# Shopify ScriptTag Checker - Will My Store Break? (`highbrow_fame/shopify-script-tag-checker`) Actor

Will your Shopify store break on 1 March 2027? Lists the ScriptTags Shopify stops injecting, the app vendors behind them and legacy customer accounts ($0.01 per store)

- **URL**: https://apify.com/highbrow_fame/shopify-script-tag-checker.md
- **Developed by:** [yestrue](https://apify.com/highbrow_fame) (community)
- **Categories:** E-commerce, SEO tools, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $7.00 / 1,000 store checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Shopify ScriptTag Checker - Will My Store Break on 1 March 2027?

**Find out which scripts on a Shopify store stop running on 1 March 2027, and which app vendor is behind each one: $0.01 per store, 500 stores = $5.** Paste Shopify store domains (or a link to a CSV file) and get one row per store: the ScriptTags Shopify injects into the storefront today, the vendors behind them, a risk level (none / low / high), whether the store still uses legacy customer accounts, and plain-English steps for what to do.

**Run it now:** press **Start** - the prefilled input checks a public Shopify demo store in a few seconds. Replace it with your own store or a whole client list, set a *Maximum charge* if you like (500 stores = $5), and download the rows as JSON, CSV or Excel. Stores that cannot be checked are free.

### Why this matters now

Shopify has announced two changes that break stores silently:

- **ScriptTags stop on 1 March 2027.** Since 1 October 2026 apps can no longer create or update script tags, and on 1 March 2027 Shopify stops injecting the existing ones into storefronts. Any app that still loads its widget, popup, review box or tracking code through a ScriptTag stops working on that date unless its vendor moves to a theme app extension (app embed) or a web pixel. ([Shopify changelog](https://shopify.dev/changelog/online-store-script-tags-deprecation))
- **Legacy customer accounts are deprecated.** New stores cannot use them, feature updates have stopped, and the final sunset date will be announced later in 2026. ([Shopify changelog](https://shopify.dev/changelog/legacy-customer-accounts-are-deprecated))

Script tags do not show up in the theme editor, so many merchants do not know which of their apps still use one. This Actor reads what the public storefront serves and tells you.

### What one row looks like

Illustrative output with a placeholder store name and vendors:

| Store | Risk | ScriptTags | Vendors behind them | Legacy accounts | What to do first |
| --- | --- | --- | --- | --- | --- |
| `store-a.example.com` | high | 3 | klaviyo.com, nfcube.com, trustpilot.com | no | Ask each vendor for a theme app extension or web pixel |
| `store-b.example.com` | low | 0 | - | yes | Plan the upgrade to the new customer accounts |
| `store-c.example.com` | none | 0 | - | no | Nothing to do |
| `store-d.example.com` | - | - | - | - | status `not_shopify` (free) |

```json
{
  "input": "store-a.example.com",
  "store": "https://store-a.example.com",
  "status": "ok",
  "riskLevel": "high",
  "scriptTagCount": 3,
  "thirdPartyScriptTagCount": 3,
  "scriptTagUrls": [
    "https://static.klaviyo.com/onsite/js/klaviyo.js",
    "https://cdn.nfcube.com/instafeed-0000.js",
    "https://ecommplugins-scripts.trustpilot.com/v2.1/js/header.min.js"
  ],
  "vendorHosts": ["static.klaviyo.com", "cdn.nfcube.com", "ecommplugins-scripts.trustpilot.com"],
  "appEmbedCount": 4,
  "legacyCustomerAccounts": false,
  "legacyCustomerAccountsEvidence": "/account/login redirects to shopify.com/<shop id>/account (new customer accounts).",
  "whatWillStopOn1March2027": "3 ScriptTags from 3 vendors (klaviyo.com, nfcube.com, trustpilot.com) load on your storefront today. Shopify stops injecting script tags into storefronts on 1 March 2027; unless the app vendor moves its script to a theme app extension (app embed) or a web pixel, these scripts stop running on that date and the feature they power (for example a popup, widget, tracking or review box) disappears.",
  "whatToDo": [
    "Ask each app vendor (klaviyo.com, nfcube.com, trustpilot.com) whether its latest version uses a theme app extension (app embed) or a web pixel instead of a ScriptTag, and update or reinstall the app if it does.",
    "In the theme editor, open App embeds and switch the embed on after the update; some apps need this one click to start working again.",
    "Replace apps whose vendor has no migration plan well before 1 March 2027, and remove apps you no longer use."
  ],
  "checkedAt": "2026-10-24T09:00:00.000Z"
}
```

### Who it is for

- **Shopify agencies and freelancers** who look after many client stores and want a ready-made "which stores need work before March" list for outreach or upgrade projects.
- **Shopify app vendors** that want to see which stores still run their ScriptTag.
- **Store owners and operators** with one or several stores who want to know which apps to ask about.

### What it checks

| Part | What is read | Result |
| --- | --- | --- |
| ScriptTags | The public home page: Shopify lists every ScriptTag it injects in the page header | `scriptTagUrls`, `scriptTagCount`, `vendorHosts`, `thirdPartyScriptTagCount` |
| Theme app extensions | Files from `cdn.shopify.com/extensions/...` on the home page | `appEmbedCount` (informational: this is the supported replacement and is not affected) |
| Customer accounts | The first answer of `/account/login` | `legacyCustomerAccounts`: `true` (the store serves the classic login form itself), `false` (it redirects to the new customer accounts) or `"unknown"`, with `legacyCustomerAccountsEvidence` |
| Verdict | All of the above | `riskLevel`, `whatWillStopOn1March2027`, `whatToDo` |

**Risk level:** `high` = at least one ScriptTag served by an app vendor. `low` = no third-party ScriptTag, but Shopify-hosted or own-domain ScriptTags, or legacy customer accounts. `none` = nothing found on the page.

### Input

- **Shopify stores**: domains or any URL on the store, one per line. Duplicates are checked once. Up to 5,000 per run.
- **CSV link** (optional): a public https link to a CSV or text file with one store per line; the first domain or URL on each line is used.
- **Stores in parallel** and **pause between requests**: defaults 5 stores at a time and 800 ms.

### Price

**$0.01 per store checked** (pay per event: one `store-checked` event per store with status `ok`). 100 stores = $1, 500 stores = $5, 1,000 stores = $10. Apify plan discounts apply on top (Bronze -10%, Silver -20%, Gold and above -30%). Everything else is free: `robots_disallowed`, `blocked`, `rate_limited`, `unreachable`, `not_shopify`, `unreadable`, `duplicate` and `invalid_input` rows are not charged. Set a *Maximum charge* on the run and it stops cleanly when the budget is used up. Apify's small per-run platform fee applies to every Actor.

### FAQ

#### How can a public page show which scripts are ScriptTags?

Shopify injects ScriptTags into the storefront through a list in the page header (an `asyncLoad` function with the script addresses). That list is part of every page the shop serves, so it can be read without a login. Scripts from theme app extensions load from `cdn.shopify.com/extensions/...`, and scripts written into the theme are ordinary `<script>` tags in the page body; neither is in the list, so they are not counted as ScriptTags.

#### Does it see everything?

No. It reads the home page. Scripts that only load on other page types (a product page, the cart) or that are limited to the checkout and order status pages are not visible there. A clean result means nothing was found on the home page, not that the whole store is safe. Run the check again after app updates.

#### What does "third-party" mean?

A ScriptTag whose address belongs to an app vendor, as opposed to Shopify itself or the store's own domain. When Shopify serves a script through its own proxy (`cdn.shopify.com/proxy/...`), the vendor host behind the proxy is shown. Scripts hosted on a generic cloud address (for example a `cloudfront.net` address) are shown with the full host, because the address does not name the app; the page where you find the app is your Shopify admin.

#### How does it know if a store uses legacy customer accounts?

Stores with the new customer accounts send `/account/login` to a Shopify-run sign-in page (`shopify.com/<shop id>/account`, an `account.` host of the store, or an `/authentication/` address). Stores with legacy accounts show the classic login form from the theme itself. The Actor only looks at that first answer and does not follow the redirect. If the store's robots.txt does not allow `/account/login`, the answer is `"unknown"`.

#### Is it a legal or compliance check?

No. It reports what the public storefront serves today and what Shopify has announced; it is not legal advice and it cannot see your Shopify admin. For the final word on a script, ask the app vendor.

#### How much for 1,000 stores?

$10 at the list price of $0.01 per store, less with an Apify plan discount, and less still if some stores cannot be checked, because those rows are free. A run of 1,000 stores takes roughly 15 minutes at the default settings.

### Polite by design

The robots.txt of every store is read **first** and obeyed: if it does not allow this robot to read the home page, nothing else is requested (`robots_disallowed`). About three requests per store (robots.txt, the home page, the first answer of `/account/login`; a fourth only when the login page sends the visitor to the store's own home page), one request at a time per store with a pause between them, the store's Crawl-delay honoured up to 10 seconds, a clear user agent (`ShopifyScriptTagChecker/1.0`), no proxy, no retry after an HTTP 403 or 429, and no attempt to get around bot protection. Nothing behind a login is read.

Found this useful? A short review on the Actor's Store page helps other store owners find it and tells us what to improve next.

# Actor input Schema

## `stores` (type: `array`):

Store domains or any URL on the store, one per line (example-store.com or https://example-store.com/products/x). Each store is reduced to its address; duplicates are checked once. Up to 5,000 per run.

## `csvUrl` (type: `string`):

Optional. A public https link to a CSV or text file with one store per line; the first cell on each line that is a domain or URL is used. Stores from the list above and from the file are merged.

## `maxConcurrency` (type: `integer`):

Different stores are checked at the same time; one store is only ever asked one thing at a time, with a pause between its requests.

## `delayMs` (type: `integer`):

Pause between two requests to the same store. A longer Crawl-delay in the store's robots.txt is used instead, up to 10 seconds.

## Actor input object example

```json
{
  "stores": [
    "theme-dawn-demo.myshopify.com"
  ],
  "maxConcurrency": 5,
  "delayMs": 800
}
```

# Actor output Schema

## `results` (type: `string`):

Every result as a JSON record, with a status for each input.

## `resultsCsv` (type: `string`):

The same records as CSV, for a spreadsheet.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "stores": [
        "theme-dawn-demo.myshopify.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("highbrow_fame/shopify-script-tag-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "stores": ["theme-dawn-demo.myshopify.com"] }

# Run the Actor and wait for it to finish
run = client.actor("highbrow_fame/shopify-script-tag-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "stores": [
    "theme-dawn-demo.myshopify.com"
  ]
}' |
apify call highbrow_fame/shopify-script-tag-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,highbrow_fame/shopify-script-tag-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/0L4mdrLbMVQ9vR638/builds/ulcHQcsX4TsG8c1hu/openapi.json