If your Shopify site has been hacked, the fastest path to recovery is to revoke unauthorized access, secure your admin credentials, and contact Shopify Support without delay. Most Shopify breaches do not involve the core platform itself — they involve compromised staff accounts, stolen API keys, or malicious third-party apps installed by attackers. Understanding this distinction will shape every step you take to recover and protect your store.

How Do You Know Your Shopify Store Has Been Hacked?

Before taking action, confirm you are dealing with an actual compromise rather than a technical glitch. Common signs include:

  • Unexpected admin activity — password changes, new staff accounts, or unfamiliar apps you did not install.
  • Customer complaints — reports of phishing emails appearing to come from your store, or fraudulent charges linked to purchases they made with you.
  • Unusual redirects — your storefront redirecting visitors to a third-party website, especially one selling counterfeit goods or collecting credentials.
  • Injected content — unfamiliar scripts, pop-ups, or banners appearing in your theme code.
  • Suspicious orders or payouts — orders placed with stolen cards, or payout account details changed without your knowledge.
  • Google Safe Browsing warnings — browsers flagging your store as dangerous. You can check your domain at Google Search Central's Safe Browsing tool.

If you see two or more of these signs simultaneously, treat it as a confirmed incident and proceed immediately.

Step 1: Do Not Panic — Contain the Breach First

Your priority is to stop the attacker from doing further damage, not to immediately restore normal operations.

Temporarily pause your store

In your Shopify Admin, go to Settings → Plan and select Pause and build or place your store in Password-protected mode under Online Store → Preferences → Password protection. This prevents customers from being exposed to malicious content while you work.

Disconnect any compromised integrations

If you suspect a specific app or integration triggered the breach, disable it immediately: go to Apps, find the app in question, and click Delete. You can also revoke app API keys under Settings → Apps and sales channels → Develop apps.

Step 2: Secure Your Shopify Admin Access

Change your password immediately

Log in and go to your Shopify account profile at shopify.com/profile. Choose a strong, unique password of at least 16 characters that you have never used elsewhere. Use a reputable password manager such as Bitwarden or 1Password to generate and store it.

Enable two-factor authentication (2FA)

If 2FA is not already enabled, turn it on now under Account → Security → Two-step authentication. Use an authenticator app (Google Authenticator or Authy) rather than SMS wherever possible, as SMS-based 2FA is more vulnerable to SIM-swapping attacks — a point emphasized by CISA in its authentication guidance.

Audit and remove all staff accounts

Go to Settings → Users and permissions. Review every staff account carefully:

  1. Remove any account you do not recognize.
  2. Force a password reset for all remaining staff members.
  3. Apply the principle of least privilege — each staff member should have only the permissions they genuinely need. OWASP identifies excessive privilege as one of the most common root causes of access-related breaches.

Revoke and regenerate all API keys

Under Settings → Apps and sales channels → Develop apps, audit every private app and custom integration. Delete access tokens for any app you cannot identify, and regenerate API keys for legitimate integrations. Notify your developers immediately if this affects live integrations.

Step 3: Contact Shopify Support

Open a support ticket at help.shopify.com or use the live chat in your admin dashboard. Be specific and factual:

  • Describe what suspicious activity you observed and when it started.
  • Share any suspicious email addresses, app names, or IP addresses you have noticed.
  • Ask Shopify Support to review your store's activity log for unauthorized logins or changes.

Shopify's Trust & Safety team has visibility into platform-level activity that you do not. They can confirm whether your store was accessed through a legitimate session or through an exploited vulnerability, and they can assist with account recovery if you have been locked out.

Step 4: Audit and Clean Your Theme Code

Hackers frequently inject malicious JavaScript into Shopify theme files to skim credit card data (a technique known as Magecart-style attacks) or to redirect visitors.

Access your theme code

Go to Online Store → Themes → Actions → Edit code.

Check these files carefully

  • theme.liquid — look for any <script> tags you did not add, especially those loading external URLs you do not recognize.
  • checkout.liquid (Shopify Plus stores only) — this is a high-value target for card-skimming scripts.
  • product.liquid and cart.liquid — additional common injection points.
  • Any asset files ending in .js — compare them against your original theme's source if possible.

How to identify malicious code

Look for:

  • Obfuscated strings using base64, eval(), atob(), or unescape().
  • External script sources pointing to domains you do not recognize.
  • Code that was recently modified (the file list shows last-modified timestamps).

Restore a clean version of your theme

If you published a backup before the incident, restore it: Online Store → Themes → Actions → Duplicate creates a backup going forward. For now, if your current theme is compromised, unpublish it and republish a known-clean version or a freshly downloaded copy from the Shopify Theme Store.

Do not simply delete suspicious lines unless you understand exactly what they do — save a copy of the compromised code first so that Shopify Support or a security professional can analyze it.

Step 5: Review Your Apps Thoroughly

Every third-party app you install is granted API access to your store. A compromised or rogue app is one of the most common vectors for a Shopify breach.

Audit your installed apps

Go to Apps and review every item in the list:

  1. Search for each app in the Shopify App Store to confirm it is legitimate and still published.
  2. Remove any app that is no longer in the App Store — delisted apps may have been removed for policy violations or malicious behavior.
  3. Remove any app you installed for a trial and forgot to delete.

Check app permissions

When you reinstall or add new apps, read the permission scope carefully. An app that only needs to read product listings should not require write access to customer data or payment settings.

Step 6: Protect Your Customers

You have a legal and ethical obligation to inform affected customers if their personal data may have been compromised.

Assess what data may have been exposed

Shopify does not store full credit card numbers on your store — payment data is handled by PCI-DSS-compliant processors. However, attackers may have accessed:

  • Customer names, email addresses, and shipping addresses.
  • Order history.
  • If a Magecart-style script was active during checkout, card data may have been captured in transit before it reached Shopify's servers.

Notify affected customers promptly

Send a clear, honest email that:

  • States what happened and what information may have been affected.
  • Confirms the steps you have taken to secure the store.
  • Advises them to monitor their bank statements and report suspicious activity.
  • Provides a contact address for questions.

Report to relevant authorities

Depending on your jurisdiction:

  • EU/UK merchants: A data breach involving personal data must be reported to your supervisory authority within 72 hours under GDPR / UK GDPR.
  • US merchants: State breach notification laws vary — consult legal counsel or your state Attorney General's office.
  • All merchants: Report card fraud to the card brands if card data may have been skimmed. Your payment processor can guide you.

Step 7: Scan for Ongoing Threats

Use Shopify's built-in activity log

Go to Settings → Plan → Activity log (or your Shopify admin's Home → Activity feed). Filter for logins, staff permission changes, and payout detail changes in the days leading up to and during the incident.

Check your connected email account

If the email address linked to your Shopify admin was compromised, attackers can intercept password reset emails and lock you out. Check your email account's login history, remove unauthorized devices, change the password, and enable 2FA there too.

Check your domain registrar

If your storefront domain is custom (e.g., yourstore.com), log in to your domain registrar and confirm:

  • DNS records have not been altered (especially A, CNAME, or MX records).
  • WHOIS contact email has not been changed.
  • Domain lock is enabled to prevent unauthorized transfer.

Step 8: Harden Your Store to Prevent Reinfection

Recovery is only complete when you have closed the door that let the attacker in.

Enforce 2FA for all staff

Under Settings → Users and permissions, require two-factor authentication for every staff member. This is the single highest-impact preventive measure you can take.

Review payout and banking details

Go to Settings → Payment providers and Settings → Bank account to confirm your payout details have not been altered. Contact your bank immediately if you notice unauthorized changes.

Set up login notifications

Enable email notifications for new admin logins so you are alerted to any suspicious access in real time. Go to Settings → Notifications and review which events trigger alerts.

Adopt the principle of least privilege

Revisit staff permissions every quarter. Remove accounts belonging to former employees or contractors the moment they stop working with you.

Use a unique email address for Shopify admin

Consider creating a dedicated email address (e.g., admin-shopify@yourdomain.com) used exclusively for your Shopify account and shared with no one. This makes phishing and credential stuffing significantly harder.

Keep apps minimal

Every installed app increases your attack surface. Remove apps you no longer actively use. This aligns with OWASP's principle of minimizing attack surface area.

Step 9: Document Everything and Conduct a Post-Incident Review

Write down a timeline of events: when you first noticed the breach, what steps you took, and when. This documentation is essential for:

  • Regulatory breach reports.
  • Insurance claims (if you carry cyber liability insurance).
  • Internal review to prevent recurrence.

Within one week of resolving the incident, hold a post-incident review with anyone who manages your store. Ask: What was the root cause? What could have detected this earlier? What process will prevent it next time?

Frequently Asked Questions

Can Shopify itself get hacked, putting my store at risk?

Shopify operates as a PCI-DSS Level 1 compliant platform with enterprise-grade security infrastructure. The vast majority of individual store breaches are not caused by vulnerabilities in the Shopify platform itself — they result from compromised merchant credentials, malicious third-party apps, or injected code introduced through a staff account. That said, if Shopify ever experiences a platform-level incident, they will notify merchants directly and post updates on their status page at status.shopify.com.

Will Shopify refund money lost due to a hack?

Shopify does not typically provide financial reimbursement for losses resulting from a merchant's compromised account. However, if unauthorized payouts were made from your store, contact Shopify Support and your bank immediately — rapid reporting maximizes the chance of reversing fraudulent transactions. Check whether your business insurance or cyber liability policy covers losses from a breach.

How long does it take to fully recover from a Shopify hack?

Basic containment — locking out the attacker and securing admin access — can be completed within a few hours. Full recovery, including code audit, customer notification, regulatory reporting, and hardening, typically takes between 48 hours and one week depending on the severity of the breach. Having a documented incident response plan in advance dramatically reduces this timeline.

Do I need to hire a security professional to recover?

In many cases, a technically capable store owner can complete the recovery steps above without outside help. However, if your theme contains heavily obfuscated malicious code you cannot interpret, if you have reason to believe customer card data was actively skimmed, or if the attacker regains access after your initial lockdown, you should engage a qualified ecommerce security professional or a PCI forensic investigator (PFI). Your payment processor can recommend a PFI if card data is involved.

How do I prevent my Shopify store from being hacked again?

The most effective preventive measures are: enabling two-factor authentication on all staff accounts and your linked email address, using strong unique passwords managed by a password manager, keeping your installed app list minimal, auditing staff permissions regularly, and monitoring your activity log for unusual events. CISA's guidance on phishing resistance and strong authentication provides an excellent framework that applies directly to Shopify store management.