Shopify Store Code Audit: Before You Fix or Rebuild

A popup you deleted months ago still flashes on mobile. A product page loads a review widget from an app you stopped paying for. Or you've just taken over a store — bought the business, or inherited it from an agency that's gone quiet — and you have no idea what's actually inside the theme. Nothing is on fire, but nothing feels safe to touch, either. That uncertainty is exactly what a Shopify store code audit resolves: it tells you what's in there before you decide to live with it, fix it, or start over.

Something's Off in a Store You Didn't Build

The reassuring part is that finding out what's in there is completely safe. Reading your theme code, scanning your app list, and checking access in the admin changes nothing — the code editor only writes changes when you click Save, so you can look at everything without risk. A code audit is just a structured walk through each of those layers — theme code, leftover app residue, access, and the ageing checkout layers — to decide what to keep, fix, or rebuild.

One boundary worth setting up front: this is a code-and-health audit, not an SEO one. Duplicate URLs, canonicals, and crawl issues are a separate job — our guide to a Shopify technical SEO audit covers that side. And if you're buying a store rather than building one, treat the code as part of due diligence: acquisition guides stress confirming the source code is clean and transferable before you pay.

When You Actually Need One

You don't audit a store for fun — you do it when one of these is true. See which of the six situations below matches yours; most readers land on at least two.

What's Hiding Inside the Theme

An audit works in layers, from the code inside your theme outward to the apps and accounts around it. Start inside the theme, where three things tend to hide: an ageing architecture, leftover app code, and invisible scripts.

Which Theme Generation Are You On?

Every Shopify theme belongs to one of three generations, and which one you're on shapes the whole fix-versus-rebuild decision. Vintage themes use the original, pre–Online Store 2.0 architecture, aren't sold in the Theme Store anymore, and — for Shopify's free vintage themes — only receive security fixes. Online Store 2.0 themes brought sections on every page and dynamic sources; the latest generation adds theme blocks, including the Horizon family. If you're unsure how to tell them apart or whether to upgrade, our guide to Shopify Online Store 2.0 breaks the architectures down.

Ghost Code: The Residue Apps Leave Behind

Here is the trap that catches most inherited stores. When you uninstall an app, does it clean up after itself? Often, no — and Shopify says so plainly.

Shopify draws a sharp line between modern and legacy integrations. Apps built as theme app extensions add app blocks that are removed automatically and entirely when you uninstall them. Older apps worked differently — they added snippets to the theme and injected JavaScript into your layout, and some apps add code to your theme that isn't automatically removed when you uninstall the app. That leftover is what practitioners call ghost code.

In practice it looks like orphaned snippet files with app-branded names — a leftover loox-reviews.liquid or privy-popup.liquid — and render tags that point at snippets which no longer exist. One agency names popup, email-capture, review, and chat apps as the usual culprits for leftover code. The damage is rarely one dramatic file; as one store audit put it, it's accumulation — layers of dead scripts from tools swapped out over the years.

ScriptTags and Injected Trackers: The Invisible Layer

Here is the practical version. If a tracker still fires after you've removed the app, it's almost always theme-injected code you can find by searching the theme (step 3 of the checklist below) — Shopify automatically removes all script tags associated with an app when you uninstall it, so a live ScriptTag rarely lingers. The complication is that a ScriptTag — remote JavaScript an app loads into your storefront or Order status page — has no built-in admin screen that lists it (the Customer events page only shows Web Pixels API apps), so for anything still hidden after your own search, a developer queries the Admin API. These legacy tags are also on a deadline, which brings us to the dated liabilities below.

Beyond the Theme: Apps, Access, and Legacy Layers

Your App and Access Inventory

Move outward from the code to what surrounds it. This is the fastest part of the audit to do yourself, and often the quickest money saved.

Collaborator accounts are the classic blind spot: they're Shopify Partners you allowed in, and collaborator accounts don't count toward your store's user limit, so they don't show up where you'd expect to count heads. Review them, and remove anyone whose work is long finished.

App bloat is the other quiet drain. One audit specialist who reviewed 100 stores put the median app spend at $580 a month, with the top quarter over $1,200 — one person's sample, not a market benchmark, but a useful gut check. Unused apps also cost speed: one audit describes a retired size-guide app that still fired on every product page for a feature no one used.

To measure that on your own storefront, Shopify's free Web Performance report charts your Core Web Vitals against every app install and theme change. For the structural speed patterns behind those numbers — and a store-wide pattern audit — see what the best Shopify stores do differently.

The Dated Liabilities: checkout.liquid and Shopify Scripts

Some of what an audit finds isn't messy — it's expiring. Shopify has been retiring the old ways apps and themes hooked into checkout, and each has a date attached. If your inherited store leans on any of them, they're on borrowed time.

If your store still customizes the Thank-you or Order status pages through checkout.liquid or additional scripts, that's the highest-priority dated item — non-Plus stores are auto-upgraded on August 26, 2026, and those customizations are lost in the process. What replaces them, and what a migration costs, is the whole subject of our guide to checkout extensibility.

Likewise, any discount, shipping, or payment logic that ran on Shopify Scripts already stopped on June 30, 2026 — silently. If an inherited store's rules quietly changed, that is often why; our guide to the Scripts-to-Functions migration maps each piece to its replacement.

Pulling the whole map together, here is what an audit typically surfaces — how serious each finding is, and whether it's a do-it-yourself fix or a job for a developer.

Severity and ownership are editorial guidance for a non-technical merchant, not a Shopify classification.

Fix or Rebuild? A Decision Framework

With the map in hand, the big decision is a fork: patch the theme you have, or rebuild on a modern one. Neither is automatically right.

Lean toward a fix when your theme is a modern Online Store 2.0 or Horizon-generation theme, the customizations are shallow and documented, and the problems are isolated — a few ghost snippets, a duplicate app, one broken section. Lean toward a rebuild when the theme is vintage, the code is deep and undocumented, ghost code has accumulated for years, or you were planning a redesign anyway. Rebuilding on a current theme resets that debt to zero.

Not sure which fork is yours? Answer five quick questions about your theme, your code, and how you want to handle it — and get the route that fits, from a free DIY cleanup to a full rebuild.

The Free DIY Audit You Can Run Today

Whatever route the quiz pointed you to, start here. Even if you'll hire a professional, these free checks tell you — and them — exactly what you're dealing with, and they cost nothing but an hour in your admin. Steps one through seven apply to everyone; the security step matters most if you saw changes you can't explain. Tick each off as you go; your progress saves on this device.

Going Deeper: Theme Check and the CLI

If you're comfortable in a terminal, two free Shopify tools go further. The Shopify CLI builds and runs themes locally, and Theme Check is a linter for the Liquid and JSON in your theme — it flags deprecated tags (like the old {% include %}) and common errors automatically. Neither is required for the audit above; they're for readers who want a line-by-line pass. If you'd rather understand the code than lint it, our explainer on Shopify Liquid covers the language itself.

If You Suspect the Store Was Hacked, Secure It First

Sometimes an audit turns up something worse than mess. Unknown redirects, template changes you didn't make, admin users or apps you never added — these aren't cleanup items, they are signs the store may be compromised. If that is what you are seeing, stop the audit and switch to securing the store.

Treat the following as triage, in order, straight from Shopify's account-security guidance:

Once you're back in control, restore the theme from a known-clean backup rather than trying to clean the live one by hand. If you can't tell what was changed, that's the point to bring in both Shopify Support and a developer.

What to Demand From an Auditor

If the audit is beyond what you want to do yourself, the quality of what you hire is decided by what you demand up front. Across agencies that publish their audit format, the good ones are consistent: one documents each finding with a recommended fix, an effort estimate, and an impact projection; another prioritizes critical issues first. The output should be a fix list ranked by impact, not a page of generic advice.

Give the auditor access scoped to what the review needs, and revoke it once the report lands — the same hygiene you'd apply to any outside contractor. For the full process of finding, vetting, and briefing someone, see our guide to hiring a Shopify developer.

And if you're not sure whether you need a quick cleanup, a fix, or a full rebuild in the first place, our Shopify development guide routes you to the right specialist in about a minute.

How Much Does a Shopify Store Code Audit Cost?

There is no official price list for a code audit, and the honest answer is that it depends on scope and on who you ask. The ranges below come from individual vendors' own pages — useful for orientation, not a market rate.

Each figure is one vendor's own listed price, not a market benchmark or official Shopify data. Hourly work runs about $110/hour for a single project (ShopExperts, formerly HeyCarson) up to $150–$300/hour at agencies. Verify current pricing on each vendor's page.

If the audit points to a rebuild rather than a patch, budget that separately. One agency lists a custom Shopify rebuild at $5,000–$20,000 and patching an existing theme at $2,000–$10,000+; another places a configured pre-built theme at $3,000–$5,000 and a fully custom build at $10,000–$20,000. Those are single vendors' figures too.

For the full build-budget picture — parts, scenarios, and rates by region — see our guide to Shopify store development cost.

After the Audit: Keep the Store Auditable

The point of an audit is to never need a bad one again. A little discipline keeps your store legible, so the next review takes an hour, not a week.

The single highest-leverage habit is version control. Shopify's official GitHub integration syncs your theme code to and from a repository, so every change is tracked and reversible — even if you never write code yourself, it gives you a history of who changed what. This walkthrough shows how to set it up without being a developer:

Backups matter too: duplicate the theme before every edit, and prune old copies so you stay under your plan's theme limit — 20 themes on Basic, Grow, and Advanced, and up to 100 on Shopify Plus.

The Bottom Line

There is no single “store code audit” that fits everyone. What is fixed is the order of operations: look before you touch, know which generation your theme is, and separate a messy store from a compromised one. Get those right and the path is obvious — miss them and you either overspend on a rebuild you didn't need or keep living with problems you can't see.

Frequently Asked Questions