Shopify Store Code Audit: Before You Fix or Rebuild

A popup you deleted months ago still flashes on mobile. A product page loads a review widget from an app you stopped paying for. Or you've just taken over a store — bought the business, or inherited it from an agency that's gone quiet — and you have no idea what's actually inside the theme. Nothing is on fire, but nothing feels safe to touch, either. That uncertainty is exactly what a Shopify store code audit resolves: it tells you what's in there before you decide to live with it, fix it, or start over.

Something's Off in a Store You Didn't Build

The reassuring part is that finding out what's in there is completely safe. Reading your theme code, scanning your app list, and checking access in the admin changes nothing — the code editor only writes changes when you click Save, so you can look at everything without risk. A code audit is just a structured walk through each of those layers — theme code, leftover app residue, access, and the ageing checkout layers — to decide what to keep, fix, or rebuild.

One boundary worth setting up front: this is a code-and-health audit, not an SEO one. Duplicate URLs, canonicals, and crawl issues are a separate job — our guide to a Shopify technical SEO audit covers that side. And if you're buying a store rather than building one, treat the code as part of due diligence: acquisition guides stress confirming the source code is clean and transferable before you pay.

When You Actually Need One

You don't audit a store for fun — you do it when one of these is true. See which of the six situations below matches yours; most readers land on at least two.

What's Hiding Inside the Theme

An audit works in layers, from the code inside your theme outward to the apps and accounts around it. Start inside the theme, where three things tend to hide: an ageing architecture, leftover app code, and invisible scripts.

Which Theme Generation Are You On?

Every Shopify theme belongs to one of three generations, and which one you're on shapes the whole fix-versus-rebuild decision. Vintage themes use the original, pre–Online Store 2.0 architecture, aren't sold in the Theme Store anymore, and — for Shopify's free vintage themes — don't receive updates beyond security fixes. Online Store 2.0 themes brought sections on every page and dynamic sources; the latest generation adds theme blocks, including the Horizon family. If you're unsure how to tell them apart or whether to upgrade, our guide to Shopify Online Store 2.0 breaks the architectures down.

Ghost Code: The Residue Apps Leave Behind

Here is the trap that catches most inherited stores. When you uninstall an app, does it clean up after itself? Often, no — and Shopify says so plainly.

Shopify draws a sharp line between modern and legacy integrations. Apps built as theme app extensions add app blocks that are removed automatically and entirely when you uninstall them. Older apps worked differently — they added snippets to the theme and injected JavaScript into your layout, and some apps add code to your theme that isn't automatically removed when you uninstall the app. That leftover is what practitioners call ghost code.

Even an app built this way can leave one switch behind. When we tested a bundles app on a development store in September 2026, its app embed stayed switched on in both themes after the final uninstall. The widget had already gone from the storefront, so the embed was empty, but it stayed on until we switched it off ourselves in the theme editor under App embeds. That was one app on one store, so treat it as a quick check, not a rule — the full uninstall log is in our Kaching Bundles test.

In practice it looks like orphaned snippet files with app-branded names — a leftover loox-reviews.liquid or privy-popup.liquid — and render tags that point at snippets which no longer exist. One agency names popup, email-capture, review, and chat apps as the usual culprits for leftover code. The damage is rarely one dramatic file; as one store audit put it, it's accumulation — layers of dead scripts from tools swapped out over the years.

Page builders are one case some vendors document themselves: PageFly and Replo each list theme files to delete by hand, and our landing page guide sets out what happens to your pages and theme when you remove a page builder.

ScriptTags and Injected Trackers: The Invisible Layer

Here is the practical version. If a tracker still fires after you've removed the app, it's almost always theme-injected code you can find by searching the theme (step 3 of the checklist below) — when an app is uninstalled from a shop, all of the script tags that it created are automatically removed along with it, so a live ScriptTag rarely lingers.

The complication is that a ScriptTag — remote JavaScript an app loads into your storefront — has no built-in admin screen that lists it (the Customer events page only shows Web Pixels API apps), so for anything still hidden after your own search, a developer queries the Admin API.

There is now an end date on this whole layer, and it changes what “fix it” means. Shopify has deprecated the mechanism, and on March 1, 2027 it will stop injecting script tags into storefronts. That is the last surface where they still ran, which Shopify says outright: storefronts are the last place script tags still run, since they already stopped working on the Order status page. The same deprecation closed the write side earlier: starting October 1, 2026, the Admin API rejects new and updated ScriptTags, on every API version, so pinning an old one buys nothing.

The read and delete calls survive both dates, which is the part that matters for an audit: a developer can still list what you have and remove it. What you should not accept after this is a developer proposing to “just add a script tag” for new tracking — the replacements Shopify names are an app embed block in a theme app extension, or a web pixel if the script only collects analytics or conversion data. An admin-created custom app can't use either, so Shopify's guidance there is to move the script into the theme, in a custom Liquid block where possible. Both dates are in the timeline below.

Beyond the Theme: Apps, Access, and Legacy Layers

Your App and Access Inventory

Move outward from the code to what surrounds it. This is the fastest part of the audit to do yourself, and often the quickest money saved.

Collaborator accounts are the classic blind spot: they're Shopify Partners you allowed in, and collaborator accounts don't count toward your store's user limit, so they don't show up where you'd expect to count heads. Review them, and remove anyone whose work is long finished. Deciding what the ones you keep should still be able to see is a separate call — our guide to who gets into your Shopify admin works through it by permission category.

App bloat is the other quiet drain. One audit specialist who reviewed 100 stores put the median app spend at $580 a month, with the top quarter over $1,200 — one person's sample, not a market benchmark, but a useful gut check. Unused apps also cost speed: one audit describes a retired size-guide app that still fired on every product page for a feature no one used.

To measure that on your own storefront, Shopify's built-in Web Performance report charts your Core Web Vitals against every app install and theme change. For the structural speed patterns behind those numbers — and a store-wide pattern audit — see what the best Shopify stores do differently.

The Dated Liabilities: checkout.liquid and Shopify Scripts

Some of what an audit finds isn't messy — it's expiring. Shopify has been retiring the old ways apps and themes hooked into checkout, and each has a date attached. If your inherited store leans on any of them, check the dates: most have already passed, and the last one is still ahead.

If your store customized the Thank-you or Order status pages, that's the highest-priority dated item. On a non-Plus plan that customization lived in additional scripts and script-tag apps — checkout.liquid was always a Plus-only file — and the new pages replace it: August 26, 2026 was the deadline for non-Plus stores to upgrade. What replaces it, and what a migration costs, is the whole subject of our guide to checkout extensibility.

Likewise, any discount, shipping, or payment logic that ran on Shopify Scripts already stopped on June 30, 2026 — silently. If an inherited store's rules quietly changed, that is often why; our guide to the Scripts-to-Functions migration maps each piece to its replacement.

Pulling the whole map together, here is what an audit typically surfaces — how serious each finding is, and whether it's a do-it-yourself fix or a job for a developer.

Fix or Rebuild? A Decision Framework

With the map in hand, the big decision is a fork: patch the theme you have, or rebuild on a modern one. Neither is automatically right.

Lean toward a fix when your theme is a modern Online Store 2.0 or Horizon-generation theme, the customizations are shallow and documented, and the problems are isolated — a few ghost snippets, a duplicate app, one broken section. Lean toward a rebuild when the theme is vintage, the code is deep and undocumented, ghost code has accumulated for years, or you were planning a redesign anyway. Rebuilding on a current theme resets that debt to zero.

If the audit points to a rebuild rather than a patch, budget that separately. One agency lists a custom Shopify rebuild at $5,000–$20,000 and patching an existing theme at $2,000–$10,000+; another places a configured pre-built theme at $3,000–$5,000 and a fully custom build at $10,000–$20,000. Those are single vendors' figures.

For the full build-budget picture — parts, scenarios, and rates by region — see our guide to Shopify store development cost.

Not sure which fork is yours? Answer five quick questions about your theme, your code, and how you want to handle it — and get the route that fits, from a free DIY cleanup to a full rebuild.

The Free DIY Audit You Can Run Today

Whatever route the quiz pointed you to, start here. Even if you'll hire a professional, these free checks tell you — and them — exactly what you're dealing with, and they cost nothing but an hour in your admin. Steps one through seven apply to every store; the last one — the legacy checkout and Scripts layer — matters most on an older store you inherited. Tick each off as you go; your progress saves on this device.

How to Run Shopify Theme Check on Your Theme

The DIY checklist reads the theme screen by screen; Theme Check reads it line by line. It is Shopify's free linter for the Liquid and JSON inside a theme. It detects errors and enforces Liquid best practices, and Shopify gives examples of what it catches: syntax errors, missing templates, unused variables and snippets, unknown and deprecated tags, and performance issues.

It runs through the Shopify CLI, which also builds and runs themes locally, so the work is getting the CLI and a local copy of your theme. If a terminal isn't your thing, use Download theme file in the theme's actions menu (Shopify emails you a .zip), unzip it, and open the folder in Visual Studio Code with the Shopify Liquid extension, which includes Theme Check and underlines problems in the editor.

A few options on the theme check command are worth knowing before you run it:

• --list shows which checks are enabled.
• -C or --config swaps in a preset such as theme-check:recommended or theme-check:all, overriding any .theme-check.yml file in the theme.
• --init generates a .theme-check.yml file, where a developer can enable, disable, or re-rate individual checks.
• --fail-level sets the minimum severity that makes the command exit with an error code, which matters when Theme Check runs in CI rather than by hand.
• -a or --auto-correct fixes offenses automatically, but only for the few checks that support it — more on that below.

Reading the Results and Handing Them Off

Severity is Shopify's measure of "the relative importance of a check to the functionality and optimization of your theme," in three levels: error, warning, and info. The checks reference lists every check with its severity — ParserBlockingScript, for instance, is an error, while OrphanedSnippet, UnusedAssign, and RemoteAsset are warnings. Read the check's own page before ranking a finding: severity says how much the rule matters to Shopify, not what a given line costs your store.

Auto-correct is not a shortcut to a clean theme. The checks reference marks only a few checks as auto-correctable, and the flag changes the files in the folder you ran it on — for a missing template it creates an empty file rather than removing the dead tag. Treat it as a developer's tool, not a cleanup button.

The report is a brief, not your to-do list. The one class you can act on yourself is the dead reference covered in the callout above; anything that touches live Liquid, scripts, or app code goes to a developer, along with the saved output. If you'd rather understand the code than lint it, our explainer on Shopify Liquid covers the language itself.

If You Suspect the Store Was Hacked, Secure It First

Sometimes an audit turns up something worse than mess. Unknown redirects, template changes you didn't make, admin users or apps you never added — these aren't cleanup items, they are signs the store may be compromised. If that is what you are seeing, stop the audit and switch to securing the store. Two-step authentication is among the steps below, and if you are wondering whether you were ever obliged to have it on, our FAQ on whether Shopify requires two-step authentication separates the cases where the platform forces it from the ones where it is left to you.

Then, if you can, change your login email password and your Shopify password, fix two-step authentication, and review finances, staff, apps and orders — the order and the details are in our FAQ on what to do if your Shopify account is hacked.

Once you're back in control, restore the theme from a known-clean backup rather than trying to clean the live one by hand. If you can't tell what was changed, that's the point to bring in both Shopify Support and a developer.

What to Demand From an Auditor

If the audit is beyond what you want to do yourself, the quality of what you hire is decided by what you demand up front. Across agencies that publish their audit format, the good ones are consistent: one documents each finding with a recommended fix, an effort estimate, and an impact projection; another prioritizes critical issues first. The output should be a fix list ranked by impact, not a page of generic advice.

Give the auditor access scoped to what the review needs, and revoke it once the report lands — the same hygiene you'd apply to any outside contractor. For the full process of finding, vetting, and briefing someone, see our guide to hiring a Shopify developer.

And if you're not sure whether you need a quick cleanup, a fix, or a full rebuild in the first place, our Shopify development guide routes you to the right specialist in about a minute.

How Much Does a Shopify Store Code Audit Cost?

There is no official price list for a code audit, and the honest answer is that it depends on scope and on who you ask. The ranges below come from individual vendors' own pages — useful for orientation, not a market rate.

After the Audit: Keep the Store Auditable

The point of an audit is to never need a bad one again. A little discipline keeps your store legible, so the next review takes an hour, not a week.

The single highest-leverage habit is version control. Shopify's official GitHub integration syncs your theme code to and from a repository, so every change is tracked and reversible — even if you never write code yourself, it gives you a history of who changed what. This walkthrough shows how to set it up without being a developer:

Backups matter too: duplicate the theme before every edit, and prune old copies so you stay under your plan's theme limit — 20 themes on Basic, Grow, and Advanced, and up to 100 on Shopify Plus. A duplicated theme is not a store backup, though: what Shopify restores for you and what it never will is a separate question, and we work through it in backing up a Shopify store.

The Bottom Line

There is no single “store code audit” that fits everyone. What is fixed is the order of operations: look before you touch, know which generation your theme is, and separate a messy store from a compromised one. Get those right and the path is obvious — miss them and you either overspend on a rebuild you didn't need or keep living with problems you can't see.

Frequently Asked Questions