Your Shopify store handles card data, customer PII, and third-party app integrations every day — and none of that is covered by Shopify's own security team. This guide breaks down what penetration testing for Shopify stores actually needs to cover, which test type to run first, and what most agencies skip.
Why this matters
Shopify secures its own platform. It does not secure your custom theme code, your third-party checkout apps, or the API connections between your store and your fulfilment, loyalty, or marketing tools.
That gap is exactly where attackers look first. A store that passes PCI DSS through Shopify Payments can still leak customer data through a poorly configured app or an exposed admin API key.
Merchants working toward Cyber Essentials for e-commerce and retail businesses run into this fast — the certification asks about boundary controls and patching that a pentest report actually evidences. Skipping the test doesn't remove the risk. It just means you find out about it from a customer, a bank, or a breach notice instead of a report.
Who this is for
This guide is for Shopify and e-commerce store owners, ops leads, and technical founders who process card payments, run custom apps or a headless frontend, and need to prove security controls to a payment processor, an insurer, or a Cyber Essentials Plus auditor. If your store is a stock Shopify theme with no custom code and no third-party checkout apps, your risk profile is lower — but not zero.
What to look for in penetration testing for Shopify stores
Scope that covers your actual attack surface
A generic "website pentest" quote usually means someone scans your storefront URL and calls it done. For Shopify, the real attack surface is checkout customisations, installed apps, admin permissions, and any API your store talks to. Ask for a scope document before you sign, not after.
Testers who understand Shopify's shared responsibility model
Shopify's PCI DSS Level 1 certification covers Shopify's own servers and payment processing. It does not extend to your custom Liquid code, your app stack, or a headless build on Hydrogen or a separate frontend. A tester who doesn't know this line will waste half your budget testing things Shopify already secures.
API and integration coverage, not just the storefront
Most Shopify stores run five to fifteen connected apps by 2026 — inventory sync, reviews, loyalty, email, fulfilment. Every one of those is an API call carrying customer or order data. A test that only hits the public storefront misses this entirely.
A report mapped to remediation, not just severity
A 40-page PDF of CVSS scores is useless to a small ops team. You need findings mapped to owners, fix windows, and retest dates. If how to interpret a penetration testing report sounds like a guide you'd need after the fact, that's a sign the report format matters as much as the test itself.
Retest included, not billed separately
A test that finds five critical issues and stops there hasn't finished the job. Confirm retesting is scoped into the price up front — some firms treat it as a separate engagement, which doubles your annual cost without warning.
Timing that lines up with your certification calendar
If you're working toward Cyber Essentials Plus, PCI DSS attestation, or an insurer's renewal, the pentest needs to land before that deadline, not after. Testing slots book out four to six weeks ahead during Q4 and Q1 renewal season.
Which test to run first — priority order
Web application and API penetration test — the non-negotiable
What it covers: checkout flow, custom Liquid code, admin panel access controls, and every API endpoint your store calls or exposes. This is where customer data actually moves.
One number that matters: most Shopify stores run more app integrations than they can name from memory — each one is a separate API surface a tester needs to probe. Verdict: Buy. This is the first test any Shopify merchant handling card data or PII should commission, full stop. See penetration testing for web applications and APIs for what a proper scope looks like.
PCI DSS-scoped test — the payment guard
What it covers: cardholder data flow, even if Shopify Payments handles the actual transaction. PCI DSS v4.0 requires annual penetration testing for merchants who touch card data directly, and "Shopify handles PCI" is not a full answer if you store, process, or transmit card data outside Shopify's hosted checkout.
Verdict: Buy if you process card data directly or run a custom checkout; Consider if you're fully on Shopify's hosted checkout with no custom payment code.
Cloud infrastructure test — the headless check
What it covers: anything hosted outside Shopify itself — a headless frontend on AWS, a custom app backend, or a data warehouse pulling order data. If your build is 100% Shopify-hosted theme, this test doesn't apply to you yet.
Verdict: Consider if you run headless or custom-hosted infrastructure; Skip if you're on a stock Shopify theme with no external hosting.
Vendor and app risk review — the blind spot
What it covers: the permissions and data access every installed app has. A loyalty app with write access to your customer database is a bigger risk than most merchants realise until someone maps it out.
Verdict: Consider annually, especially after adding three or more new apps in a year.
What to avoid
- A "full website scan" sold as a pentest. Automated vulnerability scanning is not manual penetration testing — it misses logic flaws like broken checkout discount stacking or admin privilege escalation.
- A tester who won't share the scope document before you sign. If they can't tell you what's in scope, they can't tell you what's out of scope either — and you'll pay for gaps later.
- Skipping the scoping conversation entirely. Buying a test off a price list without matching it to your actual stack wastes budget on things Shopify already secures and misses things it doesn't. How to scope a penetration test before you buy one walks through the questions to ask first.
Verdict comparison
| Test type | Covers | When you need it | Verdict |
|---|---|---|---|
| Web app and API test | Checkout, admin, custom code, APIs | Any store handling card data or PII | Buy |
| PCI DSS-scoped test | Cardholder data flow | Custom checkout or direct card processing | Buy / Consider |
| Cloud infrastructure test | Headless frontend, custom hosting | Non-standard Shopify builds | Consider |
| Vendor/app risk review | Third-party app permissions | 3+ apps installed, annual review | Consider |
Budgeting for any of these tests properly matters more than picking the cheapest quote — a scoped test that misses your app stack is money spent finding out nothing useful.
Automate the compliance side of your next pentest
OneClickComply handles evidence collection so audit prep stops eating your week.
Frequently asked questions
One last thing
The most common finding in Shopify-focused testing isn't in the theme code — it's an app with write access to customer data that nobody remembers installing. Run the vendor and app permissions review even if you skip everything else this year.