Kernel InitResearchNovember 2026
State of Shopify Security.
We passively measured 1,676 live Shopify stores across countries and sizes. Only public pages, DNS and TLS. These are the aggregated results: no store is named.
Headline numbers
Most stores are easy to impersonate.
have an email domain that can be spoofed: no DMARC, or DMARC set to p=none. N = 1,676.
still carry legacy app ScriptTags, which are not removed when an app is uninstalled. N = 1,645.
publish no SPF record at all. N = 1,676.
load third-party scripts from static CDNs without integrity checks (SRI). N = 1,675.
Key findings
What's visible from outside.
Unweighted share of the stores where each check could be measured. N is the number of stores measured.
| Finding | Stores | N |
|---|---|---|
| No CAA record | 99.3% | 1,676 |
| Zone not DNSSEC-signed | 94.6% | 1,676 |
Email domain can be spoofed (no DMARC, or p=none) | 83.8% | 1,676 |
| DMARC without aggregate reports (nobody sees abuse) | 64.6% | 1,059 |
| Legacy ScriptTags from apps | 44.6% | 1,645 |
| No SPF record | 35.6% | 1,676 |
| Third-party scripts without SRI on static CDNs | 10.3% | 1,675 |
| Basic accessibility gaps on the home page | 9.9% | 1,675 |
| Look-alike domains with mail, owned by third parties | 8.7% | 1,676 |
| JavaScript libraries with known CVEs | 6.1% | 1,675 |
| No reachable privacy policy | 5.7% | 1,622 |
| Broken script tags (host no longer resolves) | 3.0% | 1,675 |
| Scripts from domains imitating a CDN or brand | 1.0% | 1,675 |
| Code with skimmer-like signatures (review, not an incident) | 0.8% | 1,667 |
By segment
Bigger stores carry more leftovers.
Legacy app ScriptTags grow with revenue: every app a store tried and removed can leave code behind. Segments are shown only with N ≥ 30.
Legacy ScriptTags, by estimated monthly sales (USD)
Legacy ScriptTags, by plan
Store Trust Score across the sample: median 80 out of 100 (p10 73, p90 86). Higher is better.
Observation
One imitation CDN, 17 stores.
17 stores in the sample load scripts from a domain whose name imitates the jsDelivr CDN. Whoever controls that domain can change the code served to all of them at once. We don't name the stores here; affected merchants see it in their own report.
What a store should do first
- Publish DMARC with
p=quarantineorp=rejectand a reporting address, after SPF and DKIM are aligned. - Inventory every third-party script on the storefront and checkout (PCI DSS 6.4.3) and remove what nobody owns.
- Remove ScriptTags and theme snippets left by uninstalled apps.
- Remove tags pointing at hosts that no longer resolve.
- Add a CAA record and, where your DNS host supports it, DNSSEC.
Method & limits
Passive, and honest about it.
Latest passive scan of each store in a stratified sample of Shopify stores across countries and sizes (1,676 reachable with a Trust Score). Only public GET requests, public DNS/TLS and robots.txt were used: no forms, logins or payments. Look-alike domains were only resolved in DNS.
Passive checks see what a visitor's browser sees: checkout internals, admin settings and server-side controls are not observable. Skimmer signatures are heuristics, and a "review" is not an incident. Shares are not weighted to the full Shopify population.
Where does your store stand?
Get a passive scan of your domain with a 0â100 score, the same checks as this report, and the fixes in priority order.