Removing malware from a Shopify website starts with understanding that Shopify's hosted infrastructure means the malware almost never lives in server files — instead, it typically hides inside injected storefront code, compromised third-party apps, or theme script injections. Acting quickly is critical because Google Safe Browsing and payment processors like Stripe can suspend your store within hours of detecting malicious code. Follow the structured steps below to identify, remove, and prevent the threat.

What Does Malware on a Shopify Store Actually Look Like?

Because Shopify manages its own servers, you will not find a PHP webshell or a modified WordPress core file. Shopify-specific malware almost always takes one of these forms:

  • Injected JavaScript in your theme code — skimmers that silently steal customer payment card data at checkout (known as Magecart or e-skimming attacks)
  • Malicious third-party apps — apps granted Script Editor or Theme access that inject code without your knowledge
  • Compromised theme files — theme.liquid, checkout.liquid, or asset files that contain obfuscated <script> tags pointing to attacker-controlled domains
  • DNS or domain hijacking — your custom domain redirected to a fraudulent site

OWASP classifies client-side skimming as one of the most dangerous threats to e-commerce platforms, and CISA has issued multiple alerts specifically about Magecart-style attacks targeting online stores.

Warning Signs Your Shopify Store Is Infected

  • Customers report unauthorised charges after shopping on your site
  • Google Search Console shows a "Site may be hacked" or Safe Browsing warning
  • Your store redirects visitors to an unknown website
  • Shopify or your payment processor has sent a suspicious-activity notice
  • You notice unfamiliar apps in your Shopify Admin that you did not install
  • Page load times suddenly spike (a sign of external script calls)

Step 1: Put Your Store Into Password Protection Immediately

Before doing anything else, limit the blast radius.

  1. In your Shopify Admin, go to Online Store → Preferences.
  2. Scroll to Password protection and enable it.
  3. Set a strong temporary password and note it — share it only with trusted team members.

This prevents new customers from being exposed to the malicious code while you work through the cleanup. Do not skip this step.

Step 2: Audit and Remove Suspicious Third-Party Apps

Apps are the most common infection vector on Shopify because they can inject scripts globally across your storefront.

  1. Go to Shopify Admin → Apps.
  2. Review every installed app against your original records or invoices.
  3. For any app you do not recognise, or that has an unusual permissions scope (especially "read and write themes" or "read customers"), click it and check:
    • The developer name and their Shopify App Store listing
    • The last time it was updated
    • Reviews that mention unusual behaviour
  4. Delete any app you cannot verify. Shopify will prompt you to confirm — check the box to also remove any injected code when it appears.
  5. After deletion, go to Online Store → Themes → Edit code and search for any remaining script tags or src attributes pointing to the deleted app's domain.

Important: Deleting an app does not always automatically remove code it injected into your theme. You must verify manually.

Step 3: Inspect Your Theme Code for Injected Scripts

This is the most technically demanding step. If you are not comfortable reading HTML/JavaScript, hire a Shopify Expert from the official Shopify Experts Marketplace for this task.

How to Audit Your Theme Files

  1. From Shopify Admin, go to Online Store → Themes.
  2. On your live theme, click Actions → Edit code.
  3. Work through these high-priority files in order:
    • layout/theme.liquid
    • layout/checkout.liquid (Shopify Plus stores only)
    • layout/password.liquid
    • snippets/ folder — every .liquid file
    • assets/ folder — every .js file

What to Look For

  • <script> tags referencing external domains you do not recognise
  • Base64-encoded strings (look for long strings starting with atob( or eval()
  • Heavily obfuscated JavaScript — random variable names, unusual character encoding
  • document.write() calls inserting dynamic content
  • Form event listeners on #checkout or document that you did not place there

Removing the Malicious Code

  • If you can clearly identify the injected block, delete only that block — do not delete surrounding legitimate code.
  • If the infection is widespread or you cannot confidently distinguish clean from malicious code, restore a clean backup of your theme (see Step 4).

Use a diff tool (such as the free diffchecker.com) to compare your current theme files against a fresh download of your original theme from the theme developer's repository.

Step 4: Restore a Clean Theme Backup

Shopify automatically saves up to three previous versions of your theme.

  1. Go to Online Store → Themes.
  2. Click Actions → Edit code on your live theme.
  3. In the top-right of the code editor, click Older versions if available, or check if you have a duplicate of the theme saved in your theme library.
  4. If you have a clean saved theme, activate it after verifying it is free of injected code.

If No Clean Backup Exists

  1. Download a fresh copy of your theme directly from the original developer (e.g., Shopify Theme Store or your purchased theme's official repository).
  2. Re-apply only your legitimate customisations manually — do not copy-paste large blocks from the infected theme without inspecting them first.

Step 5: Rotate All Credentials and Access Tokens

Attackers who compromised your store likely have credentials they can reuse. Rotate everything.

  1. Shopify account password — Go to Account Settings and change your password to a unique, randomly generated string (use a password manager like Bitwarden or 1Password).
  2. Enable two-factor authentication (2FA) — In Shopify Admin → Account → Security, enable 2FA on every staff account, not just the owner account.
  3. Review Staff Accounts — Go to Settings → Users and Permissions. Remove any staff accounts you do not recognise or that belong to former employees.
  4. Revoke and regenerate API keys — Go to Settings → Apps and sales channels → Develop apps. For every custom app or private API integration, regenerate the API credentials. Update your connected systems with the new keys.
  5. Update your domain registrar password if your store uses a custom domain — this prevents DNS hijacking recurrence.
  6. Update your Shopify Payments or payment gateway credentials if your payment provider requires it or has flagged suspicious activity.

Step 6: Scan Your Theme Code With External Tools

After cleanup, use independent scanning tools to verify you have removed all malicious code.

  • Sucuri SiteCheck (sitecheck.sucuri.net) — Enter your store URL for a free malware and blacklist scan.
  • Google Safe Browsing Transparency Report (transparencyreport.google.com/safe-browsing/search) — Check whether Google has flagged your domain.
  • VirusTotal (virustotal.com) — Scan your store URL against 90+ security engines.
  • URLScan.io (urlscan.io) — Renders your page in a sandbox and lists every external resource your store loads, making it easy to spot unauthorised third-party scripts.

Run all four tools and address anything flagged before proceeding to the next step.

Step 7: Request a Google Safe Browsing Review

If your store was flagged by Google, it will show a "Deceptive site ahead" interstitial warning to all visitors until you request a review.

  1. Verify ownership of your store's domain in Google Search Console (search.google.com/search-console).
  2. Go to the Security Issues report in Search Console.
  3. Once you have confirmed the malware is removed, click Request Review and describe the remediation steps you took.
  4. Google typically processes reviews within 72 hours, according to Google Search Central documentation.

Do not request a review until the malware is definitively removed — repeated failed reviews extend the blacklist period.

Step 8: Notify Affected Customers and Your Payment Processor

This step is both a legal obligation in many jurisdictions and the right thing to do.

Notify Your Payment Processor

Contact Shopify Payments support, Stripe, PayPal, or whichever gateway you use. Explain that you may have had a card-skimming script active. They can:

  • Flag potentially compromised transactions for investigation
  • Help you understand your liability exposure
  • Advise on whether you need to file a formal incident report

Notify Affected Customers

If customer payment data was potentially exposed, you likely have a legal obligation to notify affected individuals under regulations such as:

  • GDPR (European Union) — notification required within 72 hours of becoming aware of a breach
  • CCPA (California) — breach notification required in the most expedient time possible
  • PCI DSS requirements — if cardholder data was exposed, you must notify your acquiring bank and may need to engage a PCI Forensic Investigator (PFI)

Consult a legal professional if you are unsure of your specific obligations. Do not assume you are exempt.

Step 9: Harden Your Store to Prevent Reinfection

Cleaning up once is not enough if the underlying vulnerabilities remain open.

Ongoing Security Practices

  • Audit apps before installing — Check developer reputation, read reviews carefully, and grant only the minimum permissions required.
  • Enable Content Security Policy (CSP) headers — If you are on Shopify Plus, work with a developer to implement a strict CSP that whitelists only approved script sources. This is one of the most effective defences against Magecart attacks, per OWASP guidance.
  • Monitor for new script tags — Use a service like Reflectiz, Feroot, or a custom uptime monitor that alerts you when new external scripts appear on your checkout page.
  • Schedule quarterly theme audits — Set a calendar reminder to manually review your theme code every three months.
  • Keep 2FA enforced — Require it for all staff, not just administrators.
  • Review app permissions regularly — Once a month, go to Settings → Apps and remove anything you are not actively using.
  • Subscribe to Shopify security notifications — Shopify announces security updates in its changelog at shopify.dev/changelog.

Frequently Asked Questions

Can Shopify get malware if it manages its own servers?

Yes. While Shopify's core infrastructure is extremely secure and you cannot be infected via server-level vulnerabilities the way a self-hosted WordPress site can, attackers target the client-side layer — specifically your theme code and third-party apps. Magecart skimmers injected into storefront JavaScript are the dominant threat vector, and they do not require server access to steal customer data.

Will Shopify remove the malware for me?

Shopify's support team can assist with guidance and may help identify suspicious code, but the store owner is ultimately responsible for the content within their theme files and installed apps. Shopify does not perform hands-on malware removal as part of standard support. For complex infections, hire a vetted specialist from the Shopify Experts Marketplace.

How do I know if my customers' payment data was stolen?

You cannot determine this with certainty from inside your admin panel alone. The strongest indicators are customer complaints about unauthorised charges, alerts from your payment processor, or discovery of a JavaScript skimmer active on your checkout page. If you suspect data was stolen, engage your payment processor immediately and consider hiring a PCI Forensic Investigator (PFI) approved by the PCI Security Standards Council.

How long does it take to remove malware from a Shopify store?

For a straightforward app-injected script, an experienced developer can identify and remove it in one to two hours. If the infection is deeply embedded across multiple theme files or involves compromised API credentials, a full cleanup and hardening process typically takes four to eight hours. The Google Safe Browsing review adds up to 72 additional hours before your store is clear of browser warnings.

How much does Shopify malware removal cost?

If you handle it yourself following this guide, your direct cost is zero beyond your time. If you hire a Shopify Expert, expect to pay between $150 and $500 USD for a standard cleanup, or more if the infection is complex, legal notifications are required, or a full security audit is included. Always get a written scope of work before engaging a contractor.