Shopify's new redirect prompt and what to check in your checkout

Starting October 21, you can add trusted domains so customers reach those sites without seeing the prompt.

October also brought reports of malicious code pulling shoppers away from the real checkout. The two are separate events, but together they point to two things worth doing on your store: review your trusted domains and test your own checkout.

What customers see, and which domains skip the prompt

The prompt shows the website address and lets the customer either continue or go back to the store. It doesn't appear for domains connected to your store, Shopify websites, or supported social networks. Shopify notes that a site you own but haven't connected to your store can still trigger it.

So if your store sends customers to a separate website of yours that isn't connected, they may hit an extra confirmation step. Shopify's two examples of trusted domains are booking tools and partner websites.

Only add domains you're sure belong to you or to a partner you know well.

Some stores had customers sent to fake payment pages through apps

Separate from Shopify's change, two write-ups describe a different kind of attack that started before the announcement. Roman Zipp ran into it while shopping on a store and investigated, then published a post on October 10 and updated it on October 21, 2026. According to that post, malicious JavaScript sent shoppers who clicked Checkout to a fake payment page, collected their card details, then returned them to the real checkout.

App developers have spoken up as well. Selleasy logged an incident on October 13, when an unauthorized script was injected into some of the stores it serves. Swym says that on October 14, between 10:06 and 11:56 UTC, shoppers clicking checkout on a small group of storefronts may have been redirected to an external page. Selleasy says it removed the script, and Swym says it patched the issue. Kurt Elster's post lists three apps whose developers have confirmed involvement: Hulk Product Options, Selleasy, and Swym Wishlist Plus.

Because the code lives outside the theme, checking your theme files alone isn't enough. Elster, co-founder of Ethercycle and host of the Unofficial Shopify podcast, wrote on October 20, 2026 that the code is served from the app vendor's servers and runs only once per browser session, so a second test in the same session can look clean. There's still no official count of affected stores, and no source says Shopify's checkout itself was compromised.

The redirect-prompt changelog doesn't mention any of this, and none of the sources we read say whether the new prompt would stop this kind of redirect. For now, don't treat the prompt as protection for your checkout.

Second task: test your store's checkout yourself.

If your store has any of the three apps above installed, ask the developer whether your store was in the affected group. Swym's page says affected merchants may have obligations to notify customers or regulators under data laws, but it doesn't name a specific law, so get legal advice if this applies to you.

If your store has its own developer

A Shopify post from October 20, 2026 carries an "Action required" label. Shopify asks developers to scan their apps with the new security check, switch to expiring access tokens, turn on two-factor authentication for the relevant accounts, and update their emergency contact email, all within the week the post went up. Shopify will soon require expiring tokens for every public app on the App Store, but hasn't given a date.

The shopify app security check command has been available since October 15, 2026. Shopify cautions that a clean result isn't a guarantee of safety. If you work with your own developer, you can ask whether they've finished these steps.

Shopify will also add IP restrictions for API keys and raise App Store requirements, with details and timing shared before each change. Developers are responsible for fixing incidents and notifying affected merchants, so if you have a dev, you can point them to this article.

Reviewing trusted domains keeps customers from running into an unfamiliar extra step. Testing checkout tells you whether the Checkout button is sending people somewhere strange right now, but one clean test can't tell you whether any customers were redirected before.