Shopify store security guide
Published 4 Nov 2026 · Updated 2026-11-04
Shopify keeps its own platform patched, so there is usually no Shopify CVE for you to fix. The risks that remain are yours: apps with access to customer data, old JavaScript libraries in your theme, staff accounts without two-step login, and an email domain that scammers can spoof to phish your customers. Setting DMARC to quarantine or reject is often the quickest win.
Who this is for: Australian direct-to-consumer and subscription brands selling on Shopify. Written by our collective of Melbourne web and app developers; facts checked against NVD, the CISA KEV catalog and vendor advisories on 2026-11-04. Free to use and share.
Book a free stack check Already breached? First steps
Supported versions
Shopify (hosted)
Shopify is a fully hosted platform: Shopify patches the servers and core checkout, so there is no platform version for you to update. Your responsibility is the theme code, installed apps, staff accounts and your email domain.
Source: Shopify (hosted) official lifecycle (checked 2026-11-04).
jQuery
jQuery 3.5.0 (April 2020) fixed the two widely flagged XSS issues below. Many older CMS themes still load jQuery 1.x, 2.x or 3.0 to 3.4 from a CDN; the version is visible in the script URL.
Source: jQuery official lifecycle (checked 2026-11-04).
DMARC set to p=none and email spoofing
What the issue is
DMARC is a DNS record that tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM checks. A policy of p=none only asks for reports; spoofed messages are still delivered.
Why it matters
Online stores send order confirmations, shipping updates and refund notices, so customers expect email from your domain. Scammers exploit that trust with fake invoices, refund and delivery messages that look like yours. Without an enforced DMARC policy, those messages can land in customers' inboxes and the fraud and reputational damage lands on you.
How to fix it
- List every service that sends email as your domain (store platform notifications, email marketing, help desk, your mailbox provider).
- Publish one SPF record that includes those senders and ends in -all or ~all; keep it under the 10 DNS lookup limit.
- Turn on DKIM signing in each sending service and publish the DKIM keys it gives you.
- Keep DMARC at p=none with a rua= reporting address for a few weeks and check that all legitimate mail passes.
- Move to p=quarantine, then p=reject once reports are clean, and keep monitoring the reports.
- Follow the ACSC's email security guidance, and report spoofing campaigns to ReportCyber.
Sources: ACSC: How to combat fake emails · CISA: Email authentication (BOD 18-01) · RFC 7489: DMARC
Key high and critical CVEs for this stack
These are recent high or critical vulnerabilities. "KEV" means CISA lists it as known to be exploited in the wild.
| CVE | Component | Affected | Fixed in | CVSS | KEV |
|---|---|---|---|---|---|
| CVE-2020-11023 | jQuery: XSS when HTML containing <option> elements from untrusted sources is passed to DOM manipulation methods | 1.0.3 up to (not including) 3.5.0 | 3.5.0 | 6.1 (CVSS 3.1, NVD) | Yes (added 2025-01-23) |
| CVE-2020-11022 | jQuery: XSS when untrusted HTML, even after sanitising, is passed to .html(), .append() and similar | 1.2 up to (not including) 3.5.0 | 3.5.0 | 6.1 (CVSS 3.1, NVD) | Not listed |
How attacks on this stack typically work
- Phishing emails that spoof your domain ("your subscription payment failed") trick customers into handing over card details; a DMARC policy of p=none does not stop them.
- A compromised staff or agency account is used to add scripts to the theme or export customer lists.
- A breached third-party app leaks the customer, order or subscription data it was granted access to.
- Old JavaScript libraries in custom theme code can carry known XSS bugs, such as jQuery before 3.5.0.
Patch and hardening steps
- Find your exact versions. In Shopify Admin, Online Store → Themes shows your theme and its version; Settings → Apps lists every installed app and what data it can access. For theme JavaScript libraries, ask your developer which versions the theme loads.
- Back up first (files and database), and keep the backup off the server.
- Shopify (hosted): no customer-side patch to apply; review the settings, apps and accounts you control.
- Update jQuery to at least: 3.5.0. Move off any end-of-life branch.
- Remove unused plugins, apps, themes and accounts, and turn on automatic updates for minor and security releases where available.
- Lock down admin: Require two-step authentication for every staff account (Settings → Users), remove ex-staff and agency accounts, and uninstall apps you no longer use.
- Check for signs of compromise after patching a KEV-listed flaw: unknown admin users, unexpected new files on the server, changed checkout or header scripts.
- Follow a patching cadence. The ACSC's Essential Eight treats patching applications as a core mitigation.
What this means for your industry
Online stores hold customer names, addresses, phone numbers and order history, which is personal information under the Privacy Act. If a breach is likely to cause serious harm, you may need to notify customers and the OAIC: see what to do after a data breach.
Melbourne or Victorian public-sector supplier? See Melbourne and Victorian breach contacts. We will cover reported incidents involving these technologies in our Australian breach news.
Want a second pair of eyes on your stack?
Book a short call and one of our developers will talk through your versions and patch plan. No pressure, no scare tactics.
Frequently asked questions
Do I need to patch Shopify?
No. Shopify is hosted and Shopify applies platform security updates. You are responsible for your theme code, apps and accounts. Source
What is DMARC and why does p=none matter?
DMARC tells receiving mail servers what to do with email that fails SPF and DKIM checks for your domain. p=none only monitors; quarantine or reject actually blocks spoofed mail. The ACSC recommends configuring SPF, DKIM and DMARC. Source
Should staff use two-step authentication?
Yes. Shopify supports two-step authentication for every account and store owners can require it. Source
I think customer data was exposed. What first?
Secure staff accounts, review app access, report to the ACSC and assess whether the Notifiable Data Breaches scheme applies. Source
Related stack guides
- Drupal and PHP stack breach guide
- Adobe Commerce (Magento) and PHP stack breach guide
- Next.js, React and Node.js stack breach guide
- PHP + WordPress stack breach guide
- Silverstripe CMS, PHP and jQuery stack breach guide
- Webflow and hosted CMS security guide
- WordPress, PHP and Node.js stack breach guide
- WooCommerce, WordPress and PHP stack breach guide
- All stack security guides
Sources
- www.shopify.com/security
- github.com/jquery/jquery/security
- nvd.nist.gov/vuln/detail/CVE-2020-11023
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023
- github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6
- blog.jquery.com/2020/04/10/jquery-3-5-0-released/
- nvd.nist.gov/vuln/detail/CVE-2020-11022
- help.shopify.com/en/manual/your-account/account-security/two-step-authentication
- www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/email-hardening/how-combat-fake-emails
- www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight
General information only, not legal or professional advice. Versions and CVEs change quickly; always confirm against the vendor before acting.