remove access immediately when someone leaves. This is the single most common gap we see in a security review, former staff, contractors, or agencies who finished a project retaining login access months or years after they stopped working with the store. Deactivating access on a departure should be part of your standard offboarding process, not something that happens “eventually.”
Two-Factor Authentication
Shopify supports two-factor authentication (2FA) for store owner and staff accounts, requiring a second verification step (typically an authenticator app code) in addition to a password at login. This meaningfully reduces the risk of a compromised password alone being enough to access your store, which matters given how common credential-stuffing and phishing attacks are across every platform, not just Shopify.
Enabling 2FA for every staff account with admin access, not just the store owner, is a straightforward, low-cost step that closes off one of the most common ways stores get compromised. It’s worth checking under your account security settings that this is actually turned on for everyone with access, rather than assuming it is.
Reviewing App Access Regularly
Every app you install requests specific data and functionality scopes, access to customer data, orders, products, or theme files, depending on what it needs to function. This is one of the most overlooked attack surfaces on a growing Shopify store, because app installs tend to accumulate gradually and rarely get reviewed after the fact.
A periodic app access review should ask:
- Is this app still actually in use, or was it installed for a campaign/project that’s since ended?
- Does its requested access scope still make sense for what it currently does?
- Is it from a developer/publisher with a reasonable track record, particularly if it has access to customer or payment-adjacent data?
- Has it been updated recently, or does it look abandoned?
Removing unused apps isn’t just good housekeeping for page speed, it genuinely reduces your exposure, since every installed app with live access is a potential point of compromise if that app’s own systems are breached, independent of anything you do on your end.
PCI Compliance and Payment Security
Shopify is a PCI DSS Level 1 certified provider, which is the highest level of certification under the Payment Card Industry Data Security Standard. In practice, this means Shopify handles a substantial share of the payment security burden at the platform level for merchants using Shopify Payments and Shopify’s standard checkout, significantly less complex than the PCI obligations a merchant running a self-hosted, custom-built checkout would carry.
That doesn’t mean merchants have zero responsibility. Things that remain genuinely on you:
- Protecting your own admin credentials and API keys, a leaked API key from a custom app or integration is a real risk regardless of how secure Shopify’s own infrastructure is.
- Custom checkout customisations, particularly on Shopify Plus. Checkout extensibility gives Plus merchants real flexibility, but any custom scripts or extensions you add are your responsibility to build securely, Shopify secures its own checkout infrastructure, not code you’ve added to it.
- Not handling or storing payment data outside Shopify’s systems, for example, never capturing raw card details in a custom form or third-party tool outside Shopify’s PCI-compliant checkout flow.
Theme Code and Custom App Security
If you have custom theme code or a custom app (built via the Shopify CLI or Shopify’s app development tools), standard secure-development practices apply and matter more as your store grows:
- Never commit API keys, access tokens, or secrets directly into theme code or a public repository
- Use environment variables and Shopify’s recommended authentication flows for custom apps rather than hardcoding credentials
- Control who has access to edit live theme code, and consider using a proper development/staging workflow rather than editing the live theme directly
Phishing and Social Engineering Risks Specific to Shopify Merchants
This is a well-known category of attack worth staff being aware of specifically: fake “Shopify support” emails asking you to log in via a link, fake app install prompts mimicking the App Store, and fake collaborator or staff invitation requests designed to get access to your admin. These attacks target Shopify merchants specifically because store admin access is valuable, it typically has access to customer data, order history, and sometimes payout information.
The practical defence is simple but needs to be a habit: never click login links from email, always navigate to Shopify admin directly, verify any unexpected collaborator request through a separate channel before accepting it, and make sure staff know this is a real, ongoing risk rather than a hypothetical one.
A Practical Security Review Checklist
- [ ] Every staff account has role-appropriate permissions, not blanket admin access
- [ ] 2FA is enabled on every account with admin access, not just the owner
- [ ] Former staff, contractors and agencies have had access revoked promptly
- [ ] Installed apps have been reviewed in the last 6-12 months, with unused ones removed
- [ ] App access scopes make sense for what each app currently does
- [ ] API keys and secrets for custom apps/theme code are stored securely, never hardcoded
- [ ] Staff are aware of common phishing patterns targeting Shopify merchants specifically
- [ ] Financial reports and payout access are restricted to those who genuinely need it
When to Bring in a Specialist
A full security review, auditing every staff account, every app’s access scope, checking custom code for exposed credentials, and reviewing your overall admin access hygiene, is exactly the kind of structured check that’s easy to keep putting off until something forces the issue. If it’s been a while since anyone looked at this properly, or your team and app stack have grown faster than your access controls have kept up, a Shopify audit is a practical way to get a clear picture of where you actually stand, rather than guessing.
FAQ
Does Shopify handle PCI compliance for me?
Shopify is a PCI DSS Level 1 certified provider and handles a substantial share of payment security at the platform level for Shopify Payments and standard checkout, which significantly reduces the compliance burden compared to a self-hosted checkout. Merchants still have responsibilities around protecting admin credentials, API keys, and any custom checkout code, particularly on Shopify Plus.
Should every staff member have two-factor authentication enabled?
Yes. 2FA should be enabled for every account with admin access, not just the store owner, since a compromised staff password without 2FA is one of the most common ways store access gets breached.
How often should I review installed apps for security?
A review every 6-12 months is a reasonable minimum, checking whether each app is still in active use, whether its access scope still makes sense, and removing anything unused or abandoned. Apps tend to accumulate quietly, so this needs to be a deliberate, scheduled task rather than something that happens naturally.
What should I do when a staff member or contractor leaves?
Revoke their Shopify admin access immediately as part of your standard offboarding process. Delayed access removal for former staff and contractors is one of the most common gaps found in security reviews.
Are phishing attacks targeting Shopify merchants a real, common risk?
Yes, fake “Shopify support” emails, fake app install prompts, and fake collaborator requests are a well-documented category of attack specifically targeting store admin access, because that access often includes customer data and financial information. Staff awareness and never clicking login links from email are the practical defences.
Get a Clear Picture of Your Store’s Security
If it’s been a while since your access controls, staff permissions and app stack were properly reviewed, book a call or start with a Shopify audit to see exactly where the gaps are.
