Shopify Scripttag Migration Auditor avatar

Shopify Scripttag Migration Auditor

Pricing

from $2.00 / 1,000 store auditeds

Go to Apify Store
Shopify Scripttag Migration Auditor

Shopify Scripttag Migration Auditor

Scan public Shopify storefronts for legacy ScriptTags before the March 2027 shutdown. Identify asyncLoad() scripts, check URL reachability, and flag possible app-extension replacements. No Shopify Admin access required; findings require manual verification.

Pricing

from $2.00 / 1,000 store auditeds

Rating

0.0

(0)

Developer

Michaelangelo Couvertier

Michaelangelo Couvertier

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

a day ago

Last modified

Categories

Security

Limited permissions

Share

Identify legacy Shopify Online Store ScriptTags that may require attention before Shopify stops injecting them on March 1, 2027. Built for Shopify agencies, developers, and merchants performing migration triage across multiple storefronts.

What it does: Scans public HTML, identifies Shopify theme signals, extracts URLs from legacy asyncLoad() loaders, checks whether script URLs are reachable, and reports possible Theme App Extension replacements. No merchant login is required for this public-page review.

What it does not do: It cannot determine whether a script executes successfully, whether the merchant needs its functionality, whether the associated app has already migrated internally, or whether a replacement behaves identically. Do not treat the output as a completed migration certification.

What you receive

Each scanned URL produces a dataset record with:

  • The storefront URL, Shopify identity assessment, theme indicators, and scanned page types.
  • Legacy asyncLoad() ScriptTags, source URL, recognized app/vendor when available, HTTP status, and evidence category.
  • Potential replacement assets found in public HTML, including their HTTP reachability (not functional verification).
  • Counts of reachable scripts lacking a detected replacement, candidate dual-loads, unreachable or unprobed scripts, and dead script URLs.
  • An agency action plan and coverage limitations to guide follow-up.
  • Estimated billing-event selection and, when monetization is enabled, actual charge-attempt telemetry.

How to interpret the main categories

FindingMeaningSuggested follow-up
Reachable legacy script, no replacement detectedScript URL returned HTTP 200/206; a replacement was not visible in the inspected templatesConfirm app ownership and its current integration in Shopify Admin; check migration requirements
Candidate dual-loadA possible replacement asset or pixel is visible, but functional parity is unverifiedTest the modern integration in a preview theme before removing the legacy tag
Unreachable or unprobed scriptHTTP checks failed, were blocked, or were disabledRetry or investigate manually; this is not a verified failed integration
Dead legacy scriptScript URL returned HTTP 404/410Check whether app is abandoned and whether removal is safe
Unverified storefrontInsufficient HTML evidence, password protection, WAF, or headless/custom storefrontManual verification needed; do not interpret zero findings as a clean migration

Run the Actor

  1. Enter a public Shopify storefront URL (or a batch of URLs) in Storefront URLs to Audit.
  2. Keep Probe HTTP Liveness enabled to distinguish reachable URLs from uncertain ones.
  3. Keep Multi-Template Scan enabled. It follows available links to up to one product, collection, and cart page in addition to the homepage.
  4. Use a modest Max Concurrent Storefront Workers setting, such as 2–5, especially for first-time audits.
  5. Start the Actor. Inspect the Dataset tab for the resulting storefront-level records.

Example input:

{
"storeUrls": ["https://www.allbirds.com"],
"verifyScriptLiveness": true,
"scanProductPage": true,
"maxConcurrency": 2,
"useApifyProxy": false
}

The example is a public website used in the November 2026 pilot. Its live output may change at any time. Use your own storefront list for operational work.

Real-world pilot

On November 5, 2026, the scanner identified legacy asyncLoad() URLs on three accessible Shopify-theme storefronts: 2 on Allbirds, 6 on tentree, and 4 on Brooklinen, all returning HTTP 200 at the time of testing. They were twelve reachable migration-review candidates, not twelve confirmed broken integrations or paid remediation opportunities. Other sites were correctly or cautiously classified as non-Shopify, headless/custom, or inconclusive. This small nonrandom pilot does not establish detection accuracy.

Scope and limitations

  • Public HTML only: no Shopify Admin API access, authenticated theme inspection, full ScriptTag inventory, app installation inventory, or browser-based runtime event testing.
  • The tool extracts recognized legacy asyncLoad() patterns; scripts loaded through different mechanisms may not appear.
  • The four template types are sampled only when public links are discoverable. Missing templates remain out of scope.
  • A response of HTTP 200/206 proves file reachability, not execution, merchant reliance, or future failure.
  • A matching extension asset proves reachability, not functional replacement. An absent match does not prove the app has no replacement.
  • Bot defenses, passwords, redirects, and custom/headless architecture can produce inconclusive results.
  • Vendor signatures are heuristics for triage, not a verified map of every installed merchant app.
  • Follow the site's access policies and scan responsibly.

Pricing and publication

The Actor is in a private pilot as of November 5, 2026. Its Apify account currently reports the pricing model as FREE; code-level billing telemetry is not proof of customer revenue. If published as Pay Per Event, the intended mutually exclusive event configuration is:

EventIntended priceCondition
store-audited$0.002Confirmed Shopify theme, probing enabled, no reachable unmatched legacy script
confirmed-live-unmigrated-lead$0.005Confirmed theme with one or more reachable legacy script URLs and no detected replacement
No event$0Non-Shopify, unverified, blocked or probing disabled

Prices only become effective when configured in Apify Console → Publishing → Monetization. Check the live Pricing tab before running a published Actor. Pricing is per store, not per ScriptTag.

Technical details

Python 3.11; Apify Python SDK 4.2; public HTTP requests with a single DNS resolution and direct IP-pinned connections (direct mode), SSRF-protected redirects, decompression guards, scoped page parsing, and locally reproducible tests.

For implementation-level validation, see VALIDATION.md in the private source repository. The Actor does not modify the merchant storefront.

Shopify source: https://shopify.dev/docs/apps/build/online-store/script-tag-deprecation/storefront