Shopify ScriptTag Checker - Will My Store Break on 1 March 2027?

Find out which scripts on a Shopify store stop running on 1 March 2027, and which app vendor is behind each one: $0.01 per store, 500 stores = $5. Paste Shopify store domains (or a link to a CSV file) and get one row per store: the ScriptTags Shopify injects into the storefront today, the vendors behind them, a risk level (none / low / high), whether the store still uses legacy customer accounts, and plain-English steps for what to do.

Run it now: press Start - the prefilled input checks a public Shopify demo store in a few seconds. Replace it with your own store or a whole client list, set a Maximum charge if you like (500 stores = $5), and download the rows as JSON, CSV or Excel. Stores that cannot be checked are free.

Why this matters now

Shopify has announced two changes that break stores silently:

• ScriptTags stop on 1 March 2027. Since 1 October 2026 apps can no longer create or update script tags, and on 1 March 2027 Shopify stops injecting the existing ones into storefronts. Any app that still loads its widget, popup, review box or tracking code through a ScriptTag stops working on that date unless its vendor moves to a theme app extension (app embed) or a web pixel. (Shopify changelog)
• Legacy customer accounts are deprecated. New stores cannot use them, feature updates have stopped, and the final sunset date will be announced later in 2026. (Shopify changelog)

Script tags do not show up in the theme editor, so many merchants do not know which of their apps still use one. This Actor reads what the public storefront serves and tells you.

What one row looks like

Illustrative output with a placeholder store name and vendors:

Store	Risk	ScriptTags	Vendors behind them	Legacy accounts	What to do first
store-a.example.com	high	3	klaviyo.com, nfcube.com, trustpilot.com	no	Ask each vendor for a theme app extension or web pixel
store-b.example.com	low	0	-	yes	Plan the upgrade to the new customer accounts
store-c.example.com	none	0	-	no	Nothing to do
store-d.example.com	-	-	-	-	status not_shopify (free)

{
  "input": "store-a.example.com",
  "store": "https://store-a.example.com",
  "status": "ok",
  "riskLevel": "high",
  "scriptTagCount": 3,
  "thirdPartyScriptTagCount": 3,
  "scriptTagUrls": [
    "https://static.klaviyo.com/onsite/js/klaviyo.js",
    "https://cdn.nfcube.com/instafeed-0000.js",
    "https://ecommplugins-scripts.trustpilot.com/v2.1/js/header.min.js"
  ],
  "vendorHosts": ["static.klaviyo.com", "cdn.nfcube.com", "ecommplugins-scripts.trustpilot.com"],
  "appEmbedCount": 4,
  "legacyCustomerAccounts": false,
  "legacyCustomerAccountsEvidence": "/account/login redirects to shopify.com/<shop id>/account (new customer accounts).",
  "whatWillStopOn1March2027": "3 ScriptTags from 3 vendors (klaviyo.com, nfcube.com, trustpilot.com) load on your storefront today. Shopify stops injecting script tags into storefronts on 1 March 2027; unless the app vendor moves its script to a theme app extension (app embed) or a web pixel, these scripts stop running on that date and the feature they power (for example a popup, widget, tracking or review box) disappears.",
  "whatToDo": [
    "Ask each app vendor (klaviyo.com, nfcube.com, trustpilot.com) whether its latest version uses a theme app extension (app embed) or a web pixel instead of a ScriptTag, and update or reinstall the app if it does.",
    "In the theme editor, open App embeds and switch the embed on after the update; some apps need this one click to start working again.",
    "Replace apps whose vendor has no migration plan well before 1 March 2027, and remove apps you no longer use."
  ],
  "checkedAt": "2026-10-24T09:00:00.000Z"
}

Who it is for

• Shopify agencies and freelancers who look after many client stores and want a ready-made "which stores need work before March" list for outreach or upgrade projects.
• Shopify app vendors that want to see which stores still run their ScriptTag.
• Store owners and operators with one or several stores who want to know which apps to ask about.

What it checks

Part	What is read	Result
ScriptTags	The public home page: Shopify lists every ScriptTag it injects in the page header	scriptTagUrls, scriptTagCount, vendorHosts, thirdPartyScriptTagCount
Theme app extensions	Files from cdn.shopify.com/extensions/... on the home page	appEmbedCount (informational: this is the supported replacement and is not affected)
Customer accounts	The first answer of /account/login	legacyCustomerAccounts: true (the store serves the classic login form itself), false (it redirects to the new customer accounts) or "unknown", with legacyCustomerAccountsEvidence
Verdict	All of the above	riskLevel, whatWillStopOn1March2027, whatToDo

Risk level: high = at least one ScriptTag served by an app vendor. low = no third-party ScriptTag, but Shopify-hosted or own-domain ScriptTags, or legacy customer accounts. none = nothing found on the page.

Input

• Shopify stores: domains or any URL on the store, one per line. Duplicates are checked once. Up to 5,000 per run.
• CSV link (optional): a public https link to a CSV or text file with one store per line; the first domain or URL on each line is used.
• Stores in parallel and pause between requests: defaults 5 stores at a time and 800 ms.

Price

$0.01 per store checked (pay per event: one store-checked event per store with status ok). 100 stores = $1, 500 stores = $5, 1,000 stores = $10. Apify plan discounts apply on top (Bronze -10%, Silver -20%, Gold and above -30%). Everything else is free: robots_disallowed, blocked, rate_limited, unreachable, not_shopify, unreadable, duplicate and invalid_input rows are not charged. Set a Maximum charge on the run and it stops cleanly when the budget is used up. Apify's small per-run platform fee applies to every Actor.

FAQ

How can a public page show which scripts are ScriptTags?

Shopify injects ScriptTags into the storefront through a list in the page header (an asyncLoad function with the script addresses). That list is part of every page the shop serves, so it can be read without a login. Scripts from theme app extensions load from cdn.shopify.com/extensions/..., and scripts written into the theme are ordinary <script> tags in the page body; neither is in the list, so they are not counted as ScriptTags.

Does it see everything?

No. It reads the home page. Scripts that only load on other page types (a product page, the cart) or that are limited to the checkout and order status pages are not visible there. A clean result means nothing was found on the home page, not that the whole store is safe. Run the check again after app updates.

What does "third-party" mean?

A ScriptTag whose address belongs to an app vendor, as opposed to Shopify itself or the store's own domain. When Shopify serves a script through its own proxy (cdn.shopify.com/proxy/...), the vendor host behind the proxy is shown. Scripts hosted on a generic cloud address (for example a cloudfront.net address) are shown with the full host, because the address does not name the app; the page where you find the app is your Shopify admin.

How does it know if a store uses legacy customer accounts?

Stores with the new customer accounts send /account/login to a Shopify-run sign-in page (shopify.com/<shop id>/account, an account. host of the store, or an /authentication/ address). Stores with legacy accounts show the classic login form from the theme itself. The Actor only looks at that first answer and does not follow the redirect. If the store's robots.txt does not allow /account/login, the answer is "unknown".

Is it a legal or compliance check?

No. It reports what the public storefront serves today and what Shopify has announced; it is not legal advice and it cannot see your Shopify admin. For the final word on a script, ask the app vendor.

How much for 1,000 stores?

$10 at the list price of $0.01 per store, less with an Apify plan discount, and less still if some stores cannot be checked, because those rows are free. A run of 1,000 stores takes roughly 15 minutes at the default settings.

Polite by design

The robots.txt of every store is read first and obeyed: if it does not allow this robot to read the home page, nothing else is requested (robots_disallowed). About three requests per store (robots.txt, the home page, the first answer of /account/login; a fourth only when the login page sends the visitor to the store's own home page), one request at a time per store with a pause between them, the store's Crawl-delay honoured up to 10 seconds, a clear user agent (ShopifyScriptTagChecker/1.0), no proxy, no retry after an HTTP 403 or 429, and no attempt to get around bot protection. Nothing behind a login is read.

Found this useful? A short review on the Actor's Store page helps other store owners find it and tells us what to improve next.