Kernel InitResearchBy segmentChile
Shopify store security in Chile.
We passively measured 106 Shopify stores in Chile as part of our State of Shopify Security benchmark. Public pages, DNS and TLS only. These are aggregated results for the segment: no store is named, and figures appear only where at least 30 stores were measured.
In short
How Chile compares.
Chile's new personal data law (Ley 21.719) is due to take effect in December 2026 with a dedicated regulator, so privacy notices, consent and third-party scripts are about to get more attention.
- The median Store Trust Score is 81, 1 point above the full sample (80).
- No SPF record: 49.1%, 13.5 points more often than across all 1,676 stores (35.6%).
- Legacy app ScriptTags (not removed on uninstall): 31.4%, 13.2 points less often than across all 1,676 stores (44.6%).
- Among the 10 countries we cover, it has the third-highest share of spoofable email domains.
- Among the 10 countries we cover, it has the second-highest share of missing SPF records.
Store Trust Score in this segment: median 81 (p10 75, p25 77, p75 83, p90 86), on a 0–100 scale where higher is better. 20.8% of these stores reach the Strong band (85+); fewer than 5 score below Good (under 70).
Side by side
Chile versus all 1,676 stores.
Share of stores with each issue, among the stores where the check could be measured. Highlighted bars are more than 2 points above the full sample.
All findings
What's visible from outside.
Unweighted shares. A finding is left out when fewer than 30 stores in the segment could be measured, and a share is not printed when it rests on fewer than 5 stores.
| Finding | This segment | All stores | N measured |
|---|---|---|---|
| Email domain can be spoofed (no DMARC, or DMARC p=none)Without an enforced DMARC policy, anyone can send email that appears to come from the store's domain. | 88.7% | 83.8% | 106 |
| No SPF recordSPF lists which servers may send mail for the domain. Without it, receivers have less to go on. | 49.1% | 35.6% | 106 |
| DMARC without aggregate reportsA DMARC record without a reporting address means nobody sees who is sending as the domain. | 65.4% | 64.6% | 52 |
| Look-alike domains with mail, owned by third partiesRegistered domains that look like the store's and accept mail, owned by someone else. | fewer than 5 stores | 8.7% | 106 |
| Legacy app ScriptTags (not removed on uninstall)Scripts injected by apps through the ScriptTag API. They are not always removed when the app is uninstalled. | 31.4% | 44.6% | 105 |
| Third-party scripts without SRI on static CDNsScripts from public CDNs loaded without an integrity hash, so a changed file would still run. | 9.4% | 10.3% | 106 |
| JavaScript libraries with known CVEsFront-end libraries whose detected version has a published CVE. Exploitability depends on use. | fewer than 5 stores | 6.1% | 106 |
| Broken script tags (host no longer resolves)Script tags that point to hosts that no longer resolve: dead weight, and a sign nobody reviews the theme. | fewer than 5 stores | 3.0% | 106 |
| No reachable privacy policyNo privacy policy reachable from the storefront where we looked for one. | 5.8% | 5.7% | 103 |
| Basic accessibility gaps on the home pageBasic, automatically detectable gaps on the home page (for example images without text alternatives). | 5.7% | 9.9% | 106 |
| Zone not DNSSEC-signedDNSSEC protects DNS answers from tampering. It is rare everywhere and depends on the DNS host. | 100.0% | 94.6% | 106 |
| No CAA recordA CAA record limits which certificate authorities may issue certificates for the domain. | 98.1% | 99.3% | 106 |
Market context
The wider Chile market.
The market dataset lists 23,593 active Shopify stores in Chile. 1.4% are on Shopify Plus (all Shopify: 2.6%); the median store has 2 installed apps and 1 detected tracker. Session replay is detected on 10.1% of them (all Shopify: 8.0%). The largest Shopify categories here are Apparel (3,738), Home & Garden (2,997) and Beauty & Fitness (2,272).
Market figures come from a third-party technology dataset of active Shopify storefronts (built 2026-11-01), shown only for segments with at least 1,000 stores. Technology detection can miss tools that are built into Shopify, so adoption shares are lower bounds.
What to do first
Five fixes, in order.
- Publish DMARC with a reporting address, then move from
p=nonetop=quarantineorp=rejectonce SPF and DKIM are aligned. - List every third-party script on the storefront and checkout pages, and remove what nobody owns (PCI DSS 4.0, requirement 6.4.3).
- Remove ScriptTags and theme snippets left behind by apps you no longer use.
- Delete tags that point at hosts that no longer resolve.
- Add a CAA record and, if your DNS host supports it, turn on DNSSEC.
Each of these is done in your own DNS, theme or app settings, and most take minutes. If you are unsure, start with the free snapshot: it checks your own domain against the same list.
Method & limits
Passive, and honest about it.
Latest passive scan of each store in a stratified benchmark sample of Shopify stores (1,676 reachable with a Trust Score, 106 in this segment), measured up to 2026-11-01. Only public GET requests, public DNS and TLS, and robots.txt were used: no forms, logins, payments or exploit attempts. Look-alike domains were only resolved in DNS.
We measure what a visitor's browser and the public DNS can see. We do not see checkout internals, admin settings, server-side controls or whether anyone has been attacked. Skimmer-style signatures are heuristics and are not reported per segment. Shares are not weighted to the full Shopify population, and segments of a few dozen stores carry wide margins of error: read differences of a few points as noise.
Full method and the overall numbers: State of Shopify Security.
More segments
Compare other segments.
Where does your store stand?
A free, passive snapshot of your own domain: a 0–100 score, how you compare with stores like yours, and the fixes in priority order.