How to Find Which Shopify App Added a Script to Your Storefront
Shopify does not tell you which app injected a script. Three ways to trace a third-party script on your storefront back to the app or theme file behind it.
By The Appnary Team
Shopify's admin lists your installed apps. It does not list the scripts those apps put on your storefront, and it does not tell you which app a given script came from. Tracing a script takes three steps.
Step 1: list what loads
Open your storefront in a private window, open the browser's developer tools, and go to the Network tab. Reload the page and filter by JS. Group what you see by domain. Your own domain, Shopify's domains, and the domains of tools you set up on purpose are expected. Everything else needs an owner.
Check a product page, the cart, and the homepage. Different pages load different scripts. Checkout has its own rules on what can run, so do not expect your storefront scripts to appear there.
Step 2: match each domain to a source
A script gets onto a storefront in one of four ways:
- App embed. Switched on in the theme editor's App embeds tab. Easy to find, and easy to turn off there.
- App block. Added to a section by the app. It appears in the section list in the theme editor.
- Theme code. A script tag typed into theme.liquid or a snippet, by an app's installer, a developer, or an agency. This is the one the app list will not show you.
- Tag manager. A script loaded by Google Tag Manager or a similar tool. It does not appear in the theme at all, and it can load more scripts that you did not add.
Search the theme code for each unknown domain. If there is a hit, the file and line tell you where it came from. If there is no hit, check the embeds and your tag manager.
Step 3: decide
For each script, you want an answer to three questions. Which app or person put it there? Do you still use that app? What does it have access to on the page? A script on a product page can read what is on that page. A script that also loads on pages with forms can read what customers type.
Anything you cannot answer for is a candidate to remove. Turn embeds off in the theme editor. For theme code, duplicate the theme and delete on the copy first, as in our guide to removing leftover app code.
Vigil is our scanner for this. It is in development, not on the Shopify App Store yet, and it cannot be installed today. Read what it checks or join the waitlist. Its scan ties each external script to a file or an app name, and reads the rendered page too, so scripts added at runtime show up.