Shopify

Auditing a Shopify store without crying wolf

A shop has one job and an audit of one should be about whether a stranger can complete a purchase. Here is what this engine reads on a Shopify store, and the finding it deliberately does not raise.

The token that is supposed to be public

Shopify documents its Storefront API access token as public. It is meant to sit in the page; that is how the storefront works. A credential scanner that matches on shape rather than on meaning will find it, call it an exposed secret, and send the owner to a developer.

A real audit did exactly that to a real store and told them to remove it. The engine now excludes tokens that are public by design — the Shopify storefront token and the Stripe publishable key among them — because a finding that a client’s own developer dismisses in ten seconds costs more credibility than it could ever have been worth.

What a shop gets checked on that a brochure site does not

Some checks only make sense where money changes hands, and raising them elsewhere is how a factory selling by quotation gets told it has no pricing page. The trust checks — returns policy, visible payment methods, delivery terms — require evidence that this is actually a shop: a cart, a checkout link, or Offer schema carrying a real price.

The rule is deliberately asymmetric. A cart beats quotation language, because a shop with a quote page is still a shop.

The contradiction nobody else looks for

The most expensive fault found on a real store this year was not technical. The homepage FAQ promised free shipping to Canada and the United States. The shipping policy page said the store ships within Canada only. Both were live on the same day.

A US visitor who believes the first can add to cart and cannot complete an order. No analyzer looks for that, because it needs two pages read and compared — and that is exactly the kind of finding a person doing the reading will catch and a scanner will not.

The free-shipping threshold that nobody reaches

The same store ran a “free shipping over $35” banner on every page while its only product sold for $19.99. The default order — one item — never qualifies. The banner is not wrong, exactly; it is a promise the shop is built so that most customers cannot collect.

What the report will not do

It will not place a test order, add anything to your cart, or submit a form. Every check reads what your pages already send. Confirming that checkout actually completes is the one thing worth doing yourself, from a phone on mobile data rather than the office network, and it takes about five minutes.

Questions people ask

Will you test my checkout?

No. Testing checkout means creating an order in your system, and this engine reads rather than writes. What it can tell you is whether the page a customer lands on contradicts your policies, whether payment methods are visible, whether the returns and delivery terms exist, and whether anything on the page is broken. Completing a real purchase yourself is the last five minutes and it is worth doing.

Do you check my product pages or just the homepage?

The whole-site crawl follows up to sixty pages the way a search engine would, and every finding names the page it came from. So a finding about a product page says which product page.

My theme is from the Shopify store. Are its problems my problem?

Some of them are and the report distinguishes. Where the platform serves its own bundles, that is not your code and it is not reported as yours. Where your theme makes a choice you can change in the editor — a heading, an alt attribute, a button label — it is yours, and it is named with the page it is on.