The 27 Shopify security checks Black Cat runs
Black Cat SSPM evaluates 27 security policies against your Shopify configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Shopify — what access Black Cat needs, and why.
Access control & privilege
16 checks · highest severity: critical
Data sharing & exposure
6 checks · highest severity: high
Access control & privilege (16)
- Excessive Admins severity: medium
- Staff Unrestricted Permissions severity: medium
- Excessive API Scopes severity: medium
- Write Payment Gateways Scope severity: high
- Write Themes Scope severity: high
- Write Price Rules Scope severity: medium
- Write Inventory Scope severity: medium
- Staff No Permissions severity: medium
- Write Fulfillments Scope severity: medium
- Unauthenticated Write Checkouts Scope severity: high
- Admin Staff MFA Disabled severity: critical
- Read All Orders Scope severity: high
- Write Draft Orders Scope severity: medium
- Write Order Edits Scope severity: high
- Write Users Scope severity: high
Data sharing & exposure (6)
- Password Protection Disabled severity: medium
- Webhook Using HTTP severity: high
- Webhook External Destination severity: low
- Unauthenticated Read Customers Scope severity: high
- Write Customers Read Payment Scope severity: high
- Webhook Customer Data Topic severity: medium
Other checks (5)
severity: high Staff MFA Disabled fix difficulty: easy #
Enable two-factor authentication for the flagged Shopify staff member
- Log in to the Shopify admin as a store owner or staff with admin permissions
- Navigate to Settings > Users and permissions
- Click on the staff member's name to open their profile
- Under "Security", locate the two-step authentication section
- Ask the staff member to enable two-step authentication from their own account settings, or require it store-wide
- Confirm the staff member has completed the two-step authentication enrollment
Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.3 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: critical Account Owner MFA Disabled fix difficulty: easy #
Enable two-factor authentication on the store owner account
- Log in to Shopify using the store owner account credentials
- Click on your account avatar in the top-right corner and select "Manage account"
- Navigate to the "Security" section
- Under "Two-step authentication", click "Turn on two-step authentication"
- Choose an authentication method (authenticator app recommended) and complete enrollment
- Store the backup codes in a secure password manager
Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: medium Webhook Private Destination fix difficulty: easy #
Update the webhook destination to a valid public HTTPS endpoint
- Log in to the Shopify admin as the store owner or staff with notification permissions
- Navigate to Settings > Notifications
- Scroll to the "Webhooks" section at the bottom of the page
- Identify the webhook pointing to a localhost or private IP address
- Delete the webhook and recreate it with a publicly reachable HTTPS URL
- Verify the new endpoint receives test webhook payloads successfully
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.6 NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: low Webhook XML Format fix difficulty: easy #
Switch webhook format from XML to JSON for stronger HMAC signature verification
- Log in to the Shopify admin as the store owner or staff with notification permissions
- Navigate to Settings > Notifications
- Scroll to the "Webhooks" section at the bottom of the page
- Delete the webhook using XML format
- Recreate the webhook with the same topic and destination URL, selecting JSON as the format
- Update the receiving endpoint to parse JSON payloads if it currently expects XML
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: low Store Setup Required fix difficulty: easy #
Complete the Shopify store setup to ensure all security features are active
- Log in to the Shopify admin as the store owner
- Follow the setup wizard prompts to complete store configuration
- Verify that all required settings are configured including payments, shipping, and taxes
- Confirm the store is no longer flagged as requiring setup
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10