Free · no install · about 30 seconds
Where does your checkout button really go?
In October 2026, compromised Shopify apps sent shoppers to fake payment pages that stole card details. Orders looked normal. This scan clicks your real checkout button like a shopper would and shows you where it lands.
We add one product to a cart and click “Checkout”. We never pay and stop as soon as we know the destination.
What this scan checks
- Opens your store in a clean browser session (the October attack fired once per session).
- Adds an in-stock product to the cart and clicks your real checkout button.
- Records where the browser is sent. Your own domain or Shopify is fine. Anything else is flagged.
- Lists third-party scripts and flags domains reported in the attack.
Limits: a single scan cannot prove a store is safe. Attacks can be intermittent or target specific devices. If you see an alert, test manually in a private window and contact Shopify Support.