Kernel InitResearchBy segmentMexico
Shopify store security in Mexico.
We passively measured 110 Shopify stores in Mexico as part of our State of Shopify Security benchmark. Public pages, DNS and TLS only. These are aggregated results for the segment: no store is named, and figures appear only where at least 30 stores were measured.
In short
How Mexico compares.
Mexican stores fall under the federal data protection law for private parties (LFPDPPP). Many sell over WhatsApp and email alongside the storefront, so a domain that can be impersonated in email leaves one more channel open to fake order messages.
- The median Store Trust Score is 81, 1 point above the full sample (80).
- Email domain can be spoofed (no DMARC, or DMARC p=none): 75.5%, 8.3 points less often than across all 1,676 stores (83.8%).
- Legacy app ScriptTags (not removed on uninstall): 36.5%, 8.1 points less often than across all 1,676 stores (44.6%).
Store Trust Score in this segment: median 81 (p10 72, p25 77, p75 85, p90 87), on a 0–100 scale where higher is better. 27.3% of these stores reach the Strong band (85+); fewer than 5 score below Good (under 70).
Side by side
Mexico versus all 1,676 stores.
Share of stores with each issue, among the stores where the check could be measured. Highlighted bars are more than 2 points above the full sample.
All findings
What's visible from outside.
Unweighted shares. A finding is left out when fewer than 30 stores in the segment could be measured, and a share is not printed when it rests on fewer than 5 stores.
| Finding | This segment | All stores | N measured |
|---|---|---|---|
| Email domain can be spoofed (no DMARC, or DMARC p=none)Without an enforced DMARC policy, anyone can send email that appears to come from the store's domain. | 75.5% | 83.8% | 110 |
| No SPF recordSPF lists which servers may send mail for the domain. Without it, receivers have less to go on. | 35.5% | 35.6% | 110 |
| DMARC without aggregate reportsA DMARC record without a reporting address means nobody sees who is sending as the domain. | 57.7% | 64.6% | 78 |
| Look-alike domains with mail, owned by third partiesRegistered domains that look like the store's and accept mail, owned by someone else. | 10.9% | 8.7% | 110 |
| Legacy app ScriptTags (not removed on uninstall)Scripts injected by apps through the ScriptTag API. They are not always removed when the app is uninstalled. | 36.5% | 44.6% | 104 |
| Third-party scripts without SRI on static CDNsScripts from public CDNs loaded without an integrity hash, so a changed file would still run. | 7.3% | 10.3% | 110 |
| JavaScript libraries with known CVEsFront-end libraries whose detected version has a published CVE. Exploitability depends on use. | 5.5% | 6.1% | 110 |
| Broken script tags (host no longer resolves)Script tags that point to hosts that no longer resolve: dead weight, and a sign nobody reviews the theme. | 6.4% | 3.0% | 110 |
| No reachable privacy policyNo privacy policy reachable from the storefront where we looked for one. | 7.8% | 5.7% | 102 |
| Basic accessibility gaps on the home pageBasic, automatically detectable gaps on the home page (for example images without text alternatives). | 8.2% | 9.9% | 110 |
| Zone not DNSSEC-signedDNSSEC protects DNS answers from tampering. It is rare everywhere and depends on the DNS host. | 94.5% | 94.6% | 110 |
| No CAA recordA CAA record limits which certificate authorities may issue certificates for the domain. | 100.0% | 99.3% | 110 |
Market context
The wider Mexico market.
The market dataset lists 42,103 active Shopify stores in Mexico. 1.4% are on Shopify Plus (all Shopify: 2.6%); the median store has 2 installed apps and 0 detected trackers. Session replay is detected on 7.8% of them (all Shopify: 8.0%). The largest Shopify categories here are Apparel (9,658), Beauty & Fitness (4,505) and Home & Garden (3,797).
Market figures come from a third-party technology dataset of active Shopify storefronts (built 2026-11-01), shown only for segments with at least 1,000 stores. Technology detection can miss tools that are built into Shopify, so adoption shares are lower bounds.
What to do first
Five fixes, in order.
- Publish DMARC with a reporting address, then move from
p=nonetop=quarantineorp=rejectonce SPF and DKIM are aligned. - List every third-party script on the storefront and checkout pages, and remove what nobody owns (PCI DSS 4.0, requirement 6.4.3).
- Remove ScriptTags and theme snippets left behind by apps you no longer use.
- Delete tags that point at hosts that no longer resolve.
- Add a CAA record and, if your DNS host supports it, turn on DNSSEC.
Each of these is done in your own DNS, theme or app settings, and most take minutes. If you are unsure, start with the free snapshot: it checks your own domain against the same list.
Method & limits
Passive, and honest about it.
Latest passive scan of each store in a stratified benchmark sample of Shopify stores (1,676 reachable with a Trust Score, 110 in this segment), measured up to 2026-11-01. Only public GET requests, public DNS and TLS, and robots.txt were used: no forms, logins, payments or exploit attempts. Look-alike domains were only resolved in DNS.
We measure what a visitor's browser and the public DNS can see. We do not see checkout internals, admin settings, server-side controls or whether anyone has been attacked. Skimmer-style signatures are heuristics and are not reported per segment. Shares are not weighted to the full Shopify population, and segments of a few dozen stores carry wide margins of error: read differences of a few points as noise.
Full method and the overall numbers: State of Shopify Security.
More segments
Compare other segments.
Where does your store stand?
A free, passive snapshot of your own domain: a 0–100 score, how you compare with stores like yours, and the fixes in priority order.