Twelve stories broke on Ecommerce Paradise today, Friday, Oct. 9. Some have deadlines, some are active attacks, and a few are just noise with a number attached.
I ranked them by how much each one changes a decision, a setting, a budget or a plan. Each entry gives you the short version, why it matters, and one thing to do. Start at the top and stop when the stories stop applying to you.
1. Shopify Will Tax US Return Shipping Fees From Oct. 23
Shopify will start calculating sales tax on US return shipping fees on Oct. 23, per a changelog post from Sept. 25. It applies to merchants on Shopify Tax or Tax Platform. Shopify adds an estimated tax when a return is created and records the final amount when it is processed. Restocking and handling fees are excluded.
Why it matters: If you charge a flat fee to send back a treadmill or a sofa, that fee now carries a tax line, and any manual workaround you built last year can double-count it.
Do this: Ask your returns app vendor and whoever handles your sales tax, in writing, who owns that number after Oct. 23. Then run a test return that afternoon.
2. Ninja Forms Flaw Plants Hidden Admins on WordPress Stores
Patchstack reported Oct. 6 that attackers are exploiting stored XSS flaws in Ninja Forms (through 3.15.3) and WPC Product Bundles (through 8.6.6) to plant a hidden administrator on WordPress and WooCommerce sites. Nothing fires until an admin opens a poisoned order or form submission. Patches are out: Ninja Forms 3.15.4 and WPC Product Bundles 8.6.7.
Why it matters: Updating blocks new attacks but does not remove an account already installed. Shopify storefronts do not run these plugins, but a WordPress blog or quote site next to your store might.
Do this: Update both plugins today. Then look for a plugin folder named wp-smart-thumbnails and compare the administrators in your database against the Users screen. Any match means treat the site as compromised.
3. Illinois Tax Amnesty for Online Sellers Ends Oct. 31
Illinois is waiving penalties and interest on unpaid sales tax for out-of-state online sellers, but only if you apply and pay by Oct. 31. You qualify at $100,000 or more in Illinois gross receipts. The payment is a flat 9% on general merchandise and covers sales from Jan. 1, 2021 through June 30, 2026. Applications run through MyTax Illinois only.
Why it matters: At a $3,500 average order, $100,000 is about 29 orders. On $350,000 of untaxed Illinois sales, my math says 9% is $31,500, while a 15% audit rate is $52,500 before penalties.
Do this: Export every Illinois order since 2021 today and register with MyTax Illinois, which takes one to two business days. Then call your CPA. I am not a tax advisor.
4. Treasury Yield Hits 24-Year High. Check Your Credit Lines
The 10-year Treasury yield hit about 5.35% on Oct. 7, its highest since 2002. Fed minutes that day said most participants expect another rate increase by year end. Prime moved to 7.00% on Sept. 17 after the Fed’s Sept. 16 hike. September CPI lands Oct. 14, and the Fed meets Oct. 27 and 28.
Why it matters: Lines of credit and variable cards follow prime. The hike is small money, but $40,000 of ad spend carried on a 21% card costs $8,400 a year, and buyers who finance feel higher rates too.
Do this: List every floating-rate balance and pay down the highest APR first. Then check what your financing provider now charges you on any 0% promo before you extend it.
5. Google’s Spam Update Ended After 14 Days: Check Now
Google said its September 2026 spam update finished rolling out on Oct. 8 after 14 days, much longer than earlier 2026 spam updates. Google gave no share of queries affected and named no new policy. Early reports lean toward publishers, and I found no published ecommerce case study yet.
Why it matters: Your Search Console data is finally clean enough to compare. That comparison decides whether you rewrite pages, hold still, or spend more on ads this month.
Do this: Export clicks for Aug. 27 to Sept. 23 as your baseline, then wait until about Oct. 16 for a full post-update week. Freeze bulk page publishing until you have it.
Tax deadlines, plugin patches and rate hikes are a lot to run alone. Want my team to build and run your high-ticket store for you? See the turnkey done-for-you service →
6. ChatGPT Ad Clicks Cost 6x Google’s, Measured Estimates
Modern Retail reported Oct. 9 that Measured estimates ChatGPT ad clicks cost about six times Google’s. Sensor Tower counted more than 1,400 advertisers in August, and brands cannot target by demographic. Most are keeping holiday budgets on Meta and search. Shopify merchants can launch campaigns from an OpenAI app.
Why it matters: In my hypothetical, a $9 click on a $2,000 product at 25% margin needs a 1.8% conversion rate to break even. A $1.50 Google click needs 0.3%.
Do this: Do not move budget out of Google Shopping or Meta. If you test, cap it near 2% of monthly ad spend, give ChatGPT its own UTM source, and write your stop rules before you start.
7. Google Ads Lets You Preview AI Max Ad Copy
Search Engine Land reported Oct. 8 that Google Ads can now preview up to 10 AI-written headlines and descriptions before you turn on AI Max text customization. The samples are not necessarily the lines that serve, and Google refreshes generated assets at least every 48 hours.
Why it matters: The AI writes from your landing page, so it repeats prices, financing terms and shipping promises, including offers you quietly ended. On a $2,000 order, one wrong claim becomes a refund request or a dispute.
Do this: Run the preview on your best category page and flag every claim about price, financing or warranty. Fix the page first, then check the asset details report weekly.
8. Court Certifies Tariff Refund Class for Non-Plaintiffs
The Court of International Trade certified a class on Oct. 8 in Freestyle World v. United States. It covers importers of record that paid IEEPA tariffs between Feb. 1, 2025 and Feb. 19, 2026 and have not filed their own suits. The Justice Department is still appealing, and a closed conference is set for Oct. 13.
Why it matters: Certification is not a payment. It is a possible second door if the appeal goes against non-plaintiffs, and it only matters if your LLC, not your supplier, was the importer of record.
Do this: Ask your customs broker for every entry tagged by liquidation status. Then get trade counsel’s view on suing versus waiting for the class. I am not a lawyer.
9. Amex Hit With $350M AML Penalty: What Store Owners Do Next
The OCC announced a $350 million penalty against American Express National Bank on Oct. 8 over anti-money-laundering failures tied to about $13 billion in suspected trade-based money laundering. The Fed issued a separate order. There is no asset cap, and nothing reported changes cardholder terms today.
Why it matters: My read is that a bank rebuilding its monitoring flags more unusual payments, and ad spend spikes and big supplier invoices look unusual. One card carrying more than half your spend is a single point of failure.
Do this: Map 60 days of charges by card and processor. Then open a second issuer card and a backup business bank account while nothing is broken.
10. FTC Closes Gildan and S&S Pricing Probe
The FTC closed its Robinson-Patman probe of Gildan and S&S Holdings on Oct. 8 after the companies amended a contract that barred Gildan from giving S&S’s rivals certain discounts. There was no penalty. It followed the Oct. 2 settlement with Southern Glazer’s Wine and Spirits.
Why it matters: Your dealer margin is set upstream by tier, rebates and contract clauses. My bet is supplier counsel are re-reading dealer agreements this month, which can help a well-documented dealer.
Do this: Ask your top five suppliers for their written dealer tier schedules. Flag any clause about exclusivity or rebates and have an attorney read it.
11. Unauthorized Google Certificates: Lock Your Store Domain
Google said Oct. 6 that attackers compromised the registries behind the .gh, .sl and .as country domains and obtained at least 12 unauthorized HTTPS certificates for Google and YouTube domains. The certificates are revoked and Chrome blocks them. No fraud against stores has been reported.
Why it matters: Whoever controls your DNS can get a browser-trusted padlock for your brand, so a cloned checkout shows no warning. For most stores the exposure is the registrar login, not a country registry.
Do this: Turn on two-factor sign-in and the registrar lock, list every domain you own, and search Certificate Transparency logs for certificates you did not order. Check Shopify’s current guidance before adding a CAA record.
12. TikTok Shop’s Median Top Seller Costs About $40
Marketplace Pulse’s TikTok Shop report, published Oct. 9 on more than 150,000 U.S. sellers, puts the median top product at around $40, with beauty near 30% of revenue. TikTok’s Buy Direct one-click checkout and AI Shopping Assistant are in advertiser testing with no launch date.
Why it matters: At a 22% margin, a $1,800 patio set earns about $396 gross and a $40 item earns $8.80 (hypothetical). TikTok sells things people grab mid-scroll.
Do this: Keep products above $500 off TikTok Shop for now. Use TikTok for discovery, cap the test near 10% of ad budget for 30 days, and close sales on your own site and phone line.
Want to work through today’s list with other store owners and me inside the community? Join the Skool community →
That is today’s list. New stories land through the day tomorrow, and I will roll them up here again. If you only have ten minutes, do two things: check your WordPress plugin versions and put Oct. 23 on the calendar for the Shopify tax change. Subscribe to the YouTube channel for daily breakdowns.
Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.
He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.
