Shopify Code Audits for Themes, Apps and Integrations

An audit is only as useful as the plan it leaves behind. The report should be something another developer could pick up and work through without phoning the auditor.

Ask for a sample report before anything else. An anonymised report from a recent audit shows the depth you'll get. Each finding should name the file, app or setting involved, explain why it matters and rate its severity. A branded export of a free speed test doesn't count.

Insist on a remediation plan with hours. Every finding needs an effort estimate and an owner: a change your team can make in the admin, a developer task, or a decision only you can take. Findings should be sorted into fix now, fix with the next theme update, and leave alone. That last group matters, because not every old snippet is worth paying to remove.

Keep the audit separate from the fix. Buy the audit at a fixed fee and treat remediation as a separate quote. Ask the auditor whether they're comfortable with another developer doing the work. If the report reads like a pitch for a rebuild, get a second opinion before you commit.

Match the auditor to your stack. A single-theme store with a dozen apps needs a strong theme developer. A Plus store with expansion stores, B2B, Functions and an ERP feed needs someone who has worked across all of those, and their sample report should show it.

Tell them what changed and when. The auditor works faster with a timeline: theme installs and updates, apps added and removed, agencies that have had access, integrations switched on. An afternoon spent on that list saves paid hours of detective work.

Red flags. A report produced entirely by automated scanners. A headless rebuild recommended before anyone has opened the code. No questions about integrations or who else works on the store. A request for your store owner password.

Several recent Shopify changes left code behind that still looks fine in the admin. An audit done today should check these by name.

Discount and shipping logic that relied on Scripts. Shopify stopped letting merchants edit or publish Scripts on 15 April 2026 and switched them off completely on 30 June 2026. On a Plus store, confirm that every tiered discount, shipping rule and payment filter Scripts used to handle now runs on Shopify Functions, and that promotional copy in the theme still matches what checkout does. Custom apps containing Functions need Shopify Plus; public apps with Functions work on any plan.

Tracking from the old checkout. Plus stores had until August 2025 to move checkout.liquid and Additional Scripts customisations off their post-purchase pages (Thank you and Order status). On other plans, those two pages stopped supporting Additional Scripts and script tags in August 2026, so purchase tracking and post-purchase snippets that lived there may have gone quiet. Checkout UI extensions on those two pages work on every plan.

Edits inside core theme files. Custom code written into the theme's own files turns every update into a manual merge, so stores stop updating. The audit should list each edit and say whether it can move into its own section or snippet.

Leftover app code and heavy tags. Uninstalling an app doesn't always remove the code it wrote into the theme. Third-party tags that load on every page should be listed with their cost in LCP, INP and CLS, the three Core Web Vitals.

Access and error handling. Flag accounts for former staff and past agencies, and apps holding order or customer permissions they no longer need. For each ERP, 3PL or marketing sync, ask what happens when a call fails: does anyone find out, or do orders quietly stop moving?

Audits are usually quoted as a fixed fee once the auditor has seen the size of the store and its stack. Typical ranges:

Most audits report on six areas, ending in a ranked plan: