Shopify Now Warns Shoppers Before They Leave Your Store

Shopify now shows shoppers a confirmation prompt before sending them from a store to any outside website, according to an October 20 changelog entry.

If your high-ticket store sends buyers off-site for financing, quotes, booking calls, spec sheets or a second storefront, that prompt now sits between your shopper and the next step. Here at Ecommerce Paradise we build stores around trust. A warning screen in front of a $3,000 purchase decision is a trust event whether you asked for it or not, and it lands hardest on high-ticket dropshipping stores.

Below: exactly what Shopify said, what merchants reported within a day, the app hijacks that likely sit behind it, my read on the cost to a store like yours, and five checks to run this week.

Form your LLC with Northwest, the best LLC formation service for ecommerce owners, before your next store launch. Cheap formation sites upsell you and hand your home address to the public record, while Northwest puts its own address on your public filings and does not sell yours. Form your LLC with Northwest →

Shopify Adds a Leave-Store Prompt to External Storefront Links

Shopify posted the change on October 20 in its Shopify changelog under Online Store. The entry says the storefront now asks customers for confirmation before sending them to a website outside your store.

Per the entry, customers see a short message showing the destination’s web address. They can continue to that site or go back to the store.

Two groups of destinations are exempt, according to Shopify. Domains connected to your store do not trigger the message. Supported Shopify and social websites do not trigger it either. The entry also warns that links to websites you own but have not connected to your store might still trigger it.

Shopify added one control. Starting October 21, merchants can add other trusted domains, such as a booking tool or a partner site, in Online Store > Preferences. Customers go straight to trusted domains without seeing the message.

The changelog does not list which link types are caught beyond those examples. It gives no rollout schedule, no opt-out and no word on whether links fired by scripts or apps are treated differently from links in your theme.

Merchants started reporting problems on October 21. A merchant posting as CoastalWanderer wrote in a Shopify Community thread that the prompt appeared without advance notice. According to the poster, Shopify Support said merchants cannot disable the prompt or approve trusted destinations. The poster also said social links on larger stores and Google Ads clicks appear to skip it. The thread shows no Shopify staff reply and no conversion data.

A second post the same morning, by a user named senabre on the Shopify developer forum, describes a merchant running two storefronts on different domains. A country selector on Store A links to Store B, and the click now triggers the prompt. The poster quotes Shopify’s Help Center as saying merchants currently cannot turn the prompt off. A forum moderator named Luke closed the post as a duplicate of an existing thread titled “Shopify-exit-interstitial – Popup Modal,” which the page lists at 13 replies and 649 views.

The sources disagree on one point that matters. The changelog says a trusted-domain list exists from October 21. Both merchant posts, also dated October 21, say no such control is available. That could be a staggered rollout. Nobody at Shopify has confirmed it.

Why Shopify Is Policing Storefront Redirects After the App Hijacks

Shopify did not tie the prompt to any incident. The changelog says only that it protects customers from unexpected redirects. The timing is hard to ignore, though.

Between October 10 and 14, attackers hijacked three Shopify apps, Hulk Product Options, Selleasy and Swym Wishlist Plus, and used them to push shoppers from the checkout button to fake card-entry pages. I covered the incident in Three Shopify Apps Hijacked to Fake Checkouts.

The best reporting came from iTnews in Australia. Per iTnews, the Selleasy attack ran from about 07:47 to 15:00 UTC on October 13. A customer of WAGD, an Australian dog harness retailer owned by Carly Clarke, landed on a fake checkout, and Clarke closed the store and reported it to Shopify. Shopify confirmed by email at 15:40 UTC that the malicious code had been removed, yet iTnews reports it kept telling her to stay shut. A Shopify support representative asked her to “please keep the password protection on while we wait for that confirmation.” Clarke said Shopify told her on October 19 she could reopen.

On the Hulk side, iTnews reports developer Roman Zipp found a script containing a function named “hijack” that intercepted checkout clicks and redirected shoppers to lookalike payment pages. A Shopify spokesperson told iTnews that when an app falls short of the company’s standards it acts, including by delisting the app.

The pattern is not new. Compromised third-party code has been the common thread in several recent cases. One was the Rank Math PRO backdoor. Another was a campaign where fake Claude ads routed through a hacked retailer’s site. A prompt that names the destination before the browser leaves your store is a cheap defense against that whole class of attack, because the shopper sees a strange address before typing a card number.

That is the counterpoint, and it is a fair one. Even the merchant who started the Community thread said they understand the need to protect customers from phishing and unexpected redirects. The complaint is narrower: the prompt makes legitimate links look questionable, and merchants have no way to say which ones are legitimate. Against that, nobody has published numbers on how many shoppers abandon at the prompt. One thread and one forum post are not a trend.

What the Leave-Store Prompt Costs a High-Ticket Store

This section is my analysis, not reporting.

My read is that the prompt matters far more to a $2,500 sofa or a $4,000 mobility scooter than to a $30 impulse item. A buyer spending that much is already scanning for reasons to doubt the store. The people most of us sell to, older and affluent buyers who pay by card and call before they buy, are exactly the shoppers who stop when a box appears saying they are about to leave the website.

High-ticket stores also send people off-site more than low-ticket stores do. Think about the typical list:

Financing pages hosted by a lender, which matters more now that BNPL costs are moving, as I noted in Affirm Falls 10% as Yields Jump. Quote forms and booking calendars on a vendor’s domain. Manufacturer spec sheets and manuals. A review page on a third-party site. A help center hosted by your support tool. A second storefront for another country. Any of these could trigger the prompt depending on how it is linked, and Shopify has not published the full rule.

Here is hypothetical math to size the risk. Label it hypothetical because Shopify has released no abandonment data. Say a store gets 20,000 sessions a month and 3 percent, or 600 sessions, click a financing or quote link that sits on another domain. If 15 percent of those shoppers bail at the prompt, that is 90 lost sessions. Those sessions are high intent, so assume a 4 percent close rate and a $2,800 average order. That is 3.6 orders, or about $10,080 a month in revenue, from one confirmation box. At a 20 to 30 percent gross margin, the gross profit at risk is roughly $2,000 to $3,000 a month. If your inputs are half of mine, the loss is still worth an afternoon.

Three scenarios, with thresholds:

If the trusted-domain list is live in your Online Store > Preferences, this is a 20-minute fix. Add your financing, booking and partner domains and test from a phone. If the list is missing, treat that as a bug report to Shopify and move your most important off-site step onto your own domain. If more than about 2 percent of your sessions click any one off-site link, test it first, because that is where a 15 percent drop-off costs real money.

Your own theme choices matter here. A clean theme with a short menu, such as Superstore, keeps outbound links to a minimum by default. Cluttered footers stuffed with partner badges and affiliate banners are where stray off-site links hide.

Your support stack adds more. A help center from Gorgias can link customers to pages on a different domain. A chat widget from Tidio can do the same, so test those links too.

Security still matters more than conversion, and this prompt is not a substitute for it. A prompt will not stop a hijacked app from loading a script on your page. Review what is installed, as I laid out in Protecting Your High-Ticket Store. Keep a payment backup plan too, which I covered in Your Payment Processor Is a Single Point of Failure.

Timing makes this urgent. TikTok Shop’s holiday sale starts November 11, as in TikTok Shop BFCM Starts Nov. 11, and ad spend ramps with it. Every friction point you find now is cheaper than one you find in the middle of a Black Friday ad push.

Auditing links, testing prompts, watching app changelogs and reading forum threads is exactly the operational drag that eats a store owner’s week. If you would rather have a team run the store while you focus on suppliers and sales, that is what my turnkey done-for-you build handles.

Tired of chasing platform changes like this one while you try to sell? My team can build and run the whole high-ticket store for you. See the turnkey done-for-you service →

Audit Every Off-Site Link in Your Shopify Store This Week

Run these five steps in order. Plan about two hours for the first four.

Open Online Store > Preferences in your Shopify admin and look for a trusted-domains field. If it is there, add your financing lender, booking tool and any second storefront. If it is not there, write down today’s date, screenshot the page and check again in 48 hours, since the changelog promised it from October 21.
List every outbound link on your store. Check the header, footer, product tabs, policy pages, blog posts and any email-capture popups. Then open the store in a private browser window on your phone and click each one. Note which ones show the prompt.
Move what you can onto your own domain. Upload supplier spec sheets and manuals to your store files instead of linking to the manufacturer. Embed the booking or quote form on a page of your own where the tool allows it. Check the links your Klaviyo forms and flows send people to. Then look at where your HubSpot meeting links point.
Measure it. In your analytics, pull outbound click events for the two weeks before October 20 and the days since, then compare conversion for sessions that clicked an off-site link against those that did not. If your financing or hosted payment page sits on another domain, test that hosted page the same way, and do the same for a backup processor such as Airwallex. My High-Ticket Black Friday Checklist has the full stress test.
Prepare your team. Put a line in your support macros for customers who message “Is this a scam?” Keep your phone number visible in the header. If you want a second set of eyes on your storefront and link setup, book a discovery call and we can walk through it together.

While you are in the admin, look back at the return shipping tax change landing October 23, since it is the other Shopify setting due for a check this week.

Frequently Asked Questions

What does Shopify’s leave-store confirmation do?
Per Shopify’s October 20 changelog entry, your storefront asks customers to confirm before sending them to a website outside your store. The message shows the destination address and lets the shopper continue or go back.

Which links skip the prompt?
According to Shopify, domains connected to your store and supported Shopify and social websites skip it. Links to sites you own but have not connected to your store might still trigger it.

Can I turn it off?
The changelog describes no opt-out. Two merchant posts on October 21 say Shopify Support told them it cannot be disabled, so plan around it. Shopify says a trusted-domain list is available from October 21 in Online Store > Preferences, though both posters said they could not find it.

Will this hurt my conversion rate?
Nobody has published data yet. Only shoppers who click an off-site link are affected, so measure those sessions first. If you are still choosing what to sell, my guide to choosing a high-ticket niche covers why trust signals matter more as the price goes up.

Is the prompt related to the hijacked checkout apps?
Shopify has not said so. The changelog says only that it protects customers from unexpected redirects. The timing follows the October 10 to 14 hijacks of Hulk Product Options, Selleasy and Swym Wishlist Plus.

What if I run two Shopify stores on different domains?
A merchant on the Shopify developer forum reports that a country selector linking one store to another triggers the prompt. Add the second domain as a trusted domain if the setting is available to you, and my free beginner guide covers the single-store setup that avoids the problem.

Want to compare notes with other store owners on what Shopify just did to outbound links? Bring your storefront questions to the community and work through them with me. Join the Skool community →

I will keep watching the changelog and the merchant threads for a Shopify staff reply or a published rule list. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.