What Shopify covers and what's on you
As a hosted platform, Shopify handles hosting, updates, checkout security and the processing of card data. There are no outdated server plugins or exposed databases like in a self-hosted setup. That removes a large share of the classic ecommerce risks.
What stays on your side is people and decisions: who has access to the admin and with which permissions, which apps have access to your data, what code gets added to the theme and how you review orders before shipping them. That's where real problems usually happen.
Two-step authentication and access
The most effective measure is having every account use two-step authentication. Shopify offers an authenticator app, security keys and passkeys; SMS can no longer be set up as a new method. Keep your recovery codes somewhere safe, because they're what lets you in if you lose your phone.
Each team member turns it on in their own account, since the owner can't do it for others. On Shopify Plus, the organization can require a secure login method for all users. Shopify Payments also requires two-step authentication to be turned on; without it, payouts can be held.
- One user per person, never shared accounts
- Two-step authentication on every account
- Roles with the minimum permissions needed
- Collaborators removed at the end of each project
- Regular review of the login history
Apps: the most neglected area
Every app you install asks for permissions over parts of your store: products, orders, customers or the theme. Before installing, read which permissions it requests and whether they make sense for what it does. A reviews app shouldn't need full access to customer data.
Uninstall apps you no longer use. Beyond removing access to your data, uninstalling doesn't always remove the code the app added to the theme, so check the files and app blocks after removing it. That cleanup also improves store speed.
The theme and third-party code
Every script you add to the theme runs in your customers' browsers. Pixels, chats, widgets or snippets copied from a tutorial can load third-party resources you don't control. Keep an inventory of what's in the theme and who put it there.
The same applies to code access. If an agency or a developer works on the theme, they should do it with their collaborator account and on an unpublished copy, not directly on the live theme. That way every change has an author and a date, and you can review the result in preview before your customers see it.
Before publishing major changes, work on a copy of the theme and keep versions. Shopify keeps a version history of theme files, but duplicating the theme before every big change is the fastest way to roll back if something goes wrong.
Fraud analysis on orders
Shopify analyzes online orders paid by card and shows fraud indicators from the Basic plan up: address verification (AVS), CVV match, the customer's location compared with the payment method, unusual device or network activity and multiple attempts with different cards.
In addition, on the Grow plan or higher, or if you use Shopify Payments, each eligible order gets a low, medium or high risk recommendation. Medium and high risk orders are flagged in the orders list, and the order page suggests what to do: fulfill it, confirm with the customer or consider canceling. Look at the overall recommendation rather than a single indicator, because one alone doesn't determine the risk.
What to do with a suspicious order
If an order comes up as high risk, don't ship it without reviewing it. Contact the customer, compare the shipping address with the billing address and look for signs like freight forwarding addresses or several orders in a row with different cards. If you can't verify it, cancel and refund: it's far cheaper than losing the merchandise and paying the chargeback.
To buy time, you can set up manual payment capture: the payment is authorized when the order is placed but not charged until you approve it. With Shopify Flow, which is free on Basic, Grow, Advanced and Plus, you can automate alerts or tags so high-risk orders are reviewed before they reach the warehouse.
Frequently asked questions
Is Shopify secure for an online store?
The platform handles hosting, updates, SSL and checkout security. What depends on you is accounts, permissions, installed apps and order review.
What is Shopify fraud analysis?
It's the automatic review of card orders. It shows indicators from Basic up and a low, medium or high risk recommendation from Grow up or if you use Shopify Payments.
What should I do if an order shows high risk?
Don't ship it without checking. Contact the customer and, if you can't verify it, cancel and refund. Manual payment capture gives you room to review before charging.
Is two-step authentication mandatory on Shopify?
It's required to get paid through Shopify Payments without holds, and Shopify can require it on some accounts. On Plus, the organization can enforce it for all users.