A New Script Appeared on Your Store. Would You Know?

A script is a piece of code your store loads, usually from someone else's server, that runs in your customer's browser. New ones arrive on their own: an app update, a theme edit, a tag added in a marketing tool, an agency deploy on a Friday afternoon. Nothing breaks when one appears. Nobody emails you.

Which makes the useful question a different one from the one merchants usually ask. Not what is running on my store. What is running that was not running last week.

I have spent thirty years in security and hold CISSP and PCIP certifications. The single most common thing I find on a merchant's store is code the merchant cannot account for. Not malicious code, usually. Just code nobody remembers approving.

What is drift, and how is it different from being hacked?

Drift is an unintended change to your storefront, measured against the same store at an earlier point in time. Three things have to be true. There is a baseline to compare against. Something moved away from it. And nobody told you.

Remove any one of those and it is not drift. A change you approved is a deployment. A difference with nothing to compare against is just a description of your site today.

Being hacked is someone breaking in. Drift is your own stack changing underneath you, through doors you opened on purpose. The second is far more common, and it is the one nobody monitors.

How does a new script end up on your store without you approving it?

Five routes, and only the first involves you clicking anything. You install an app. An app updates itself and brings a new vendor along. Someone edits the theme. An agency deploys. Or a tag gets added in a marketing tool by someone who has never seen your codebase.

The self-updating app is the one that surprises people. You vetted the app in 2024. The vendor it now loads from was added in an update you never saw, because you agreed to automatic updates, which was the sensible choice.

Tag managers are the sharpest version of this. The entire point of one is to let marketing add tracking without touching code, which works. It also means a tag can land on your checkout without a single person who writes software ever seeing it.

How much third-party code is normal?

More than most merchants expect. The HTTP Archive Web Almanac's 2025 Third Parties chapter found that at least 90% of pages load code from at least one third party, and the median page makes 83 third-party requests on desktop.

Those are individual HTTP requests, not 83 separate scripts. Images, fonts and tracking beacons all count, and the number is easy to overstate.

Third-party code is the normal condition of a modern store, not an edge case. Which is why "we do not really use third-party scripts" is almost never true when you go and look.

Why doesn't anyone tell you when it happens?

Because no part of your stack owns that job. Your platform tells you about orders, your host tells you about downtime, and each app tells you about itself. A new script belongs to none of those categories, so it produces no notification anywhere.

Nothing looks wrong, either. The page loads. Checkout works. Analytics keep reporting. A new script is invisible from the shop floor, and the only place it shows up is in the page your customer's browser actually assembled.

That is the failure mode worth naming: it is not that the alert is ignored. There is no alert.

How do I see what is running on my store right now?

Load one page of your store the way a shopper does and list every third-party service it pulled in. Our free Webpage Security Checker does this from outside your store, with nothing installed and no account. You can also do it by hand in your browser's developer tools, under the network tab.

Start with your homepage, then your cart. If you take card details on your own domain rather than through a hosted checkout, check that page too, and read what PCI DSS v4 expects of payment-page scripts before you do.

The first list is not the point. The comparison is. A single inventory tells you what runs today, which quietly argues that you are finished. You are not finished until you have two lists from different days.

Which changes actually matter?

Most do not, and treating every change as an emergency is how people stop reading alerts. Three cases deserve attention the day you see them.

Anything new on the page that takes card details. That is the page an attacker wants, and a script there can read what a customer types. Magecart attacks work exactly this way.

Data going somewhere you do not recognise. A vendor domain you cannot name is worth ten minutes. Our free Website Tracking Checker lists where a page sends data before a shopper answers your cookie banner, which is its own problem on Shopify.

A script that lost its integrity check. If a script used to carry a hash proving it had not been altered and now does not, the code you vetted is not necessarily the code running. That is the mechanism behind most supply chain attacks.

Everything else goes in a list you review when convenient. A new font from a CDN is not worth your Tuesday.

How often should you check?

Weekly, for most stores. That is roughly how often apps update and agencies ship, so a slower cadence means you are routinely looking at a store that has already moved. Check more often if your storefront changes constantly, if you run a lot of apps, or if card details are entered on your own domain.

The honest reason to automate it is that manual checking does not survive a busy month. A calendar reminder loses to a product launch every time.

What to do this week

Three steps. None of them take longer than a coffee.

1. Get today's inventory. Run the Webpage Security Checker on your homepage and your cart page.
2. Read the list properly. Name the vendor behind every entry. The ones you cannot name are your real work.
3. Set up the comparison. Whether that is a recurring reminder or an automatic weekly check, the value only starts on the second run.

The part that is easy to get wrong

You can do all of this today and be out of date by next month. That is not a failure of the check. It is the nature of a storefront that a dozen systems are allowed to modify.

This is your store today. App updates, theme edits and new agency work change it — usually without anyone telling you.

A one-off scan argues against itself by looking complete. Run the free check, verify your domain, and keep it running. The first report tells you where you stand. The ones after it tell you what moved.

Dennis Wu is a certified security and PCI professional (CISSP · PCIP) with over 30 years in the field, working with ecommerce merchants in the $1M–$50M range who have no in-house security team. Want a second opinion on what your own inventory turned up? Get in touch or see what a monitored plan covers.