Shopify App

SiteGuarding Store Scanner for Shopify

See what really runs on your storefront. The scanner opens your pages like a visitor and reads your theme files, and tells you about hidden links, injected scripts, card forms and Checkout buttons that lead somewhere else.

Last Update: 28 Oct 2026

Status: In development. Join the list below and we will write to you when the app is in the Shopify App Store.

Security scanning for Shopify stores

Most Shopify stores are attacked through the code that runs on the storefront, not through the server. In 2026 several widely used apps were used to change storefront code on the stores that had them installed, and the files of the theme never changed. A merchant usually finds out when a customer complains, or when a card issuer does.

SiteGuarding Store Scanner looks at your store the way a visitor's browser does. It opens your pages in a real browser, records every script that runs and every address those scripts talk to, and compares the result with your theme files and with the previous scan. Then it tells you, in plain words, what changed and what looks wrong.

The app only reads. It never changes your theme, never blocks a visitor, and asks for one permission only: to read your theme files. It does not see your orders, your customers or your payouts.

How it works

1. You install the app and turn the scan on. Installing alone does not start anything: you choose which pages we open, how often, and whether we check the path to Checkout. Nothing is scanned until you say so.
2. We open your pages in a real browser. One page of every type, then more, up to the limit of your plan. No more than one request per second, no forms are ever submitted, and our visits are kept out of your analytics and ad data.
3. We read your theme files through the official Shopify API, including the themes you have not published.
4. You get a report. Every finding says what we saw, on which page or in which file, why it matters and what to do next. If you recognise something as your own work, mark it and we will not ask again.

Main Features

Hidden links and spam text. Links and blocks of text that a visitor cannot see, placed in your pages to promote someone else's website, with the reason they are hidden.
Injected and obfuscated JavaScript. Code that hides what it does, builds itself at runtime or is added to the page by another script after it loads.
Card skimmers. Scripts that read payment or contact fields, encode what visitors type and send it to another server, on pages where no payment form should exist at all.
Fake payment forms. A card number field together with a security code or expiry date on a storefront page. Shopify never collects card details there.
Checkout redirects. We click the Checkout button and record where it leads, then stop before the page loads. If it does not lead to your own checkout, you hear about it the same day.
Every external domain on your store. Which scripts come from where, how much JavaScript each provider adds and which app brought it, with a note when a domain is new since the last scan.
Theme file changes. Added, changed and removed files since the previous scan, including themes you have not published, so an edit nobody remembers making does not stay unnoticed.
Code in theme settings. Sections and app settings that hold code are checked too: a script pasted into a Custom Liquid block runs exactly like a theme file.
Leftovers of apps you removed. Snippets and includes left behind in the theme by apps that are no longer installed, with the app they belong to.
Secrets left in the code. API keys and access tokens written into a theme file or a page, where anyone can read them.
Outdated JavaScript libraries with publicly known security issues, with the version to update to.
Insecure and redirecting pages. Resources loaded over plain http on a secure page, and pages that try to send your visitors to another website.
Your domain's reputation and email records. Blacklist checks, and SPF and DMARC records, so a problem with your domain does not reach your customers' inboxes first.
Alerts you will actually read. Email, Slack and Shopify Flow, with a daily summary instead of one message per finding.
An honest report. The report always says what was checked and when, and which pages or files could not be read. Silence never means "clean".

What the app does not do

It does not block visitors, bots or countries, and it is not a firewall. Shopify runs its own protection at that level.

It does not change or repair your theme. We tell you what to fix and where; our security team can do the work for you.

It does not see orders, customers, payments or payouts, and does not ask for permission to.

It cannot look inside Shopify's own checkout pages: those are Shopify's, not your store's.

It is not a complete malware scan of everything that ever runs: a scan reports what our browser saw on the pages it checked, at the time it checked them.

Plans

Billing goes through Shopify, so the price appears on your Shopify invoice, in USD. Prices below are per month; paying for a year gives two months free.

	Free 0 USD	Starter 19 USD a month	Pro 49 USD a month	Business 99 USD a month
Pages per scan	25	250	1,000	5,000
Pages opened in a browser	5	20	50	50
Automatic scan	manual, once a week	daily	daily	daily, key pages hourly
Checkout path check	-	-	4 times a day	hourly
Critical and high findings	all, in full	all	all	all
Medium and low findings	count and first 5	all	all	all
Theme files	published theme	all themes, with changes	all themes, with changes	all themes, with changes
History	last scan	90 days	12 months	12 months
Alerts	-	email	email, Slack, Flow	email, Slack, Flow
Report	on screen	PDF, CSV	PDF, CSV	PDF, CSV, white label
Domain and email records	once	weekly	daily	daily
Support	help pages	email	email, priority	email, priority

A finding that matters is never hidden behind a price. On the free plan you see every critical and high finding in full; the paid plans add depth, frequency, history and detail on the smaller findings.

Be the first to know

The app is going through Shopify's review. Leave your email and we will write to you once, when it is available in the Shopify App Store. No newsletter.

You are on the list. We will email you once, when the app is available in the Shopify App Store.

Already have a problem?

If your store is behaving strangely, if customers report payment problems, or if a browser or a card issuer has flagged your shop, our security team can audit your store and clean it by hand. We have been doing this since 2008, for more than 250,000 websites.

Contact our security team

FAQ

Does the scan slow down my store?

No. The app adds no code to your storefront. The scan is a handful of page visits, no more than one per second, and you choose when they happen.

Will the scan show up in my analytics or my ad reports?

No. Analytics and advertising pixels are stopped during the scan, so our visits do not reach your reports or your ad optimisation.

Does the app place test orders?

No. The scanner never submits a form and never places an order. For the optional Checkout check it adds one item to a cart, clicks the Checkout button, records where the button leads and stops before the page opens.

What permission does the app ask for?

One: read access to your theme files. Nothing else. No orders, no customers, no payments.

What happens to my data if I uninstall?

Everything we hold about your store is deleted. Shopify also tells us to delete it, and we do that within 30 days at the latest.

Can it find everything?

No, and we will not pretend otherwise. The report tells you what was checked and when, and lists the pages and files it could not read.

My theme is a paid one with many apps. Will there be a lot of false alarms?

The scanner knows the domains of the common Shopify apps and services and treats them differently. When something is your own work, mark it once and it will not come back.