--- title: "Shopify App Hacks: Is Your Store Affected? | shoplab" description: "After the reported Shopify app hacks, use our free checklist to check your store, spot unusual redirects, and review which apps can access your data." url: https://shoplab.cc/en/shopify-app-security --- Shopify app security # Shopify app hacks: Is your store affected? In the recently reported attacks involving Shopify apps, shoppers were redirected to fake checkouts. This free guide helps you check for unusual redirects at checkout and start reviewing your apps. [Get the free checklist](#app-security-checklist)[Discuss app security](https://app.reclaim.ai/m/shoplab/shopify-app-security-advisory?tz=Europe%2FBerlin) No sign-up. You will not enter customer details or place an order. ## How to check your checkout 1. Open a product01 2. Add it to the cart02 3. Check the checkout address03 Click the checkout button your customers actually use. Opening a checkout address directly skips the step where a redirect can be triggered. Your free self-check ## Six steps for your store Start with your desktop browser and app list. Keep a private record of anything unusual so your team can investigate it. 1. 01 ### Open your store in a private window. Close all private windows, then open a new one. Type in your known store address and do not sign in as a customer. This starts your check without cookies from earlier visits. A private window does not protect you from a malicious page. 2. 02 ### Go from a product to checkout. Add an available product to the cart and use the normal checkout button. Stop as soon as you can inspect the destination page and its address. Do not enter personal or payment details or place an order. 3. 03 ### Check the address in your browser. Does the actual domain match your expected checkout? If the destination is unfamiliar, stop and have it checked. If nothing looks unusual, test other routes to checkout, such as a cart drawer. Close all private windows and open a new one for each route. 4. 04 ### List every installed app. Open app management in Shopify. Record each app’s provider and purpose. An app may remain installed after it disappears from the App Store. Delisting alone does not prove that an attack occurred. 5. 05 ### Review access and assign an owner. Record which data or store areas an app can access and who on your team is responsible for it. Ask for an explanation of permissions you do not understand. Pay particular attention to apps that run in the purchase journey or can change store content. 6. 06 ### Plan the removal of unused apps. First check whether orders, other apps, or internal workflows depend on them. Save any data you need and follow the provider’s removal instructions. Then test the purchase journey again and have any remaining integrations checked. ## How to read the result * Several redirects or a domain change are reasons to look closer. They do not prove an attack on their own. What matters is whether the destination belongs to your configured purchase journey. * Redirects to Shopify or Shop Pay can be legitimate. A familiar name on the page does not replace checking the actual browser address. * HTTPS and a browser padlock tell you the connection is encrypted. A phishing page can use HTTPS too. A normal-looking run is a snapshot. It does not prove that every app is secure, or that mobile devices, other products, or later visits will behave the same way. ### Did you reach an unfamiliar page? Stop the test. Privately record the time, observed domain, and a screenshot without personal data. Tell your technical team, Shopify, and the relevant app provider if known. Have the suspicious integration investigated and contained before testing further. Take a closer look with Shoplab ## Who can access what in your store? We list your apps, review their access, and show you which risks to address first. You get an app inventory with responsible owners and an action plan for your store. [Book an app security consultation](https://app.reclaim.ai/m/shoplab/shopify-app-security-advisory?tz=Europe%2FBerlin) We will agree on a suitable scope for your store in the call. An assessment cannot provide a complete security guarantee. * 01 ### An app inventory with owners Which apps and integrations do you use, what purpose do they serve, and who looks after them? * 02 ### Access and the purchase journey Which data can apps access? Where do they affect the cart, checkout, or order processing? * 03 ### Providers and unanswered questions What security information is available, and what does a provider need to explain about an incident or its safeguards? * 04 ### A prioritized action plan What should you investigate, restrict, or remove first? Which dependencies and follow-up tests need to be considered? ## What happened in the app attacks? Our detailed article explains the reported incidents, how checkout redirects work, and what an app’s removal from the App Store actually tells you. [Read the background and sources](https://shoplab.cc/en/shopify-news/shopify-app-hacks-checkout-phishing-2026)