How to Check if Your Shopify Store Was Affected by the App Checkout Hijack

To check if your Shopify store was affected by the October 2026 app attacks, do five things: test your checkout in a clean private browser window, check your theme’s app embeds, review any app setting that accepts custom code, search your theme code for unexpected changes, and tighten passwords and staff access. If you find anything, password-protect your store, keep evidence, and contact Shopify Support and the app developer. The whole check takes about 30 minutes.

For background on what happened, read our summary of the October 2026 attacks. In short: attackers used several apps to send some shoppers to fake checkout pages on web addresses ending in .top, then on to the real checkout. The code only fired once per browser session, so a quick look at your own store can easily miss it. The steps below are built around that.

Step 1: Test your checkout properly

Because the redirect fired only once per session, test from a fresh start each time.

1. Open a new private or incognito window, with browser extensions turned off.
2. Go to your store, add a product to the cart, and click Checkout.
3. Look at the web address on the checkout page. It should be your own domain or one ending in myshopify.com. Anything else, especially an address ending in .top, is a red flag.
4. Repeat on your phone, and through every route to checkout your store has: the cart page, the cart drawer, and any “buy now” button.

If you or your developer are comfortable with browser tools, open the developer tools on your store and check Session Storage and Local Storage for keys starting with __ctf_. In the Network tab, filter for “.top”. Security firm cside reported both as signs of this attack.

Step 2: Check your app embeds

In your Shopify admin, go to Online Store, then Themes, then Customize, and open App embeds.

• Make sure you recognise every embed that is switched on.
• Switch off any embed from an app you no longer use or don’t recognise.
• If you use Hulk Product Options, Selleasy or Swym Wishlist Plus, follow the developer’s latest notice before switching its embed back on. Swym specifically asked merchants to turn off its embeds while it restores service.

Step 3: Review app settings that accept custom code

In this attack, the malicious code was loaded through app settings that accept custom JavaScript or HTML. Open each app you use and look for fields named things like “Custom JS”, “Custom code”, “Advanced settings” or “Custom HTML”.

• Take a screenshot of each one first, so you have a record.
• If a field has code you didn’t add, or don’t recognise, don’t delete it yet. Screenshot it and contact the app developer.
• If you never use the field, ask the developer whether it can be turned off.

Step 4: Search your theme code for changes

In the second wave against Swym Wishlist Plus, theme files were edited directly. Swym asked merchants to search their theme code for “checkout-guard”.

1. Go to Online Store, then Themes. On your live theme, open the menu and choose Edit code.
2. Use the search to look for “checkout-guard” and “.top”.
3. Open any file that shows recent changes you didn’t make. Shopify keeps older versions of theme files, so you can compare and roll back.
4. Also look for leftover code from apps you’ve uninstalled. Removing an app doesn’t always remove its code from your theme.

Step 5: Lock down passwords and access

• Change your Shopify password and the passwords for the app developers’ own dashboards, where you have them.
• Turn on two-step verification for every staff account.
• Go to Settings, then Users, and remove staff and collaborator accounts that no longer need access. Cut back permissions for the rest.
• Go to Settings, then Apps, and uninstall any app nobody uses. Each one still has the access you gave it.

If you find something

1. Stop new shoppers being affected. Turn on password protection for your store (Online Store, then Preferences) while you sort it out. Shopify gave the same advice to at least one affected store.
2. Keep evidence. Screenshots, the web addresses you saw, dates and times, and which app was involved. Don’t delete anything before you’ve recorded it.
3. Contact the right people. Shopify Support, the app developer, and your payment provider.
4. Check your obligations. Depending on where you and your customers are, you may have a legal duty to report a data incident or tell affected customers. Get advice if you’re not sure.
5. Tell customers only what you know. If customers may have entered card details on a fake page, tell them plainly, advise them to contact their bank, and don’t guess at details you haven’t confirmed.

If your customers are already asking

Some shoppers may message you after seeing the news, or because they noticed a strange checkout page. A short, honest reply works best. For example:

Thanks for letting us know. Some Shopify stores were affected this month by a problem with third-party apps that sent shoppers to fake checkout pages. We’ve checked our store and [what you found]. If you entered card details on a page that wasn’t our website, please contact your bank. You can reply here with any questions.

Fill in the bracket only with what you’ve actually confirmed.

What to do next

Once your store is clear, use the moment to cut your risk for next time. Our guide to Shopify app permissions shows which access to worry about. Our seven checks before installing an app help you choose new apps more carefully.

Frequently asked questions

My checkout looks normal when I test it. Am I safe?

Not necessarily. The redirect fired only once per browser session, so test in a fresh private window each time, on desktop and mobile. Then check your app embeds, app settings and theme code as well.

I don’t use any of the named apps. Do I need to do anything?

It’s still worth doing the checks. No one has published how the attackers got into these apps, and more merchants reported redirects as the month went on. Thirty minutes now is cheap insurance.

Should I uninstall the affected apps?

Follow the developer’s own guidance. HulkApps and Logbase say their apps are safe to use again. Swym says leaving Wishlist Plus installed while it’s paused is safe. If you no longer use an app, uninstalling it is always fine.

How do I know if customers entered card details on a fake page?

You usually can’t tell from your Shopify admin, because the order still went through the real checkout afterwards. Customers who saw an unusual checkout address, or who report unexpected card charges, are the signal. Contact your payment provider if you suspect it.