Shopify runs your checkout. Your pixels, apps and theme are still yours.
Shopify's PCI validation covers Shopify. The pages your shoppers browse, the apps and pixels on them, and the cart page they leave from are yours, and they change every week. Store Health reads them from outside and tells you which changes could lead to a privacy complaint, leaked customer data or stolen card details.
Paste your URL. About 20 seconds. No account, no card. Nothing to install.
What the checkout walk reads on Shopify
On Shopify, checkout runs on Shopify's own servers. What you control is your cart page, the doorway your shoppers leave from, so that is what we read. We stop there and never open Shopify's checkout.
Once your checkout path passes its test, every check walks it, on Free and Pro. We ask your approval before the first walk, and you can turn it off.
Shopify's validation stops at its checkout
The payment form sits inside Shopify's PCI-validated environment. The pages that lead your shopper to it, and where those pages send them, are still yours.
What goes wrong on Shopify, and what we read for it
The same six areas as on every platform, in the order they matter most here. Each check is compared with your previous check, and each change is ranked Should check, Good to check or Recorded only.
- Consent before tracking. Whether trackers, such as ad pixels and session recorders, run before shoppers agree to them.
Read on every check, on every plan.
- Security settings. Whether your pages tell browsers which scripts may run and which sites may embed them, and whether your login cookies can only travel over an encrypted connection.
- Connection encryption. Whether your store accepts only modern encryption, with a valid certificate.
- Software updates. Whether the software your store's pages name, WordPress, its plugins and themes, and JavaScript libraries, has a published security vulnerability.
Read on every check, on every plan.
- Checkout scripts. Each script that runs where shoppers pay or start to pay, and whether we can name where it comes from.
- Tamper monitoring. Whether a tool watches your payment page and reports changes that you did not make.
Read on every check, on every plan, once your checkout path has passed its test.
From the blog, for Shopify stores
Shopify Fires Your Pixels Before Consent by Default. The Fix Is Hidden.
Shopify app pixels and custom pixels send data before a shopper answers your cookie banner, even when permissions look required. How to check, and the hidden fix.
Is Shopify PCI Compliant? Yes. Your Store Isn't Covered
Shopify is PCI DSS Level 1, but that attestation covers Shopify, not your store. What Shopify handles, which SAQ you file, and what stays your job.
What Scripts Are Running on Your Shopify Store? How to Get the Full List
Shopify has no single screen that lists every script on your store. Here's where they actually come from, and how to get a complete inventory.
Meta Pixel, TikTok and Your Cart Page: Tracking Before Consent
Meta and TikTok's richest events are built for the cart and checkout, and many store pixels do not wait for the cookie banner. What each event carries, and how to check.
Questions Shopify merchants ask
Shopify is validated as a PCI DSS Level 1 service provider. That covers Shopify's systems: the checkout and the card data it handles. Your store's theme, apps, pixels and the pages that lead to checkout are not inside that validation. They are yours to watch, and the self-assessment is yours to file.
Run it on your Shopify store
About 20 seconds, no account. You get the list of what we found.
CyberShield Studio monitors and reports; it does not certify compliance or replace a QSA, ASV, or legal counsel.