Information checked: November 4, 2026
Have you added apps without knowing exactly what access they have to orders and customer information? Does someone at a former development partner still have access to your admin? If you use Shopify, can you leave every part of the purchase flow to Shopify?
If any of these questions concerns you, start by looking at your own store. The staff, apps, theme, and payment settings can help you separate what is working as intended from what needs a closer look. An external assessment takes time and money, but there are checks your team can do first.
This guide covers a review of admin settings and an ordinary purchase journey. Seeing no problem on these screens does not prove that there are no hidden vulnerabilities or data leaks. After the self-check, we explain when specialist testing or a submission to your card company may be needed.
1. Check who can access the admin now
In Settings, open Users and review staff members and collaborators. Collaborator access lets external parties, such as development agencies, work on your store. For each person, ask whether they are still responsible for the work and why they need access. Open their assigned roles as well. If someone has multiple roles, their permissions are combined.
For example, if a person hired to add products can export customer information, ask the person responsible for that work whether a CSV export is necessary. Keep the access if its purpose is clear. If it is not, check the work involved and revise the permissions. If a former employee or contractor still has access, inform the store owner and remove that access. Tell the owner promptly about any user or role change you cannot account for, and compare it with the activity logs discussed below.
Shopify's user management guide also explains how to review existing users and assigned roles. Permission to view customer information is separate from permission to export it. Start by checking the roles actually assigned; you do not need to create a new role just to perform this review.
2. Check each staff member's sign-in method
Once you know who can access the admin, ask each staff member to open their own account security settings. They should check whether they have set up a passkey or two-step authentication and how they would recover access if they lost their device. A passkey uses device authentication for sign-in. Two-step authentication requires another verification step in addition to a password. Shopify's secure sign-in guide explains how to configure these methods.
If an admin user screen says a secure sign-in method is “required,” that shows a requirement set for the user. Ask the staff member which method they have actually enrolled. You cannot set up someone else's authentication on their behalf. If a shared account makes it impossible to tell who made a change, prioritize a move to individual access. Compare any unfamiliar sign-in with the person's devices and work. If they cannot account for it, contact the store owner and Shopify Support promptly.
3. Compare each app's purpose with the data it can access
In Settings, open Apps and list the installed apps. Open each one. Under Activity and permissions, check which areas, such as orders, customers, or products, the app can read or change, and when it was last used. Privacy shows the personal data it can access. Compare these permissions and activity dates with the app's everyday purpose and the work of the person responsible.
Suppose an app displays product reviews and also has access to customer information. It may need that access to send review requests. If the person responsible cannot explain the need, ask the app provider which feature uses which data and whether the permissions can be reduced. A permission shown in the admin does not prove that the provider has actually stored the data outside Shopify. Check its privacy policy or ask the provider where data is stored, for how long, and how it is deleted.
For third-party apps, Unused access shows permissions that have not been used in the past 30 days. It is a starting point for review. Some features run only at particular times, so 30 days without use does not by itself show that the entire app is unnecessary or safe. Shopify-built apps are currently outside this activity tracking. You can also consult Shopify's app management guide.
Before uninstalling an app that appears unused, check with the responsible team whether it affects the purchase flow, automates orders or inventory, or holds data you will need later. As Shopify's uninstall guide notes, code may remain in the theme. Data stored outside Shopify and billing also need separate checks after an app is removed.
4. Trace displays and code added to the theme
In Online Store, open Themes and identify the published theme. In the theme editor, review App embeds and the app blocks on product pages and in the cart. If you can identify when and why a display was added, note whom to contact at the development agency or app provider. Ask the developer who is responsible for updating and fixing any custom code.
If a display remains on a page but is no longer used, compare the affected pages with the date the app was removed. Removing a display may leave the app's data permissions in place. Reading theme code alone cannot establish whether it is secure. If no one can explain code that affects the buy button or cart, ask the developer before editing it. If your sales interface was built separately from a Shopify theme, also ask its developer who maintains that code.
5. Follow the purchase journey from product page to payment
On an actual product page, press the buy button and continue through the cart to the screen before payment. You do not need to enter a card number or place an order. If an app adds gift input or a members-only display, choose a product that uses that feature too. In the admin, open Settings and Payments to see the enabled payment methods and contracted providers. Compare them with the methods and destinations shown to buyers.
If you use an external payment provider, the buyer may move from a Shopify screen to that provider's screen. Check whether the destination matches the provider you contracted with. If an unfamiliar screen asks for a card number, stop before entering it. Record the URLs before and after the move and the time, then ask the store owner, developer, and payment provider to investigate. An unfamiliar redirect alone does not establish a leak; preserve where the journey began.
6. Find customer and order data kept outside Shopify
The Shopify admin cannot show where a customer CSV went after export or which email addresses were passed to a messaging service. Ask the people who work with orders and customer information whether they use shared drives, personal computers, email attachments, messaging services, or an earlier system. For each location, ask what work requires the data, who can open it, and when it will be deleted.
For example, if a CSV from a completed campaign remains in a folder shared with a contractor, ask the campaign team and contractor whether they still need the file. If they do not, remove access and delete it according to your contract and internal retention rules. Deleting customer information in Shopify does not establish that a copy in an external service was deleted. Ask each service owner about its retention period and the result of deletion.
7. Compare unfamiliar changes with the logs
If a permission review leaves you asking who granted access, open the User management activity log under Settings, Users, and Security, or the Store activity log under Resources in Settings, General. For user and role changes and covered admin actions, you can see when a change was made and who made it. If a sign-in is unfamiliar, compare each user's recent access with their own work. What logs show and how they can be filtered depend on store permissions and feature availability. They do not record every view or action. See Shopify's store activity log guide.
If a change matches planned work, note the person and the change, then continue. If you find a user addition or app installation you cannot account for, tell the store owner immediately. A log alone cannot establish the cause or full impact. The owner should decide whether access or app use needs to be stopped and compare the facts with the relevant staff member, provider, and Shopify Support. Verify the sender of notification emails and the corresponding admin display before acting on them.
Keep a one-page record and decide what to do next
You do not need a long request document to record this self-check. Separate what you saw on screen from whom you need to ask, so another team member can continue the work. The entries below are examples of how to record findings, not problems found in a real store.
| Area | Example of what you saw | Next action and contact |
|---|---|---|
| Staff | A former development contractor still has access | The store owner removes access and records when it was changed |
| Apps | An app can access order information, but the person responsible cannot explain why | Ask the app provider which feature uses the information and which permissions it needs |
| Purchase journey | Before payment, the buyer moved to a screen that does not match the contracted provider | Stop before entering card details, record the URL and time, and contact the owner and payment provider |
If an app's purpose matches the permissions it needs and the purchase journey follows the contracted payment method, you can decide to keep the current settings. If a purpose or storage location is unclear, ask the provider or your internal owner for an answer. For access you cannot account for, or a card-entry screen that differs from the contracted provider's, stop the relevant action and alert the owner promptly. Mark each entry “confirmed,” “being checked,” or “action needed,” and record who will do what next.
When your team cannot decide from the self-check
Settings screens cannot reveal hidden weaknesses in code or problems spanning Shopify, apps, and external servers. Bring your notes to a specialist if you have a custom sales interface or app, unexplained behavior in the purchase journey, or documents to submit to a card company.
Popaz can review your admin settings and the features you use, then help separate operational changes from areas that need a specialist vulnerability assessment. If you still have questions after trying this guide, contact Popaz first. An initial consultation and rough estimate are free. Technical investigation that requires access inside your store, or detailed requirements work, is scoped and priced separately, with a nondisclosure agreement where appropriate. For areas Popaz cannot assess sufficiently, we recommend a specialist security firm.
Japan's Credit Card Security Guidelines, version 6.1, for card merchants, call for periodic web application vulnerability assessments or penetration tests and any necessary fixes. Software updates, reviews of code developed or modified in-house, and checks of input fields are separate measures. Even if your store does not retain card numbers, you must understand and declare the measures in place. Do not treat this screen-based self-check as evidence that those measures have been completed. Ask your contracted card company or payment service provider (PSP) what documentation it requires and how to handle work you cannot perform or alternative measures.
When asking a specialist firm for a quote, use your notes to describe your theme, apps, sign-in, custom code, payment method, and the areas you want assessed. You can also use the optional assessment request template. Before sending automated scans or attack-like inputs to services managed by Shopify, app providers, or payment providers, confirm permission for the targets and methods. Ask what is excluded from the quote and whether it includes a report, retesting after fixes, and any additional fees.
Published starting prices for one-off, general web application assessments vary: ¥300,000 for automated testing, excluding tax, ¥400,000 for testing that combines tools and manual work, excluding tax, and plans above ¥1,000,000, excluding tax. These are published examples with different ways of counting targets and different work included. They are neither an average nor an estimate for your Shopify store. The price depends on whether the provider counts requests (the communications involved in loading screens and submitting input), screens, or functions, and whether sign-in screens and APIs are included. Ask whether a report meeting and retesting after fixes are included or charged separately.
Show the provider which features you want checked. Use its quote to confirm the assessable scope, required permissions, testing method, report and retesting terms, total price including extras, and schedule.
References
- Shopify Help Center: Security and privacy
- Credit Card Security Guidelines, version 6.1 (Japan Credit Association, March 2026)
