Website check
shopify.com
In plain English
Overall, shopify.com scored an A (87 out of 100). The check found five items to improve, and none of them are urgent. The most important fix is adding a Content Security Policy, which limits which scripts can run on the page and makes it harder for injected code to steal logins or change what visitors see. Visitors do not need to be worried based on this check alone, since the findings are about hardening the site rather than signs of an active problem.
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
Page can be framed by other sites
Another site could load this page in a hidden frame and trick visitors into clicking things (clickjacking).
How to fix: Send X-Frame-Options: DENY (or SAMEORIGIN), or add a frame-ancestors rule to the Content Security Policy.
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No CAA record
CAA records limit which certificate authorities may issue certificates for shopify.com, which makes a wrongly issued certificate less likely.
How to fix: Add a CAA record naming your certificate provider, for example 0 issue "letsencrypt.org".
What the agent did (12 steps)
- 01Picked up a daily rating check
- 02Looking up shopify.com and connecting over HTTPS
- 03Connected over HTTPS: www.shopify.com answered 200 after 1 redirect
- 04Certificate from Google Trust Services, valid 63 more days (TLSv1.3)
- 05Read the security headers: HSTS, nosniff set; missing CSP, X-Frame-Options, Referrer-Policy
- 06No PHP version given away
- 07Found 0 script sources from other sites
- 08Old TLS 1.0/1.1: refused
- 09Plain http:// redirects to HTTPS
- 10security.txt found
- 11Email spoofing protection: SPF set, DMARC set
- 12Scored 87/100, grade A. Writing it up in plain English
Technical details (26)
- ip
- 172.64.145.93
- caa
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- www.shopify.com
- tls validTo
- 2026-12-24T19:46:16.000Z
- tls daysLeft
- 63
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf.google.com include:mail.zendesk.com include:sendgrid.net ~all
- email apex
- shopify.com
- email dmarc
- v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-aggregate@shopify.com;ruf=mailto:dmarc-reports@shopify.com
- status
- 200
- cookies
- headers server
- cloudflare
- headers x-content-type-options
- nosniff
- headers strict-transport-security
- max-age=15552000; includeSubDomains; preload
- finalUrl
- https://www.shopify.com/
- requests
- 4
- timingMs
- 176
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.