Shopify Narrows Its Off-Site Redirect Warning (23 Oct 2026)

What happened

On 20 October 2026 Shopify added a confirmation step to storefronts.
Before a shopper was sent to a website outside the store, they saw a short message with the
destination address and could either continue or go back. Domains connected to the store,
and supported Shopify and social websites, did not trigger it. Shopify’s own note pointed
out that a website a merchant owns but has not connected to their store might still trigger
it.

On 23 October 2026, three days later, Shopify updated the same entry.
The storefront now only blocks links to websites Shopify has identified as malicious, and
asks for confirmation for websites it considers suspicious. Everything else goes straight
through with no message
(Shopify
Changelog).

The context is the redirect campaign reported from 10 October, in which code arriving
through third-party storefront apps intercepted the checkout action and sent shoppers to
lookalike checkout pages on throwaway domains, which captured card details and then
forwarded them to the real checkout so the order still completed. We covered that
when it broke, along with
the check to run on your own store.

Why the narrowing makes sense, and why it matters to you

The first version was blunt by design: warn on everything outside the store. Three days
of that in production will have produced exactly the complaints you would expect.
Affiliate links, booking systems, external size guides, review widgets, payment pages on
owned-but-unconnected domains, and every link a merchant deliberately placed, all throwing
an interstitial that made the store look compromised.

So the fix is reasonable. The thing worth noticing is not the decision. It is the
timeline. A platform-level protection appeared on a Monday and was materially scoped down
by Friday, in an update appended to the original note rather than announced
separately.

If you are a merchant, three practical consequences follow.

You cannot build customer communication on a platform behaviour that is three
days old. Anyone who told their customers this week “our store will warn you
before any external link” now has a statement that is only sometimes true. It is now
conditional on Shopify’s judgment of a domain.

Detection is now the platform’s call, not a blanket rule. Malicious
gets blocked, suspicious gets a prompt, everything else passes. That is better for your
conversion rate and it means an unlisted domain on day one of a campaign gets through. The
attack described above used fresh throwaway domains, which is precisely the case a
reputation list is slowest on.

Your own app audit is the layer that persists. Platform protections
move. The list of third-party apps allowed to run code on your storefront is yours, it
changes only when you change it, and it is the control that was actually missing in the
original incident. If you have not been through it,
the vetting checklist still applies.

The part that lands in your inbox

There is a customer service consequence here that is easy to miss.

Shoppers who saw the interstitial this week have questions, and they are reasonable
ones. “Why did your site warn me about leaving?” “Is this link safe?” “I got a security
message, has your store been hacked?” Those arrive in chat, not in a support ticket, and
they arrive from people who are mid purchase.

They need a short, accurate, prepared answer. Not a reassuring one. Something that says
what the message was, that it came from the platform rather than from a problem with your
store, and what the shopper should check.

The sharper version of the problem applies to anyone selling in conversations. If you
send payment links into WhatsApp or Instagram, your
customers are being trained, correctly, to be suspicious of links in messages. “Is this
payment link really from you” is going to become a routine question, and the answer needs
to be consistent every time, from everyone, including out of hours.

Two things make that answer hold up. The link should come from a domain the customer can
recognise and that you can state plainly. And your business should never be the kind that
sends an unexpected payment link, which is a workflow decision rather than a security
one.

What to do this week

List every third-party app that can run code on your storefront, and remove the ones
you are not actively using.
Connect any domain you own to your store, so your own links are not treated as
external.
Write the two-sentence answer to “is this link safe” and put it where your automation
and your team both use it.
Check your own outbound links still work without a prompt, now that the rule has
changed again.

None of that depends on what the platform does next, which is the point.