Short answer: In your Shopify admin, click your account name → Manage account → Security, and set up two-step authentication. Choose a security key or passkey if you can, an authenticator app otherwise, and save the recovery codes. Then require 2FA for every staff account — a store is only as secure as its least careful staff member.
What a compromised store actually costs
More than most people expect, and in more directions.
Payouts. The first move in a store takeover is usually changing the bank account payouts go to. It is quiet, it does not break anything customers see, and by the time you notice, a payout cycle has gone.
Customer data. Names, addresses, order history, partial payment information. That is a breach with legal notification obligations depending on where your customers live.
Card skimming. Attackers inject malicious script into a theme or checkout to harvest card details as customers type them. This can run for weeks, and it is your brand and your liability.
Fraudulent apps and discount codes generating orders or draining inventory.
And unlike a personal account, every hour of compromise involves real customers and real money.
Step 1: Turn on two-step authentication
- In the Shopify admin, click your name/avatar (bottom left or top right depending on layout).
- Choose Manage account.
- Open Security.
- Under two-step authentication, click Turn on.
Step 2: Pick the strongest method available
Shopify supports several:
- Security key / passkey (WebAuthn) — the best option. Bound to Shopify’s domain, so a phishing page cannot use it. See hardware security keys and WebAuthn and FIDO2.
- Authenticator app — six-digit codes generated offline. Solid, and universally available.
- Shopify mobile app — push approvals through the app you already have.
- SMS — the weakest. Exposed to SIM swap attacks, and store owners are targeted specifically because there is money attached.
For a store that takes payments, a security key is genuinely worth the cost — buy two and register both. If you go the app route, use any standard authenticator: Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, or a password manager. Start with what is an authenticator app if this is new.
Do not screenshot the QR code — it holds the raw secret. And be careful setting this up during a screen share with a developer or agency.
Step 3: Save the recovery codes
Shopify issues recovery codes. Store them offline, or in a password manager that is not accessible from the same compromised session — see where to store backup codes safely.
Being locked out of a live store during a sale is a costly kind of downtime, and Shopify support’s identity verification takes time. Also register a second method — a backup security key, or the token on a second device — so a lost phone is not an outage.
Step 4: Require it for all staff
Your own account being secure is half the job. Staff accounts, agency logins and freelance developers are all routes in.
- Go to Settings → Users and permissions.
- Enable the option requiring two-step authentication for all staff.
- Review every user: remove people who have left, and reduce permissions for those who do not need full admin.
Pay particular attention to collaborator accounts from agencies and developers. These persist long after a project ends, and an agency breach becomes your breach. Remove access when work finishes — the pattern is covered in 2FA for small teams.
Step 5: The store-specific checks
2FA protects logins. These protect the store:
- Payout bank details — verify now, and check after any suspicious login alert. This is the number one target.
- Installed apps — review permissions. Uninstall anything unused. Apps with write access to orders and customers are a large attack surface, and app-level breaches have hit merchants repeatedly.
- Theme code — check for unfamiliar scripts, especially in checkout-adjacent templates. Skimmers hide here. Keep a known-good backup of your theme.
- Notification emails — confirm order and payout notifications go to an address you monitor and that has strong 2FA.
- Domain and DNS — if your store runs on your own domain, that registrar account controls everything. See securing your domain name.
- Login alerts and session review — check for devices you do not recognise.
The phishing aimed at merchants
Store owners receive a steady stream of well-crafted lures: fake “your store has been flagged” emails, chargeback notices, copyright complaints about product images, and app-update warnings. All lead to a login page that relays your credentials in real time.
A security key defeats this entirely because it will not authenticate on the wrong domain. With codes, the defence is behavioural: never log in from an email link, always type the admin URL yourself, and treat urgency as the warning sign it is. More detail: phishing-resistant MFA and can 2FA be hacked?
Frequently asked questions
Does 2FA on my Shopify account protect customer accounts?
No. It protects admin access. Customer accounts have their own login, and Shopify’s newer customer accounts use one-time email codes rather than passwords.
Can I use one authenticator app for multiple stores?
Yes. Each store or account is a separate entry in the same app. Keep them clearly labelled.
Why is my code being rejected?
Clock drift is the usual cause — turn on automatic network time. See why 2FA codes get rejected.
What if I lose access during a busy sales period?
Use a recovery code or your second registered method. Failing both, Shopify support requires identity verification, which takes time you will not want to spend. Register two methods on day one.
Should my developer have their own login?
Always. Never share your admin credentials — use staff or collaborator accounts so access can be revoked cleanly and actions are attributable.
My store has been compromised. What is the order of operations?
Change your password and end all sessions, verify and correct payout details, review staff and collaborator accounts, audit installed apps, inspect theme code for injected scripts, then contact Shopify support. Check your email account too — it is often the original entry point (what to do if your email is hacked).
The bottom line
A security key if you can afford one, an authenticator app if not, recovery codes saved, and 2FA required for every staff and collaborator account. Then check payout details, installed apps and theme code — because on a store, the login is the front door and the payout field is the till.
Need a code while setting up? Our free online 2FA code generator runs entirely in your browser.