Shopify Monitoring — What Exactly We Check

With Shopify, the platform takes care of the server, updates and file security — but that does not mean a store cannot stop selling. An enabled password page, an app that breaks the cart or a foreign script added to the theme is enough. MonitorWWW.com recognises a Shopify store automatically and watches the things the owner actually controls.

Is the store selling

• Password page — the store returns a 200 status but shows a password form instead of products. Plain monitoring will say everything works; we send an alert.
• Cart and catalog — whether /cart and /collections/all respond and do not show a "store unavailable" message.
• Cart API — whether /cart.js returns a valid cart. The "Add to cart" button and the cart drawer in most themes depend on it.
• Shopify's unavailability message — for example after a store is frozen because of an unpaid plan.

Scripts and apps

• External script domains in the cart — we remember where the cart page loads JavaScript from and raise an alert when a new domain appears. Usually it is a new app or pixel, but a script added without your knowledge looks exactly the same.
• Suspicious code — execution of encoded code, reading card fields combined with sending data out, WebSocket connections to foreign domains and scripts disguised as images.

We skip domains that belong to Shopify itself — they change without the merchant doing anything. The scan covers the HTML of the cart page; payment itself happens on Shopify's pages, which we neither have nor need access to.

Domain and SEO

• Redirect from *.myshopify.com — whether the store's technical address points to the primary domain or shows the same content under a second address.
• Theme — name and version, when the theme provides them.
• SSL certificate and domain expiry — a domain connected to Shopify is still yours and can still expire.

How often

We check store availability every few minutes. The extra Shopify checks are four requests a day, one at a time, several hours apart and at irregular intervals — so they neither load the store nor run into platform limits. On a newly added site the first cycle finishes in about an hour.

We do not install an app in the store or need access to the Shopify admin — we check the store the way a customer sees it.

Alerts

We notify you about outages by email, SMS or Telegram. A separate alert (email, Telegram, webhook) is sent when the store gets locked behind a password page, or when a new script domain or suspicious code appears in the cart. Other findings are in the dashboard together with where to fix them in Shopify settings.

What we check on every site, regardless of platform

• Uptime and response time — HTTP status, load time, redirects, maintenance mode.
• SSL certificate and domain — certificate validity and domain expiry date, with an alert ahead of time.
• DNS — SPF, DMARC, MX and CAA records.
• Security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cookie flags.
• Files that should not be visible — .env, .git, phpMyAdmin, backups, directory listing.
• Malware and PHP errors — suspicious code and error messages in the page content.
• Blacklists — whether the domain has been flagged as unsafe.
• Content changes — an optional keyword that must be present on the page.