Kernel InitResearchBy segmentHome & Garden
Shopify security for home and garden stores.
We passively measured 196 home and garden stores on Shopify as part of our State of Shopify Security benchmark. Public pages, DNS and TLS only. These are aggregated results for the segment: no store is named, and figures appear only where at least 30 stores were measured.
In short
How Home & Garden compares.
Home and garden orders are often high-ticket and shipped in several parts, so customers expect many order and delivery emails, exactly the messages a spoofed domain can imitate.
- The median Store Trust Score is 80, the same as the full sample.
- DMARC without aggregate reports: 71.3%, 6.7 points more often than across all 1,676 stores (64.6%).
- No SPF record: 31.6%, 4.0 points less often than across all 1,676 stores (35.6%).
- Among the 5 categories we cover, it has the highest share of spoofable email domains.
- Among the 5 categories we cover, it has the lowest share of legacy app ScriptTags.
- Among the 5 categories we cover, it has the third-highest share of scripts without SRI.
- Among the 5 categories we cover, it has the third-highest share of missing SPF records.
Store Trust Score in this segment: median 80 (p10 73, p25 77, p75 84, p90 86), on a 0–100 scale where higher is better. 18.9% of these stores reach the Strong band (85+) and 4.1% score below Good (under 70).
Side by side
Home & Garden versus all 1,676 stores.
Share of stores with each issue, among the stores where the check could be measured. Highlighted bars are more than 2 points above the full sample.
All findings
What's visible from outside.
Unweighted shares. A finding is left out when fewer than 30 stores in the segment could be measured, and a share is not printed when it rests on fewer than 5 stores.
| Finding | This segment | All stores | N measured |
|---|---|---|---|
| Email domain can be spoofed (no DMARC, or DMARC p=none)Without an enforced DMARC policy, anyone can send email that appears to come from the store's domain. | 87.2% | 83.8% | 196 |
| No SPF recordSPF lists which servers may send mail for the domain. Without it, receivers have less to go on. | 31.6% | 35.6% | 196 |
| DMARC without aggregate reportsA DMARC record without a reporting address means nobody sees who is sending as the domain. | 71.3% | 64.6% | 108 |
| Look-alike domains with mail, owned by third partiesRegistered domains that look like the store's and accept mail, owned by someone else. | 8.7% | 8.7% | 196 |
| Legacy app ScriptTags (not removed on uninstall)Scripts injected by apps through the ScriptTag API. They are not always removed when the app is uninstalled. | 41.1% | 44.6% | 192 |
| Third-party scripts without SRI on static CDNsScripts from public CDNs loaded without an integrity hash, so a changed file would still run. | 12.8% | 10.3% | 195 |
| JavaScript libraries with known CVEsFront-end libraries whose detected version has a published CVE. Exploitability depends on use. | 7.7% | 6.1% | 195 |
| Broken script tags (host no longer resolves)Script tags that point to hosts that no longer resolve: dead weight, and a sign nobody reviews the theme. | 4.1% | 3.0% | 195 |
| No reachable privacy policyNo privacy policy reachable from the storefront where we looked for one. | 6.8% | 5.7% | 191 |
| Basic accessibility gaps on the home pageBasic, automatically detectable gaps on the home page (for example images without text alternatives). | 9.2% | 9.9% | 195 |
| Zone not DNSSEC-signedDNSSEC protects DNS answers from tampering. It is rare everywhere and depends on the DNS host. | 94.4% | 94.6% | 196 |
| No CAA recordA CAA record limits which certificate authorities may issue certificates for the domain. | 99.0% | 99.3% | 196 |
Market context
The wider Home & Garden market.
The market dataset lists 375,374 active Shopify stores in home and garden. 2.5% are on Shopify Plus (all Shopify: 2.6%); the median store has 2 installed apps and 1 detected tracker. Session replay is detected on 9.0% of them (all Shopify: 8.0%). By country, the largest groups are the United States (144,401), the United Kingdom (30,534) and Australia (18,372).
Market figures come from a third-party technology dataset of active Shopify storefronts (built 2026-11-01), shown only for segments with at least 1,000 stores. Technology detection can miss tools that are built into Shopify, so adoption shares are lower bounds.
What to do first
Five fixes, in order.
- Publish DMARC with a reporting address, then move from
p=nonetop=quarantineorp=rejectonce SPF and DKIM are aligned. - List every third-party script on the storefront and checkout pages, and remove what nobody owns (PCI DSS 4.0, requirement 6.4.3).
- Remove ScriptTags and theme snippets left behind by apps you no longer use.
- Delete tags that point at hosts that no longer resolve.
- Add a CAA record and, if your DNS host supports it, turn on DNSSEC.
Each of these is done in your own DNS, theme or app settings, and most take minutes. If you are unsure, start with the free snapshot: it checks your own domain against the same list.
Method & limits
Passive, and honest about it.
Latest passive scan of each store in a stratified benchmark sample of Shopify stores (1,676 reachable with a Trust Score, 196 in this segment), measured up to 2026-11-01. Only public GET requests, public DNS and TLS, and robots.txt were used: no forms, logins, payments or exploit attempts. Look-alike domains were only resolved in DNS.
We measure what a visitor's browser and the public DNS can see. We do not see checkout internals, admin settings, server-side controls or whether anyone has been attacked. Skimmer-style signatures are heuristics and are not reported per segment. Shares are not weighted to the full Shopify population, and segments of a few dozen stores carry wide margins of error: read differences of a few points as noise.
Full method and the overall numbers: State of Shopify Security.
More segments
Compare other segments.
Where does your store stand?
A free, passive snapshot of your own domain: a 0–100 score, how you compare with stores like yours, and the fixes in priority order.