What to check on your store after a Shopify app is reported compromised

Updated October 12, 2026

Short answer: first find out whether the app is, or ever was, on your store. If it is, test your checkout in a private browser window on a desktop and on a phone, and confirm the address bar stays on a domain that belongs to your store. Then uninstall the app if you can't trust it, review what your other apps can access, search your theme for code the app left behind, change the passwords that matter, and tell the app's developer and Shopify Support what you found.

One step on this list, searching your theme for leftover app code, can be automated. GhostCode does that part. It does not test your checkout and it can't see code that an installed app loads while a page is running, so it is not a substitute for the steps below.

What happened in October 2026

According to a write-up published 2026-10-10 by a software engineer who ran into it while shopping, he clicked Checkout on a Shopify store and landed on a page that looked like Shopify's checkout but sat on a different web address. The author traced it to a script file belonging to an app installed on the store, delivered from Shopify's CDN. He reports that when a page loaded, this script requested data from the developer's server, that the response included custom JavaScript, and that this JavaScript ran in the shopper's browser and redirected the checkout click to a fake checkout page. The fake page collected what the shopper typed and then passed them on to the real checkout.

Three details from the write-up matter for the checklist below:

The code was not in the store's theme. As described, it arrived from the app developer's server each time a page loaded.
It acted once per browser session. The write-up says the script recorded in the browser's session storage that a shopper had already been redirected, and did not try again.
The cause was not established. The author says it was unclear how the code got there and lists several possibilities, from a compromised merchant account at the developer to a compromise of the developer itself. He knew of two affected stores at the time of writing.

The write-up also reports that Shopify escalated the issue the same day, that the redirect stopped on the store where the author saw it, and that the store confirmed it had removed the app. We have not verified the write-up's findings ourselves, and we don't know the developer's account of what happened.

The checklist

1. Find out whether the app is on your store

In your Shopify admin, go to Settings → Apps. The Installed tab lists what is on your store now and the Uninstalled tab lists what has been removed. Click an app's name to see its history of installs and uninstalls. Check for other apps from the same developer as well. If the app is in neither tab, it is probably not on your store. Shopify describes the list as covering recently uninstalled apps, so an app removed long ago may not appear. Old app invoices and step 5 are the backstop. Steps 2 and 4 are worth doing a few times a year anyway.

2. Test your checkout the way a new shopper would

Open a new private or incognito window. This matters: by the write-up's account the redirect happened once per browser session, so a browser that has already been through your checkout may not show it.
Go to your store, add any product to the cart and click the ordinary Checkout button.
Read the address bar before you type anything. After you click the ordinary Checkout button, the address should start with a domain listed under Settings → Domains in your admin: your main domain, a subdomain of it such as checkout.yourstore.com, a country domain if you sell in several markets, or your myshopify.com address.
Repeat on a phone, again in a fresh private window. Test the ordinary Checkout button on the cart page and in the cart drawer. Express buttons such as Shop Pay or PayPal open their own sites, so an address that is not yours is expected there.

Some addresses that are not yours are still normal. A Shop Pay button, or a shopper already signed in to Shop, can open a page on Shop's own address (shop.app or shop.com). A PayPal, Amazon Pay or similar button opens that company's own site, and a bank's card verification page can appear after you press Pay. If you require customers to sign in before checkout, the sign-in page can be on shopify.com. If you use a third-party checkout app or a headless storefront, confirm your normal checkout address with whoever set it up.

Stop if you clicked the ordinary Checkout button and the page asking for contact, shipping or card details is on none of these, especially a lookalike with a misspelled word or an unfamiliar ending. Don't enter real card details. Take a screenshot showing the full address and go to step 3.

3. Uninstall the app if you can't trust it right now

Go to Settings → Apps, open the menu next to the app and choose Uninstall. Uninstalling ends the app's access to your store, and the app's blocks, embeds and script tags stop loading on your storefront. Before you do it, export any data you need from the app, because some app data can't be recovered afterwards. If the app charges you outside Shopify, cancel that with the developer too.

Then run the checkout test from step 2 again, in a new private window.

4. Review what your other apps can access

Still in Settings → Apps, click each installed app. The Activity and permissions section shows which areas of your store the app can view or edit and when it was last active in each. The Privacy section shows which personal data it can access. Uninstall apps you no longer use. Every installed app that loads code on your storefront is something you are trusting on every page view, so a shorter list is a smaller risk.

5. Look for code the app left in your theme

Uninstalling does not remove code that an app wrote into your theme files, or code you pasted in when you set it up. Go to Online Store, open the menu (…) on your theme and choose Edit code, then use the search button in the left sidebar to search every file for the app's name and its web address. Any line that still loads a script from the developer's servers keeps running in your shoppers' browsers after the app is gone.

If you want to see what a file looked like earlier, the code editor's Timeline view shows previous versions of one file at a time. Its history is limited and it doesn't cover files in the assets folder.

More detail: what uninstalling an app does and doesn't remove, and how to remove leftover app code safely.

6. Check Customer events

Go to Settings → Customer events → Custom pixels. Custom pixels are pieces of code that you or someone working on your store added by hand. Disconnect or delete any you don't recognize or no longer need.

7. Change the passwords that matter

Your account with the app's developer, if you have a separate login there. Change the password and turn on two-step sign-in if they offer it. The write-up's author gives the same advice.
Keys you gave the app for other services, such as an email platform or an ads account. Create new keys in those services and delete the old ones.
Your Shopify login, only if there are signs it was accessed: sign-ins you don't recognize, new staff accounts, or settings that changed. In that case Shopify's guidance is to change the password on your email account and your Shopify account, turn on two-step authentication (or reset it if it was bypassed), review staff permissions and your store's activity log, check your Checkout, Domains and Notifications settings, and look over your Shopify financial accounts for activity you don't recognize.

You don't need to do anything about the app's own access to Shopify. Uninstalling the app ended it.

8. Tell the right people

The app's developer. Use the support contact on the app's App Store listing. Say what you saw and when.
Shopify Support. Start a chat from help.shopify.com. Give the app's name, your screenshots and the address shoppers were sent to. Shopify normally sends questions about a third-party app to its developer, but a redirected checkout is still worth reporting: in the incident above the author reports the redirect stopped on that store within hours of his report to Shopify. If you think your Shopify account itself was accessed, Shopify says to contact Support immediately.
Your payment provider and an adviser, if shoppers may have typed card details into a fake page. Depending on where you and your customers are, you may have a duty to notify customers or a regulator. This guide can't tell you whether you do. Ask someone qualified before you decide.

What a theme scan can and can't tell you here

We make GhostCode, a Shopify app that scans your theme files, so it is worth being exact about its limits.

It would not have detected the incident described above. By the write-up's account the code was fetched by the installed app while the page loaded and was never stored in the theme. A scan of theme files has nothing to find. The checkout test in step 2 is the check that catches a redirect. A clean test is not proof either: code like this can be switched on for only some visitors or some of the time, so repeat it over a few days.
It does not test your checkout or watch your live storefront for redirects.
What it does do is step 5: it scans your theme for code left by uninstalled apps, using signatures for 100+ apps, and shows the app, the file and the line. It also flags theme code that refers to a short list of web addresses tied to malicious scripts or fake checkout pages in public reports. That list is small and specific. A clean result does not mean your store is safe.

GhostCode only reads your theme and never edits it. Read how GhostCode works. Free and paid plans available. See the GhostCode listing on the Shopify App Store for features and plans.

Common questions

How do I test whether my Shopify checkout is being redirected?

Open a new private or incognito window, add a product to the cart, click Checkout, and read the address bar before you type anything. The address should be on a domain listed under Settings → Domains in your admin (Shop Pay, PayPal and similar buttons open their own sites). Do it once on a desktop browser and once on a phone, each time in a fresh private window.

Does uninstalling a compromised Shopify app fix the problem?

It ends the app's access to your store, and the app's blocks, embeds and script tags stop loading. It does not remove code the app wrote into your theme files, and it does not undo anything that already happened. After uninstalling, repeat the checkout test and search your theme for leftover code.

Would a theme code scan detect a compromised app?

Not if the harmful code is delivered by the installed app while the page loads, which is what an independent write-up described in the October 2026 checkout redirect incident. That code is never stored in your theme files, so a theme scan cannot see it. A theme scan finds code that sits in your theme. The checkout test is the check that catches a redirect. A clean test is not proof either: code like this can be switched on for only some visitors or some of the time, so repeat it over a few days.

Do I need to change my Shopify password after an app is compromised?

A compromised app does not mean your Shopify login was exposed. Change the password for any account you hold with the app's developer first. If you see sign-ins, staff accounts or settings changes you don't recognize, change your Shopify password and turn on two-step authentication (or reset it if it was bypassed).

Who do I contact if I think an app on my store is compromised?

Contact the app's developer and Shopify Support, and tell both exactly what you saw, with screenshots and the web address shoppers were sent to. If you think your Shopify account itself was accessed, Shopify's guidance is to contact Shopify Support immediately.

For step 5 only: install GhostCode from the Shopify App Store to scan your theme for leftover app code. It never edits your theme. Free and paid plans available. Do the checkout test yourself first.

Related guides

Sources

Questions: support@alpenglowsoftware.com