In October 2026, a handful of Shopify apps had their settings changed by unauthorized people, and some shoppers who clicked Checkout were sent to a look-alike payment page before landing on the real one. The reassuring part is that the Shopify checkout redirect check takes about five minutes, and the apps involved responded quickly. Here is what is known so far, how to test your own store, and a few habits that keep it tidy.

In this article

What happened

On October 10, developer Roman Zipp was shopping on an online store when the checkout page asked his password manager for card details in the wrong field. He looked at the address bar, saw an unfamiliar domain, and traced the redirect back to an app called Hulk Product Options.

In the days that followed, Selleasy and Swym Wishlist Plus each described incidents of their own, and merchants reported a few more apps, some of which are still unconfirmed. Each vendor said unauthorized changes had added storefront code. Shopify has not said that its own checkout was breached. As far as the public record shows, the entry point was the app settings, not the store theme.

How the redirect worked

Many Shopify apps let a merchant add custom JavaScript or custom labels in the app’s own dashboard. The app’s storefront code then asks the vendor’s server for those settings every time a page loads, and runs what comes back.

In the Hulk case, Zipp found roughly 22.7 KB of JavaScript inside that response. The script waited for a click on Checkout, sent the shopper to a look-alike page, and then forwarded them to the real checkout, so the order still went through. It only ran once per browser session, which is why store owners testing their own site often saw nothing unusual.

Because the code arrived from the vendor’s server, the theme files themselves looked clean. That is the main reason a quick theme scan can miss it.

Test your checkout in five minutes

  1. Open a fresh private browser window.
  2. Add any product to the cart.
  3. Click Checkout and read the address bar. You should be on your own domain or Shopify’s checkout, nothing else.
  4. Repeat in a second private window and once on your phone. The script ran once per session, so one clean test is not the full picture.
  5. Clear the browser’s site data between tests, since app settings can be cached.

If you land on an unfamiliar domain, especially one ending in .top, stop there and see the section below.

Review your installed apps

Open Settings, then Apps and sales channels, and go through the list.

  • Remove apps nobody uses. Fewer apps means fewer places for code to live.
  • For each app that touches the storefront, open its own dashboard and look for Custom JavaScript or Custom HTML fields. Clear anything you did not add yourself.
  • In the theme editor, open App embeds and switch off the ones you do not need.
  • Remove old staff and contractor accounts.
  • Turn on two-step sign-in for Shopify, the email behind it, and every app account that offers it.

What Shopify and the vendors did

Shopify’s changelog on October 20 announced that online stores now ask customers to confirm before sending them to a website outside the store. Shopify also published guidance for app developers called Securing your app, together, asking for two-step sign-in, expiring access tokens and regular endpoint scans.

The vendors moved quickly too. HulkApps removed the unauthorized code and hired an independent security firm. Selleasy said it fixed the cause within hours and later passed Shopify’s security checks and returned to the App Store. Swym paused its app for all merchants while it added protections. These are the companies’ own statements, so it is sensible to read each vendor’s incident page before reinstalling or re-enabling an app.

If you spot an unfamiliar page

  1. Do not enter card details.
  2. Note the full address and the time, and take a screenshot of the address bar.
  3. Contact Shopify Support and the developer of any app you recently installed or updated.
  4. Change your Shopify and app passwords, and turn on two-step sign-in.
  5. If a shopper typed a card number into the page, they should contact their card issuer.

A simple monthly habit

  • Weekly: run the private-window checkout test from two devices.
  • Monthly: review installed apps and their custom-code fields.
  • Quarterly: remove old staff access and review sign-in settings.
  • Before installing a new app: read the permissions it asks for and who can change its code.

A calm, regular check like this catches most surprises early. If you would like a second pair of eyes on your store or hosting, visit expertwebdeveloper.in or get in touch through this site.

Sources

Also published on expertwebdeveloper.in, dev.to, Medium, Substack and LinkedIn.