Shopify Staff Permissions Audit: A 20-Minute Checklist
Old staff, freelancers, and agencies keep access long after the work ends. A short checklist to review who can reach your Shopify admin, and what they can change.
By The Appnary Team
Most store takeovers do not start with clever code. They start with an account that still works. A freelancer from two years ago, a former employee, an agency login that was shared in a chat. This audit takes about twenty minutes.
1. List every account
In the Shopify admin, open Settings, then Users. Write down every staff account and every collaborator. For each one, ask who it is, what they do for the store now, and whether they still need access. An account nobody can explain is the first one to remove.
2. Remove what has no current job
Remove staff who left and collaborators whose project ended. If an agency still works with you, keep one named login for the project, not a shared one. A shared login tells you nothing about who changed what.
3. Cut permissions to what is used
Staff permissions are set per area: orders, products, apps, themes, settings, and so on. Full access is rarely needed. Someone who answers support tickets does not need to edit the theme or install apps. Anyone who can install apps or edit code can put a script on your storefront, so treat those two permissions as the sensitive ones.
4. Turn on two-step verification
Reused passwords are the usual way into an account. On most plans each person has to set up two-step verification on their own account, so ask them to, and check that they did. On Shopify Plus you can require it for the whole organization.
5. Review the apps
Open Settings, then Apps and sales channels. Remove apps you no longer use. For the ones you keep, look at what access each app has. An app that was set up years ago with access it does not need is the same problem as a staff account nobody remembers.
6. Look at the recent history
Read the recent activity for changes you did not expect: a new staff account, a changed permission, a theme edit at an odd hour. Shopify's admin shows a limited number of recent events, so do this review often enough that the evidence is still there.
Make it a habit
Put the review on the calendar once a quarter, and run it again when an agency or freelancer finishes. For a theme-side check to go with it, see how to find which app added a script.
Vigil is our scanner for this. It is in development, not on the Shopify App Store yet, and it cannot be installed today. Read what it checks or join the waitlist. It does not replace this review, because it does not read staff accounts.