Security for stores: accounts, apps and staff access
Where store security actually fails, which is rarely the platform, and the routine that closes the doors staff, apps and habits leave open.
The short answer
The platform secures what a store cannot: the checkout, payment processing and the infrastructure underneath. Store breaches come through the ring the store controls. A staff account with a reused password and no two-factor. An app installed years ago with permission to read every customer and change every product. A domain or email account that lets an attacker redirect the store or reset every other login. A theme loading scripts from a third party that was later compromised. Closing those doors is a routine, not a project: two-factor everywhere, least privilege for staff and apps, departed people removed the same day, a quarterly access review, a short app list with permissions read, and the domain, DNS and email protected as carefully as the store.
Where store security fails
| Door | How it opens | How it is closed |
|---|---|---|
| Staff accounts | Reused or phished passwords; no two-factor; admin rights for everyone | Two-factor mandatory; roles with least privilege; unique passwords in a manager |
| Departed staff and agencies | Accounts never removed; shared logins still known | Same-day removal; quarterly access review; no shared logins |
| Apps | Broad permissions granted at install; unused apps left in place; compromised vendors | Few apps; permissions read; unused removed; storefront injection checked |
| Domain, DNS and email | Registrar or email account taken over; store redirected; resets intercepted | Two-factor, locks, company ownership, monitoring |
| Theme and third-party scripts | Scripts from vendors on every page; custom forms handling sensitive data | Minimal third parties; no custom payment fields; content security policy where possible |
| Customer accounts | Credential stuffing against logins | Platform protections; passwordless options; watching failed login patterns |
| Data exports | Customer lists exported and left in inboxes and drives | Export only when needed; delete after; audit who exports |
The routine
- Two-factor on every staff account, enforced, with an authenticator app or hardware key.
- Roles by need: owners, staff with specific permissions, no default admin.
- Remove departed staff and agencies the same day, and rotate what they knew.
- Quarterly access review across the store, domain, DNS, email, payments and marketing accounts.
- App audit quarterly: what each does, what permissions it holds, what it injects into the storefront; remove the unused.
- Protect the domain and email: company ownership, two-factor, registrar lock, monitoring of changes.
- Watch the storefront’s third-party scripts and keep them minimal.
- Handle exports carefully: only when needed, stored securely, deleted after use.
Apps as third parties
Every installed app is a company with access to your store’s data and, often, your storefront’s pages. Its security is now part of yours. A compromised app vendor has been the route into stores whose own security was fine. Keep the list short, read the permissions at install, review them quarterly, remove what is unused, and prefer apps that do not inject scripts into the storefront at all. The app audit is a security review as much as a speed one.
What this means for you
Trust the platform for the checkout and the infrastructure, and take responsibility for the ring around it: staff accounts with two-factor and least privilege, same-day removal of leavers, a quarterly access review, a short app list with permissions read and storefront injection checked, and the domain, DNS and email protected like the store itself. The routine takes minutes a quarter and closes the doors through which stores are actually breached.
Frequently asked questions
Is a Shopify store secure by default?
The checkout, payments and platform infrastructure are, and a store cannot weaken them. What the store controls is the ring around it: who can log in and with what permissions, which apps have access to what, whether the domain and email are protected, and what the theme loads from third parties. Breaches of stores come through that ring, and the store owner is responsible for it.
What can a malicious or compromised app do?
Whatever its permissions allow: read customers and orders, change products and prices, inject scripts into the storefront that skim payment details from custom forms or redirect visitors. App permissions are granted at install and rarely reviewed. Install few, read the permissions, and remove any app whose access exceeds its job.
How do we handle staff leaving?
Remove their store account, their app and integration access, their email and any shared credentials the same day, and rotate anything they knew. Quarterly, list everyone with access to the store, the domain, DNS, email, payment and marketing accounts, and remove anyone who should not be there. Former staff and agencies retaining access is the most common finding in store access reviews.
Sources
- Shopify Help Center: Securing your account (accessed 2026-09-12)