Shopify Narrows Its Leave-Store Warning to Risky Sites

By
Shopify Narrows Its Leave-Store Warning to Risky Sites
Shopify Narrows Its Leave-Store Warning to Risky Sites
Affiliate disclosure: This post contains affiliate links. If you buy through them, I may earn a commission at no extra cost to you. Full disclosure

Shopify narrowed its leave-store warning on Friday so storefronts now block only known malicious sites and confirm only suspicious ones.

If you run a high-ticket store, this is your close rate. Your buyers leave your pages for financing applications, quote forms, scheduling tools and second storefronts before they spend $3,000 or more, and the first version of this prompt sat in front of those clicks. According to Shopify’s changelog, most outbound clicks now go straight through.

I covered the original rollout here at Ecommerce Paradise on October 21. That post is the baseline for everything below, and I linked it in the background section so you can compare the two versions side by side.

The sections that follow cover the exact change, why merchants were angry on day one, what I think it does to your conversion math, and five checks to run before Monday.

Shopify keeps rewriting the rules under your storefront, so the entity behind it should be the one thing that never changes. Form your LLC with Northwest Registered Agent, the best LLC formation service for ecommerce owners. Northwest charges the same renewal price you paid in year one, with no upsell ladder, which is how cheap formation sites make their money back. Form your LLC with Northwest →

Shopify’s Oct. 23 Update Limits Leave-Store Prompts to Risky Sites

Shopify posted the original change to its changelog on October 20. The text said an online store now asks customers to confirm before sending them to an outside website. The customer sees the destination address and can continue or go back, per the Shopify changelog entry on unexpected redirects.

The same entry now shows an update dated October 23. Under the revised text, the store blocks only sites Shopify has identified as malicious. It asks for confirmation on sites it considers suspicious. It sends customers straight to every other site with no message.

Two exemptions carry over from the first version. Domains connected to your store do not trigger anything, and neither do supported Shopify and social websites. Websites you own but have not connected to your store can still trigger the message, according to the changelog.

The changelog lists no required steps for merchants. It also gives no reason for the narrowing, no count of sites flagged, and no figure for how many prompts shoppers saw during the first three days.

Shopify’s Help Center page on the feature tells a slightly older story. As of October 24, the Help Center article on leave-store confirmations describes a screen titled “Are you sure you want to leave [store name]?” with two buttons, “Back to [store name]” and “Go to site.” It says merchants cannot turn the message off or choose websites that skip it “at this time.” It also says the message does not mean the other site is unsafe. The page carries no date and does not mention a blocked screen.

A merchant who posted in the Shopify Community on October 23 described the newer behavior in more detail. User dimon4512 described a store that now shows a blocked screen with no option to continue for flagged sites, per the Shopify Community thread on outbound links. That description comes from a merchant citing the changelog, not from Shopify staff, and the Help Center page does not yet confirm it.

The exemption list on the Help Center page is the most useful part for planning. The message does not appear for your store’s domains and subdomains listed under Domains in admin, your checkout, Shopify pages such as customer accounts and Shop Pay, popular social networks including Facebook, Instagram, TikTok and YouTube, browser back and forward buttons, and email and phone links.

On the control question, the answer is unchanged. In a reply dated October 23 at 8:14 a.m., community user Daniel_Jude wrote that the confirmation is applied at the platform level and cannot be turned off in admin. He added that exemptions and triggers are controlled by Shopify. That is one forum member’s account, and no Shopify employee has contradicted it in the threads I read.

Why Merchants Pushed Back Within Hours of the Oct. 20 Launch

The reaction started on October 21. A merchant posting as CoastalWanderer in the Shopify Community wrote that the prompt appeared without notice and that Shopify Support said it could not be disabled or set to trust specific destinations. The poster called it “an unnecessary penalty,” according to the original Community thread asking for an opt-out.

Another user, gavin_turner, called the modal “clunky” and said it slows pages that carry many partner links. A third, rajimulislamjoy, said it could hurt customer trust and asked Shopify to consider a trusted-domain list. Later that evening CoastalWanderer wrote that it “looks like it has been resolved. A sitewide rollback.” Shopify has not confirmed a rollback, and the October 23 changelog text reads as a narrowing, not a removal.

A developer raised the multi-store case the same day. On the Shopify developer forum, a user named senabre reported that a country selector linking two storefronts on different domains triggered the prompt and that merchants could not mark the destination as trusted. A moderator closed that post as a duplicate, per the Shopify developer forum thread on trusting storefront domains. The thread it pointed to showed 21 replies and 1,246 views as of October 22.

The timing sits next to a bad two weeks for Shopify app security. Between October 10 and 14, three apps were reported hijacked to send shoppers from checkout to fake card-entry pages: Hulk Product Options, Selleasy and Swym Wishlist Plus. I walked through the details in my breakdown of the three hijacked Shopify apps.

Per iTnews, the Selleasy script ran from 07:47 to 15:00 UTC on October 13, and a Shopify spokesperson said on October 17 that “when an app falls short, we act.” The iTnews report on the hijacked extensions also covers an Australian store owner who closed her shop after a customer landed on a fake checkout.

Shopify has not said the leave-store prompt is a response to those incidents. Its stated purpose is protecting customers from unexpected redirects. I am noting the overlap, not claiming a cause.

Shopify also pushed guidance to developers in the same window, which I summarized in Shopify’s request that app developers harden their code. A separate Rank Math PRO backdoor showed the same pattern on the WordPress side.

A fair counterpoint exists. A warning before a redirect is a sensible defense against the exact attack that hit those apps, and even the harshest critics in the threads said phishing protection is reasonable. What they objected to was a blunt version with no control. The October 23 rewrite addresses part of that complaint, though not the request for a merchant-managed list. The first version of my coverage is at my October 21 post on the leave-store prompt.

What a Narrower Warning Does to a High-Ticket Store’s Close Rate

My read is that the October 23 version is good news for most high-ticket stores and a slow-burn risk for a few. The good news is simple. The click that matters most, a buyer heading to a financing application or a quote form, now passes through unless Shopify has flagged the destination.

The risk is that you do not control the flag. Shopify has not published what makes a site suspicious. The Help Center says nothing about an appeal path beyond contacting Support with the page, the site named and a screenshot. If a financing partner’s domain, a scheduling tool or a supplier’s spec-sheet host lands on the wrong list, your buyers hit a wall you cannot remove.

Here is the math, and it is hypothetical. It reuses the model from my first post. Say a store gets 20,000 sessions a month and 3% click an off-site link, which is 600 sessions. If the original blanket prompt made 15% of those shoppers quit, that is 90 lost sessions. At a 4% close rate that is 3.6 orders, and at a $2,800 average order it is about $10,080 in revenue. At a 20-30% gross margin, that is roughly $2,000 to $3,000 in gross profit a month.

Now apply the narrower rule. If only 1% of those 600 clicks go to a destination Shopify flags, the exposed sessions drop to 6. Even if every one of them quits, the same close rate and order value put the loss near $670 in revenue. The point is the shape of the change, not the exact dollars. Blanket friction on every outbound click becomes targeted friction on a handful. None of those inputs are reported figures. Plug in your own.

The threshold I would use: if more than about 2% of your sessions click one off-site link, that link deserves a phone test this week. Financing is the likeliest candidate. Wayfair expanded 0% APR financing through Klarna, which I covered in my Wayfair and Klarna financing post, and buyers now expect an installment option on a big purchase. Where you send them to apply matters.

Financing costs are moving too. I flagged the cost side in my Affirm yields post, and if your financing step is both costlier and potentially flagged, you want to know which problem is hitting you. A conversion drop on that link could be either one.

Scenario one: your off-site links all go to domains you own and have connected. Nothing changes and you can skip most of this. Scenario two: you link to a second store, a blog on a separate domain or a booking page you own but never connected in Shopify. The changelog says those can still trigger the message, and connecting them takes little time. Scenario three: you link to third-party partners. You cannot fix a flag on someone else’s domain, so you need a fallback, such as hosting the quote form on your own domain.

Phone sales are where this bites hardest. High-ticket buyers often call before they buy, and a warning that makes a legitimate link look risky works against the trust you built with a visible phone number. My guide to high-ticket sales follow-up covers what happens to the leads who do make it to a form.

The bigger lesson is concentration risk. Shopify changed checkout behavior, tax handling and catalog scheduling in the same week. I covered one piece of that in my post on Shopify taxing return shipping fees. Each change is small. Together they are a reminder that your store runs on someone else’s rules, and your process has to absorb a surprise a week.

The same logic applies to payments. If a platform change blocked your checkout path tomorrow, how fast could you reroute? I laid out a backup plan in my processor backup plan guide. A second payment rail through Airwallex is one option for stores that sell across borders.

Running these audits across a catalog, a second domain, financing partners and a dozen apps is the operator drag that wears owners down. It is also exactly the kind of work my team takes off your plate in the turnkey done-for-you build, where the store is built and run for you.

Outbound-link friction is one more leak to find in a store that already sells. Want my team to scale the store you already have? See the scaling service →

Five Link Checks to Run on Your Shopify Store Before Monday

These take under two hours for a typical store. Do them in order.

  1. Connect every domain you own. Open Settings, then Domains, in your Shopify admin and confirm every domain you link to is connected to the store. Per the changelog, connected domains do not trigger the message. If you need a domain you have not bought yet, Namecheap is one option for registering them.
  2. Click every off-site link on your phone. Check Online Store, then Navigation, plus links in pages, blog posts and product descriptions. Test financing, quote forms, spec sheets and booking pages. Write down any link that shows a prompt or a blocked screen.
  3. Pull a 30-day baseline. Export clicks on your key off-site links from your analytics, then compare the next 14 days against it. Track leads in HubSpot so form submissions tie to a source. My HubSpot setup guide for high-ticket stores covers the free CRM.
  4. Add a support macro. Tell customers to send a screenshot and the site named if they ever see a warning, which matches what Shopify’s Help Center asks merchants to collect for Support. A canned reply in Gorgias gets you the evidence in minutes. A quick prompt in Tidio live chat does the same.
  5. Audit your installed apps. A Shopify spokesperson told iTnews that merchants can review the activity and permissions of any app at any time. Remove anything you do not use, and read my chargeback prevention guide so you know what a hijacked checkout costs in disputes. If a prompt shows up after Add to cart or Checkout, check apps and theme code first, per Shopify’s Help Center.

Explore Turnkey Builds for service details and pricing. Email me with questions before getting started.

For payment-page scripts, the PCI Security Standards Council published an information supplement on March 10, 2025 covering requirements 6.4.3 and 11.6.1, which focus on authorizing and monitoring scripts on payment pages. The Council says it does not enforce compliance and tells merchants to work with their acquirers, per the PCI SSC blog post on payment page security. I am not a security or legal advisor, so take that to your processor.

Frequently Asked Questions

Can I turn off Shopify’s leave-store message?
No. Shopify’s Help Center says merchants cannot turn it off or choose sites that skip it at this time. A merchant in the Community thread reports the same from Support.

Does the message mean the other site is unsafe?
The Help Center says it does not. After the October 23 changelog update, a confirmation screen is meant for sites Shopify considers suspicious, so a prompt on a partner you trust is worth reporting.

Will a financing link to Affirm or Klarna trigger it?
Shopify has not said. Those domains are not on the Help Center exemption list, and the changelog says unflagged sites go straight through, so test on a phone. My Klarna and FreshBooks post covers another place Klarna shows up in a small-business workflow.

Do email links and phone links trigger the message?
No. The Help Center lists email links, phone links and the browser back and forward buttons as exempt. That keeps a mailto link or a call button on your contact page clear, and it means your Klaviyo flows are not the first place to look if clicks drop.

Is checkout affected?
The Help Center lists your checkout as exempt. The apps that run inside checkout are the bigger concern, and my Railway breach post covers the key-rotation side of that.

Did the app hijacks cause this change?
Shopify has not said so. The changelog describes the goal as protecting customers from unexpected redirects, and the timing overlaps with the October 10 to 14 incidents.

I am new to this. Where do I start?
Start with my primer on what high-ticket dropshipping is. Then grab the free list of 1,000+ niches at ecommerceparadise.com/niches.

Not sure which off-site step is quietly costing you orders? Want 1-on-1 coaching to launch or fix your high-ticket store? Get the coaching details →

I will keep watching this one. If Shopify adds a trusted-domain list or publishes numbers on how many sites it flags, I will update you. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

Related Articles

If this was useful, these go deeper:

Share on Facebook
Post on X
Save
Share