Kernel InitResearchBy segmentUnited Kingdom
Shopify store security in the United Kingdom.
We passively measured 107 Shopify stores in the United Kingdom as part of our State of Shopify Security benchmark. Public pages, DNS and TLS only. These are aggregated results for the segment: no store is named, and figures appear only where at least 30 stores were measured.
In short
How United Kingdom compares.
UK stores work under UK GDPR and PECR, which require consent before non-essential cookies and set rules for marketing email. Order-confirmation and delivery emails are the messages customers are trained to trust, so they are the first ones attackers copy.
- The median Store Trust Score is 79, 1 point below the full sample (80).
- Legacy app ScriptTags (not removed on uninstall): 57.7%, 13.1 points more often than across all 1,676 stores (44.6%).
- No SPF record: 23.4%, 12.2 points less often than across all 1,676 stores (35.6%).
- Among the 10 countries we cover, it has the second-highest share of spoofable email domains.
- Among the 10 countries we cover, it has the highest share of legacy app ScriptTags.
- Among the 9 countries we cover, it has the highest share of scripts without SRI.
- Among the 10 countries we cover, it has the lowest share of missing SPF records.
Store Trust Score in this segment: median 79 (p10 73, p25 76, p75 82, p90 85), on a 0–100 scale where higher is better. 15.0% of these stores reach the Strong band (85+) and 6.5% score below Good (under 70).
Side by side
United Kingdom versus all 1,676 stores.
Share of stores with each issue, among the stores where the check could be measured. Highlighted bars are more than 2 points above the full sample.
All findings
What's visible from outside.
Unweighted shares. A finding is left out when fewer than 30 stores in the segment could be measured, and a share is not printed when it rests on fewer than 5 stores.
| Finding | This segment | All stores | N measured |
|---|---|---|---|
| Email domain can be spoofed (no DMARC, or DMARC p=none)Without an enforced DMARC policy, anyone can send email that appears to come from the store's domain. | 88.8% | 83.8% | 107 |
| No SPF recordSPF lists which servers may send mail for the domain. Without it, receivers have less to go on. | 23.4% | 35.6% | 107 |
| DMARC without aggregate reportsA DMARC record without a reporting address means nobody sees who is sending as the domain. | 64.9% | 64.6% | 77 |
| Look-alike domains with mail, owned by third partiesRegistered domains that look like the store's and accept mail, owned by someone else. | 9.3% | 8.7% | 107 |
| Legacy app ScriptTags (not removed on uninstall)Scripts injected by apps through the ScriptTag API. They are not always removed when the app is uninstalled. | 57.7% | 44.6% | 104 |
| Third-party scripts without SRI on static CDNsScripts from public CDNs loaded without an integrity hash, so a changed file would still run. | 15.1% | 10.3% | 106 |
| JavaScript libraries with known CVEsFront-end libraries whose detected version has a published CVE. Exploitability depends on use. | 10.4% | 6.1% | 106 |
| Broken script tags (host no longer resolves)Script tags that point to hosts that no longer resolve: dead weight, and a sign nobody reviews the theme. | fewer than 5 stores | 3.0% | 106 |
| No reachable privacy policyNo privacy policy reachable from the storefront where we looked for one. | fewer than 5 stores | 5.7% | 104 |
| Basic accessibility gaps on the home pageBasic, automatically detectable gaps on the home page (for example images without text alternatives). | 12.3% | 9.9% | 106 |
| Zone not DNSSEC-signedDNSSEC protects DNS answers from tampering. It is rare everywhere and depends on the DNS host. | 98.1% | 94.6% | 107 |
| No CAA recordA CAA record limits which certificate authorities may issue certificates for the domain. | 99.1% | 99.3% | 107 |
Market context
The wider United Kingdom market.
The market dataset lists 239,037 active Shopify stores in the United Kingdom. 2.7% are on Shopify Plus (all Shopify: 2.6%); the median store has 3 installed apps and 1 detected tracker. Session replay is detected on 8.4% of them (all Shopify: 8.0%). The largest Shopify categories here are Apparel (56,629), Home & Garden (30,534) and Beauty & Fitness (23,518).
Market figures come from a third-party technology dataset of active Shopify storefronts (built 2026-11-01), shown only for segments with at least 1,000 stores. Technology detection can miss tools that are built into Shopify, so adoption shares are lower bounds.
What to do first
Five fixes, in order.
- Publish DMARC with a reporting address, then move from
p=nonetop=quarantineorp=rejectonce SPF and DKIM are aligned. - List every third-party script on the storefront and checkout pages, and remove what nobody owns (PCI DSS 4.0, requirement 6.4.3).
- Remove ScriptTags and theme snippets left behind by apps you no longer use.
- Delete tags that point at hosts that no longer resolve.
- Add a CAA record and, if your DNS host supports it, turn on DNSSEC.
Each of these is done in your own DNS, theme or app settings, and most take minutes. If you are unsure, start with the free snapshot: it checks your own domain against the same list.
Method & limits
Passive, and honest about it.
Latest passive scan of each store in a stratified benchmark sample of Shopify stores (1,676 reachable with a Trust Score, 107 in this segment), measured up to 2026-11-01. Only public GET requests, public DNS and TLS, and robots.txt were used: no forms, logins, payments or exploit attempts. Look-alike domains were only resolved in DNS.
We measure what a visitor's browser and the public DNS can see. We do not see checkout internals, admin settings, server-side controls or whether anyone has been attacked. Skimmer-style signatures are heuristics and are not reported per segment. Shares are not weighted to the full Shopify population, and segments of a few dozen stores carry wide margins of error: read differences of a few points as noise.
Full method and the overall numbers: State of Shopify Security.
More segments
Compare other segments.
Where does your store stand?
A free, passive snapshot of your own domain: a 0–100 score, how you compare with stores like yours, and the fixes in priority order.