Shopify vs a Custom Website: What You Take On

A pitch for a custom-built store can lead with two promises: total flexibility and no monthly platform fee. Both can be true. What it may not list is everything the platform subscription was carrying that now becomes a contract, a line item or a form you sign: the payment processor, the size of your PCI paperwork, fraud screening, hosting, and the code itself.

This guide is a register of who carries what on each route — a Shopify plan, a custom front end on Shopify, or a fully custom build — with the official source for each line. Some duties stay with you on Shopify too: tax responsibility, and chargeback losses except the fraudulent chargebacks that Shopify Protect reimburses on eligible Shop Pay orders of US stores with a US Shopify Payments account. That is worth knowing before you compare prices.

What Counts as a “Custom Website” Here

In this guide a custom website means a store whose commerce runs on code you own, built from scratch on a framework or assembled from open-source software you host. Two other things go by the same name, and they change the comparison completely, because they keep Shopify's checkout.

Shopify's developer documentation defines the middle row precisely: headless commerce separates your storefront's frontend from its backend, you choose the stack, framework and hosting for that frontend, and the Storefront API serves products, collections, search and the cart before handing customers off to checkout. If the custom option on your table is a self-hosted open-source platform rather than your own code, our Shopify vs WooCommerce comparison covers that route on its own terms.

What Moves to You When You Leave the Platform

Read the table by its last column. A No is something Shopify carries today that a custom build hands to you or your agency. A Yes is a duty that stays with you whichever platform you choose, so it should never be counted as a saving or a cost of either side.

Hosting is the one line that is pure plumbing. Shopify includes secure commerce hosting in every plan, charges no bandwidth fees, issues a free TLS/SSL certificate for domains you add, and serves storefront assets through a CDN backed by Cloudflare; the trade-off is that you can't use a third-party SSL certificate on a Shopify store. The full inventory of what a traditional build makes you assemble is in our guide to what a Shopify website includes.

Payments: Who Runs the Checkout

Payments are where the routes split first, because on Shopify you are choosing who processes the card on an existing checkout, and on a custom site you are choosing what sits behind a checkout you build.

What Shopify Payments takes off your list

Shopify describes its own processor as eliminating the hassle of setting up a third-party payment provider or merchant account. It is available if your business is located in one of 41 supported countries, counted on Shopify's list in October 2026, and each country page sets out its own bank-account and business verification requirements.

One condition comes with it, and one benefit. You must secure your account with two-step authentication, and in exchange Shopify charges no third-party transaction fees on orders processed through Shopify Payments, Shop Pay and Shop Pay Installments, or on manual methods such as cash on delivery and bank transfers.

What a third-party gateway costs on Shopify

Shopify's own rule is plain: if your country isn't listed, or Shopify Payments doesn't support your business category, you need to use a third-party payment provider. You can choose from over 100 card providers, of two types: direct providers, and external providers whose customers finish paying on a checkout page hosted outside your online store.

This is a genuine weakness of Shopify against a custom site. Third-party transaction fees apply to transactions processed through third-party and alternate gateways even when Shopify Payments is also activated, except PayPal when Shopify Payments is your primary provider, and a custom site pays its processor without that layer.

The example shows the mechanism rather than a forecast: the fee scales with every dollar that passes through the gateway, so it grows with your sales, and moving up a plan lowers the rate. Run both sides on your own monthly volume.

Mixing providers has its own price. When a store runs a third-party provider alongside Shopify Payments, Shopify charges standard Shopify Payments rates plus a 1.25% premium on the transactions Shopify Payments processes. When the surcharge is waived and how to choose a gateway around it are covered in our guide to Shopify's third-party gateway surcharge.

On a custom site, you contract the processor yourself

Stripe's integration security guide states the starting point for any site that takes cards: a business accepting payments must do so in a PCI-compliant manner and annually attest to that compliance, and anyone involved with processing, transmitting or storing card data must comply with PCI DSS. How much of the standard lands on you depends on whether your own site renders the card fields outside a processor's iframe or your server handles card data.

Stripe adds that this might require dedicated security software and hardware and external auditors for the annual assessment, and offers low-risk integrations that send payment details directly to Stripe without passing through your servers. Which integration your developer picks is therefore a compliance decision, not only a design one.

A custom site doesn't have to give up Shop Pay. Shopify says you can add Shop Pay to your existing commerce platform without migrating, provided your checkout collects the customer's email before payment, your business is eligible for Shopify Payments and located where it is available, and you or your developer have API integration experience, because setup works directly with the Shop Pay Wallet API.

PCI Compliance: What Each Route Leaves You

The question is never whether PCI DSS applies. PCI SSC says the standard is intended for any entity that stores, processes or transmits cardholder data, whether it does so directly or through a third-party service provider. The question is how much of it lands on you, and that is decided by who renders the card fields and whether your server handles card data.

Two Shopify pages, two different statements

Read side by side, Shopify's own pages seem to disagree. They are about different parties, and the third column says which.

Shopify's certification is a service provider's: it describes its annual attestation as the best evidence of the PCI DSS compliance of Shopify's services. Your business is a separate subject. PCI SSC says a merchant that outsources processing must still validate compliance, typically through a Self-Assessment Questionnaire such as SAQ A, and sets out why outsourcing narrows the work without ending it.

Which questionnaire is yours is not Shopify's call. PCI SSC tells merchants to consult the entity the SAQ will be submitted to, typically an acquirer or the payment brands, and none of the Shopify pages we checked on October 18, 2026 — its PCI compliance and security pages, its PCI DSS blog post, its compliance reports pages and its checkout-compliance posts — names the SAQ type a Shopify merchant files. Ask the entity you submit to, in writing, whichever route you choose.

How your payment page decides your questionnaire

PCI SSC publishes separate questionnaires because merchants store, process or transmit card data in different ways. On a custom site, the integration your developer chooses lands you in one of three rows.

Even the lightest row brings duties of its own on a custom build:

• For a page that embeds a processor's payment form in an iframe, PCI SSC's SAQ A asks you to confirm your site is not susceptible to attacks from scripts that could affect your e-commerce systems; that criterion doesn't apply to a redirect to the processor.
• A provider of third-party scripts unrelated to payments is not a service provider for SAQ A purposes, so those scripts stay your responsibility, and Stripe warns that including JavaScript from other sites makes your security dependent on theirs.
• SAQ A under version 4.x includes external vulnerability scanning by an Approved Scanning Vendor for your e-commerce pages, even when processing is fully outsourced.
• In Shopify's own view, a merchant who doesn't use Shopify would need client-side protection platforms to manage and authorize scripts.

What stays on your side when your own front end renders the payment field is set out step by step in our guide to PCI duties for custom and headless checkouts.

Headless keeps the payment page on Shopify

A headless build changes less of this than it seems. The Storefront API hands customers off to checkout, and Shopify's Hydrogen documentation says checkout stays on Shopify, so your front end never renders the payment field. Shopify's enterprise blog says its checkout meets PCI DSS version 4 with no additional merchant work, and that Extensions in Checkout allow customization while keeping that compliance. Your own validation, typically to your acquirer or the payment brands, still stands, as on any Shopify plan.

Taxes: The Responsibility Is Yours on Either Route

This is the duty most often counted as a Shopify feature when it isn't one. Shopify Tax calculates tax only for certain transactions, where the order's destination is in the United States, the European Union, the United Kingdom or Canada, and it collects automatically only where you have a registered tax liability. Shopify states the boundary in one line.

The exception is narrow and closing. Automated filing serves only US stores that are already enrolled, and Shopify says it files returns for sales made through December 31, 2026, still ahead as of October 2026. After that, Shopify Tax keeps calculating and keeps your tax reports current at no extra cost while you file directly with each state, or you hand filing to a partner such as Numeral or Zamp.

Shopify Tax itself is free until your store reaches a sales threshold, then charges a per-transaction fee based on your location and plan.

A custom site swaps the calculator, not the duty. Stripe's own description of how tax compliance works with Stripe Tax leaves the same three jobs on your side:

• Register with the tax authority in a location before you collect tax there.
• Calculate and collect the right tax at checkout, which the service automates.
• File and remit the tax collected in every location where you're registered. Stripe offers filing as a service in the US, in Canada for simplified GST/HST registrations and in the EU for non-Union One Stop Shop (OSS) registrations in Ireland; Stripe files for you only if you use it, and the duty stays yours.

Where you owe US sales tax in the first place, and how registration works state by state, is covered in our guide to US sales tax on Shopify.

Fraud and Chargebacks: Who Screens Orders and Who Pays

Fraud and disputes split into two questions that are easy to merge: who flags a risky order before you ship it, and who pays when a cardholder disputes a charge afterwards.

Who screens orders for fraud

Shopify's fraud analysis identifies orders that can be fraudulent so you can review them in your admin before you fulfill them. It works with online credit card orders Shopify can verify, its recommendations come from machine learning trained on historical transactions across all Shopify stores, and Shopify Payments can block some high-risk checkout attempts before an order is created.

A custom site starts without any of this. Your processor's tool is the usual replacement, but its availability can depend on how you integrate: Stripe says Radar, its fraud prevention tool, is only available when you use one of its client-side tokenization methods, so a direct-API integration loses it. How to read Shopify's risk levels and when an app is worth adding is covered in our guide to Shopify fraud analysis.

Who pays when a cardholder disputes

A chargeback is the bank's decision and the merchant's loss on any platform, with one narrow Shopify exception covered below. Shopify's chargebacks page states the general rule in a caution block of its own.

When a cardholder's bank makes a chargeback, it takes the disputed amount from you right away, and with Shopify Payments the amount is deducted from your next available payout. In the US the chargeback fee is $15 USD, returned if you win. Shopify also warns that fulfilling high-risk orders can raise chargebacks to the point of disabled payment processing and removal from Shopify Payments.

The exception is Shopify Protect, and it is narrow. Shopify Protect covers eligible orders against fraudulent and unrecognized chargebacks for free, but only for stores located in the United States with a US Shopify Payments account, only for orders paid through Shop Pay, and only for orders made up entirely of physical items that need shipping.

On a custom site with Stripe, the processor debits your balance for the payment amount and dispute fee, and Stripe advises answering inquiries immediately unless you intend to accept financial liability. It also notes that card processing treats dispute activity above 0.75% as excessive, and that excessive disputes affect your ability to process with other processors too. Responding to a dispute on Shopify, evidence by reason, is covered in our guide to Shopify chargebacks.

Owning Your Data and Your Code

The case for custom can include owning everything. It is worth separating the data you can take with you from the code someone has to maintain, because they lock you in differently.

What you can export from Shopify

The Help Center documents these exports, one entity at a time:

• Products to CSV, which Shopify lists for backups, moving to a new Shopify store and bulk editing.
• Customers and their details to CSV; up to 50 customers download in the browser, and larger exports are sent by email.
• Orders to CSV from the Orders page, where the transaction history contains only captured payments data.
• Bulk operations in the GraphQL Admin API to fetch data asynchronously in bulk, which needs an app or API access.

Lock-in runs the other way too. If you start custom and move to Shopify later, the Help Center says customer passwords can't be migrated from another online store using a CSV, because they're encrypted outside Shopify, and order information can't be imported through a customer CSV. What is harder to take out of Shopify, and what that means for a long-term decision, is weighed in our guide to Shopify's data portability limits.

Who maintains a custom build

Shopify is explicit about what headless asks of you: you choose the stack, framework and hosting, a headless storefront costs more to build and run than a theme, and Hydrogen doesn't ship a component library, so the interface is yours to write and maintain. A fully custom build extends the same ownership to the checkout, the payment page and the commerce backend.

The practical question for a contract is who holds the repository, the hosting account and the processor account when the agency relationship ends, and what it costs to bring the next developer up to speed on code only the first one knows. Hourly rates and typical budgets by task are in our guide to what Shopify developers cost.

What It Costs: Published Fees Versus Open Line Items

A monthly plan price set against zero is not the whole comparison. The table below lines up what each side actually pays for.

No PCI SSC page we read on October 18, 2026, from its SAQ documents to its FAQs, puts a dollar figure on an SAQ D or a QSA assessment. Stripe's guide to PCI compliance cost gives annual ranges by company size: typically $1,000–$10,000 a year for small businesses, and from about $50,000 up to $250,000 a year for large enterprises whose programs include QSA audits. Neither prices your specific build, so this guide doesn't either. Ask for each custom line as a written quote, including who pays for it after launch.

At the top end Shopify's own pricing stops being published too. Plus starts at $2,300 a month on a 3-year term or $2,500 on a 1-year term for standard setups, while more complex, higher-volume businesses switch to a variable platform fee Shopify doesn't publish. Shopify for enterprise, which lets large businesses use the full platform or modular components, is priced through sales.

When a Custom Build Is the Right Call

The strongest argument for custom is a requirement Shopify can't meet. Shopify's developer documentation draws that line itself, and the answer it gives is headless, which keeps its backend and checkout.

Between a theme and a fully custom build there are three middle paths:

• Headless with Hydrogen. Hydrogen is Shopify's headless toolkit; it works with frameworks that run server code, such as Next.js, React Router, Nuxt, Astro and SvelteKit, and Shopify's October 2026 release notes say React Router and Next.js have starters and you can host anywhere, including Oxygen, which is still free.
• Shopify for enterprise. Large businesses can use modular components, including a Storefront Component for building custom storefronts on their preferred framework and hosting provider.
• Shopify on the site you keep. The Buy Button or the Storefront API adds selling to an existing website without rebuilding it, the third path covered in our guide to adding Shopify to an existing website.

A fully custom build is the honest answer in a narrower case: when the payment page or the commerce backend itself must be your own code, because even headless keeps Shopify's checkout. That choice is sound when someone on your side will carry the PCI work it brings, which per Stripe can be SAQ A with Checkout or Elements, SAQ A-EP if fields on your own site outside Stripe's iframe pass card data through Stripe.js v2, the site itself not receiving it, and SAQ D if your server sends card data to its API. When headless is enough on its own is weighed in our guide to when headless Shopify makes sense.

Not sure yet who you would hire for any of these? Our Shopify development hub routes you to the right guide in about a minute.

Which Route Fits Your Store?

The table at the top answers by profile. This answers by combination: what your storefront needs, whether the payment page must be your own code, and who will carry security and compliance after launch. Each route moves a different set of duties onto you.

Before You Commit to a Custom Build

Which of the nine steps are yours depends on the route:

• Custom build: all nine.
• Headless: the payment page stays on Shopify's checkout, so step one becomes a choice between Shopify Payments and a third-party provider and steps three to five apply only to the storefront you host; steps two and six to nine stay.
• Shopify plan: step two, because you still validate your own compliance, typically with an acquirer or the payment brands, and steps six to nine: tax, fraud screening, disputes, and the handover of code, data and accounts.
• Shopify on the site you keep: checkout stays Shopify's, so steps two and six to nine apply as on a Shopify plan, and steps three to five apply only to the pages of your own site that load the store.

The Bottom Line

Flexibility and the absence of a platform fee are real benefits of a custom build. They come with a set of duties that a Shopify plan carries today, and with a few that never left you on either route.

Frequently Asked Questions