Shopify Checkout Hijack: What Store Owners Should Check

If you run a Shopify store, the last fortnight has been an uncomfortable one. Since 10 October, a number of Shopify stores have had shoppers quietly redirected to fake checkout pages, not because Shopify itself was breached, but because the apps installed on those stores were used to deliver the malicious code. Customers typed their card details into a look-alike page, then were passed back to the real checkout so the order still went through. Most store owners had no idea anything was wrong.

I spend most of my week inside Shopify stores, and almost every one I audit has more apps installed than it actually uses. So I want to cut through the noise: what happened, what you should check today, and how to stop your app stack becoming a liability.

What actually happened

The incident was first spotted on 10 October by developer Roman Zipp, who was sent to a fake checkout on a domain ending in .top while buying from a Shopify store. He traced it back to custom JavaScript being served through the Hulk Product Options app, and has kept a running timeline on his blog.

Over the following days, other apps were caught up too. Logbase confirmed that on 13 October an unauthorised party reached one of its internal tools and added a malicious script to the settings of some stores using its Selleasy upsell app (Logbase incident update). Swym reported unauthorised changes affecting its Wishlist Plus app on 14 October and again from 18 October, and paused the app while it rotated credentials (Swym security response).

The real-world impact is not theoretical. iTnews reported that an Australian dog harness retailer had to close its store on Shopify's advice after a customer flagged the fake checkout. On 20 October Shopify posted "Securing your app, together" to its developer forum, asking app developers to tighten security and announcing stricter rules for storefront app code.

Two details matter for store owners. First, the malicious code wasn't sitting in your theme files, so a quick look at your theme wouldn't have found it. Second, it was reportedly designed to fire only once per browser session, so testing your own checkout twice in a row could easily look clean.

Five checks to do on your store this week

None of this needs a developer. Set aside half an hour and work through it.

1. List every app you have installed. In Shopify admin, go to Settings, then Apps. Check specifically for Hulk Product Options, Selleasy and Swym Wishlist Plus. If you use any of them, read the developer's incident notice and follow their guidance.
2. Review your app embeds. In the theme editor, open App embeds and make sure you recognise every one that's switched on. If you can't say what an embed does, find out.
3. Test your checkout in a fresh private window. Use an incognito window with no browser extensions, add a product to the basket and click checkout. You should land on your own checkout, not an unfamiliar domain. Repeat in a new private window on a different device.
4. Tighten your logins. Make sure two-step authentication is on for your Shopify account and every staff account, and remove staff or collaborator access you no longer need.
5. Watch your inbox and reviews. Customers reporting an extra payment page, an odd error before checkout or card fraud after ordering are your early warning. A clean test today doesn't rule out an earlier window.

If you do find something, screenshot it, contact Shopify Support and the app developer straight away, and take advice on your data protection obligations. I'm a marketer, not a security specialist, so for anything beyond these basic checks you want a qualified professional involved.

Why app bloat is a growth problem, not just a security one

Here's my honest take from years of auditing stores. Most Shopify stores I look at carry apps that were installed for a test, a seasonal promotion or a feature nobody uses any more. Every one of those apps is another piece of code running on your storefront and another company with access to your store.

Leaving aside security, that bloat costs you money in ways that are easier to measure:

• Speed. Extra scripts slow your product and basket pages, and slower pages tend to convert worse.
• Tracking. Overlapping upsell, review and pop-up apps often fire their own pixels, which muddies the conversion data feeding your Google Ads and Meta campaigns.
• Monthly fees. Unused subscriptions quietly add up across a year.

So treat this incident as the push to do a proper app audit. For each app, ask three questions: what does it do, what revenue or saving can I attribute to it, and is there a native Shopify feature that now does the same job? If you can't answer the second question, it's a candidate for removal.

Protect conversion trust while things settle

Shoppers read the news too, and checkout trust is fragile. A few practical steps help:

• Keep your checkout as close to standard Shopify as you can. The more custom code you have around the basket and checkout button, the more there is to go wrong.
• Make sure your trust signals (payment logos, returns policy, contact details) are visible on product and basket pages, not just in the footer.
• Keep an eye on checkout abandonment and payment errors in Shopify analytics over the next few weeks. A sudden dip is worth investigating, not just putting down to seasonality.
• If you were affected, communicate with customers clearly and quickly. Silence damages trust far more than a straightforward explanation.

Build a simple app policy for 2027

The fix long-term isn't to avoid apps altogether. Good apps drive real revenue. It's to be deliberate about them. My suggestion is a one-page app policy:

• One person owns the app list and reviews it every quarter.
• Every new app is installed with a clear goal and a date to judge whether it worked.
• Apps that fail their test are removed, along with any leftover theme code and embeds.
• Custom JavaScript fields inside apps are only used when there's a documented reason.

It's not glamorous, but it's the kind of housekeeping that keeps a store fast, accurate and trustworthy, which is exactly what your marketing spend depends on.

What this means for your business

If you sell on Shopify, check your apps and checkout this week, and switch on two-step authentication if you haven't already. Then use this as the moment to strip out the apps that aren't earning their keep. You'll likely end up with a faster store, cleaner tracking for your ad campaigns and lower monthly costs, as well as a smaller attack surface. Shopify has said more security changes for apps are coming, so expect some of your apps to update or change how they work in the coming months.

As an official Shopify Partner, Shopify growth is a big part of what I do. You can see the full range of my marketing services here.

Want a second pair of eyes on your store?

If you'd like help auditing your Shopify apps, tracking and conversion rate, I'm happy to take a look. Book a free 30-minute call or a free marketing audit and we'll work out what's helping your store grow, and what's just getting in the way.