Shopify Checkout Hijacked? How to Stop It and Recover

Explore this post with:

October 18, 2026

8 min read

Maintenance

To stop a Shopify checkout hijack, you have to control what runs on your storefront before the shopper reaches checkout. Shopify's own checkout pages are locked down and sandboxed. Hijacks happen one step earlier, on your product and cart pages, where app scripts can catch the click on the checkout button and send the shopper somewhere else. The fix is to limit those scripts, watch them, test your checkout path on a schedule, and have a response plan ready.

On October 10, 2026, a developer in Germany spotted a fake checkout page while buying from a Shopify store. It took him about three hours to reach the store owner, the app developer, an abuse desk and finally Shopify. Once Shopify escalated the report, the hijack on that store was fixed in 16 minutes. Most of the delay was finding who could stop it. This guide closes that gap.

For the background on the October attack, read Was Shopify Hacked? The October 2026 Checkout Hijack. For logins and staff access, start with our guide to protecting your Shopify store from hackers. This post covers one thing: keeping your checkout path clean, and what to do when it isn't.

How Scripts Reach Your Checkout Path

The checkout path is every page and click between "add to cart" and Shopify's checkout: product pages, the cart page, cart drawers, upsell popups and the checkout button. Shopify doesn't sandbox these pages, so any script loaded on them can change what the checkout button does.

Scripts get there in four main ways:

1. App embeds. Most storefront apps load through theme app extensions, switched on in the theme editor under App embeds. They run on every page unless the app limits itself.
2. Code fetched at page load. Some apps load a small file that then downloads more code from the developer's own servers. In October, that second download is what attackers replaced. It never appears in your theme files and can change without an app update.
3. Custom JavaScript fields. Some apps let you paste code into their settings. Anyone with access to the app's dashboard or internal tools can change it.
4. Theme code and tag managers. Scripts in theme.liquid or a tag manager run everywhere and are easy to forget.

Watch apps that replace your checkout button with their own JavaScript, such as cart drawers, upsell tools and "buy now" buttons. They need to run code when the shopper clicks, and that's exactly the position a hijack needs.

Checkout Extensibility and Sandboxed Pixels

Shopify has closed the checkout itself to outside code. Knowing what's protected tells you where to focus.

According to Shopify's developer documentation, checkout.liquid is no longer supported for the information, shipping and payment steps. It was retired on the Thank you and Order status pages on August 28, 2025, and script tags were retired there for non Plus stores on August 26, 2026. Tracking code now lives under Settings, then Customer events, where pixels run in a sandbox that can't reach the main page.

If old tracking code is still pasted into your theme files, move it to Customer events. Just remember the gap: Checkout Extensibility protects checkout, not the product and cart pages before it.

Blocking Redirects and Monitoring Scripts

Here's the honest part: no Shopify setting stops a script on your storefront from sending a shopper to another domain. Security headers can limit where scripts load from, but in October the bad code came from the apps' own approved servers. Control comes from three habits: fewer scripts on the checkout path, a record of what should be there, and alerts when that changes.

Cut scripts from the checkout path

• Keep Shopify's standard checkout button where you can, so it submits to your store's own cart and checkout addresses.
• Limit app embeds to the pages that need them. A reviews app has no reason to run on the cart page.
• Remove custom JavaScript from app settings unless someone can explain every line.

Keep a script inventory

Open your product page and cart, press F12 to open developer tools, go to the Network tab, filter by JS and reload. Write down every domain that loads a script. That's your baseline. Check it monthly and after every app install or update. A new domain on the cart page that nobody can explain is your first warning sign.

Set up automated monitoring

A scheduled browser test can add a product to the cart every hour, click checkout and confirm the final address belongs to your store or Shopify. If it lands anywhere else, you get an alert. For a store doing $500K or more a year, a few hours of exposure costs far more than monitoring.

A Checkout Testing Routine That Catches Hijacks

The October script fired once per browser session, so a single test often showed nothing. Test like a new shopper, every time.

Weekly Checkout Test

• Use a fresh private window for every run.
• Test on desktop and on a phone, since many apps load different code on mobile.
• Try every path to checkout: cart page, cart drawer, buy now buttons and upsell popups.
• Read the address bar on the payment step. It should show your domain or a shopify.com address.
• Watch your password manager. If it offers card details on an unfamiliar domain, stop.
• Compare scripts in the Network tab against your baseline.
• Repeat the test within an hour of any app install, app update or theme change.
• Log the date, device and result. If something goes wrong, your log tells you how far back to look for affected orders.

Your Response Plan if Your Checkout Is Hijacked

Write this plan down now and share it with whoever runs your store when you're away.

First hour: stop the damage

1. Turn on your store password under Online Store, then Preferences, so new shoppers can't reach the hijacked path.
2. Save evidence first. Screenshot the fake page and its address, and note the time.
3. Turn off app embeds one by one, starting with apps that touch the cart or checkout button. Test after each change.
4. Publish a clean theme copy from before the problem if you can't find the cause quickly.
5. Contact Shopify Support with the fake domain, your screenshots and the apps you suspect.

Same day: find the scope

1. Set your exposure window, from your last clean test to the moment you turned on the password.
2. Pull every order and abandoned checkout from that window and mark those paid by typed card. Shop Pay, PayPal and Apple Pay don't pass card numbers through the page.
3. Ask the app developer what changed, when, and which stores were affected.
4. Change passwords on Shopify and every app dashboard, and report the fake domain to Google Safe Browsing.

Before you reopen

• Run your full checkout test on several devices and confirm scripts match your baseline.
• Confirm with Shopify Support that it's safe to trade. In October, Shopify asked at least one affected store to stay closed until the investigation ended.

Notifying Customers After a Hijack

Tell affected customers within days, and tell them plainly to contact their card issuer and watch their statements. Customers who hear it from you first are far less likely to dispute your charge.

• Who: every customer who paid by typed card or started checkout during the exposure window.
• What to include: the date, what happened in one or two sentences, what may have been exposed, what they should do, and a real person to reply to.
• What not to say: don't promise "no data was taken" if you don't know, and don't name the app until the developer confirms it.
• Legal rules: all 50 US states have breach notification laws, some with deadlines as short as 30 days. In Canada, breaches with a real risk of significant harm must be reported to the Privacy Commissioner and affected people. Check with a lawyer.

Handling Chargebacks After a Hijack

Most hijacked orders were real purchases through your real checkout, and stolen cards are usually used on other sites. Disputes still come from customers who see your name next to charges they don't recognize.

• Respond to every dispute from your Shopify Payments page before the deadline shown.
• Send strong evidence: order confirmation, tracking, the matching billing address and your messages with the customer, including your notification email.
• Refund when it's fair. A refund costs less than a lost dispute and its fee.
• Watch your dispute rate for 90 days, and keep notes that link any spike to the incident.

How Proactivo Commerce Helps

We audit the apps and scripts on your checkout path, remove what doesn't need to be there, move tracking into sandboxed pixels, set up checkout monitoring and write a response plan your team can follow on the worst day.

Proactivo Commerce is an official Shopify Partner that has worked with US brands for 6 years, delivering 500+ Shopify projects for 400+ DTC brands with 400+ five star reviews. See our work or hear it from our clients.

Close the Gap Before Checkout

Shopify locked down its checkout. The pages before it are still yours to protect. A script inventory, a weekly test and a written response plan would have cut the October exposure from hours to minutes for most stores.

Want us to check your checkout path? Book a free discovery call, and we'll show you which apps and scripts we'd remove, monitor and fix first.

Book Your Free Discovery Call