标签：#shopify

For twenty years, "ranking" meant one thing: get indexed, get crawled, get a position on a results page. Every Shopify store's SEO checklist was built around that single goal. Sitemap submitted, meta tags filled in, Core Web Vitals green, done. That checklist still matters. It's also no longer sufficient, and most stores haven't noticed yet. Two different systems, two different jobs Google's index and an LLM's answer engine are not the same kind of system, even though they both "read" your store. A search index is a retrieval system. It crawls a page, tokenizes the content, stores it, and matches it against a query at request time. Ranking is a function of relevance signals backlinks, click-through behavior, freshness, page experience. The unit of output is a list of links. The user does the synthesis. An LLM-based answer engine is a generation system. When someone asks ChatGPT, Perplexity, or Claude "what's a good Shopify store for sustainable activewear," the model isn't returning a ranked list of crawled pages. It's generating a single answer, and it decides which brands to name in that answer based on which entities it has high confidence are real, relevant, and well-attested across multiple sources. The unit of output is a sentence. The model does the synthesis, and your store either gets a mention in that sentence or it doesn't. This is the gap. A store can be fully indexed sitemap clean, every product page crawlable, ranking on page one for its category and still never get named in an AI-generated answer. Indexing is a necessary condition for citation. It is not a sufficient one. What "citable" actually requires Citation in an LLM context isn't about keyword matching. It's closer to reputation modeling. Three things tend to separate stores that get cited from stores that don't: Entity consistency across the web. The model needs to resolve "your brand" as a single, stable entity across multiple independent sources your own site, marketplaces, press mentions, r

You exported a product CSV, edited it in Excel or Google Sheets, and uploaded it to Shopify. Shopify shows a generic error — or worse, it silently imports the wrong thing: a handle gets overwritten, a variant attaches to the wrong product, half your rows go missing. You find out days later from a customer. Shopify CSV Preflight Validator checks the file before you upload it. It runs locally on your machine, never touches your store, needs no API key, and returns three things: fixed_products.csv — a safe copy with the unambiguous, mechanical mistakes already corrected. errors.csv — a machine-readable list of every finding (row, rule, severity, suggested fix). report.md — a human-readable report you can read in 30 seconds. No login. No upload of your catalog to a third party. Just a file in, a verdict out. Why CSV imports fail (and why the error message doesn't help) Shopify's product CSV import is a two-stage process: it validates the file, then applies rows. A file can pass the upload dialog and still misbehave on apply. The most common ways merchants get burned: A spreadsheet adds a UTF-8 BOM to the first cell. The first header ( Title ) becomes invisible-garbage + Title , so Shopify can't find the title column. Header case / legacy names drift. title instead of Title , Handle instead of URL handle . Some get ignored, some get rejected. A variant row loses its parent handle. Shopify can't tell which product the variant belongs to. Two product rows share one handle. Shopify silently keeps one and overwrites/merges the other. Image alt text with no image URL, negative prices, compare-at prices below the real price — small data bugs that ship to your live storefront. These are not exotic. They're what happens every time a human edits a CSV in a spreadsheet. What the tool actually does — a real run Here is a messy export with several of the problems above. Running: csv-preflight check messy-product-import-sample.csv --out-dir ./out --lang en produces this report.md (ve

Looked at 30 products running Meta + TikTok ads profitably. 7 patterns every single one had: PRICE : $25-$65 Below = thin margins. Above = harder impulse. BUNDLE OPTIONS "Buy 2 save 10% / Buy 3 save 15%" — every store had this. None were single-product only. VISUAL HOOK IN 3 SECONDS Unique design, specific problem solved, or "wow factor." Generic products failed. REAL REVIEWS WITH PHOTOS Not 5-star spam. Real, mixed reviews. Even negatives build trust. SHIPPING TIME ON PDP Every store disclosed it directly. None hid it in FAQ. STICKY ADD-TO-CART ON MOBILE All 30 had it. If your Add to Cart scrolls off-screen on mobile, you're losing sales. POST-PURCHASE UPSELL "Add this for $X" / subscription / bulk refill. This is where AOV lives. WHAT THEY DIDN'T HAVE Live chat (only 4/30) Exit-intent popups (only 2/30) Countdown timers (only 3/30) Countdown timers (only 3/30 — most had REAL shipping urgency instead) Multiple payment options visible on PDP (most just had Shopify default) The "guru tactics" aren't what winning stores use. 3 QUICK WINS Pick products with visual hooks Bundle by default Fix PDP before scaling ads

Most "Shopware vs Shopify" posts compare dashboards, app stores, and pricing tables. None of that matters to you until the day a client asks for something the platform won't let you build. Then the comparison stops being a feature grid and becomes a question about ceilings: how high can I go before the platform says no, and what happens when I hit it? That's the only axis I care about as a developer, so that's the one I'll argue on. Shopify is an outstanding product. It's also a closed SaaS that decides, on your behalf, where customization ends. Shopware is open source built on Symfony, which means the ceiling is "however far PHP and HTTP will take you." Below are the three places that difference actually bites, with code. Angle 1: The checkout is the wall This is the headline because it's where most agency developers first hit something they cannot do. For years the Shopify answer to "customize the checkout" was checkout.liquid . That era is over. Shopify deprecated checkout.liquid in favour of Checkout Extensibility . Plus stores had to migrate their Thank-you and Order-status pages by August 28, 2025 , and in January 2026 Shopify began auto-upgrading stores — wiping customizations built on additional scripts, script-tag apps, or checkout.liquid . Non-Plus stores have until August 26, 2026 , and legacy Shopify Scripts keep working only until June 30, 2026 . ( Shopify migration timeline ) The replacement, Checkout Extensibility, is genuinely more upgrade-safe. It's also a smaller box. You get Checkout UI Extensions (declarative components that render in slots Shopify defines) and Shopify Functions for backend logic — and that's the surface. You don't own the checkout template; you decorate the pieces Shopify exposes. Worth noting: full visual checkout customization (branding API, custom fields beyond the defaults, full UI extension power) is gated to Shopify Plus anyway. On Shopware, the checkout is a Twig template like every other page, and you override it the sam

Last night I ran external security scans on the public websites of 10 leading Shopify and Shopify Plus agencies — the same scan any browser or attacker would see. No credentials, no special access. One agency scored an A. Three scored C- or below. The most common finding appeared on 9 of 10 sites. TL;DR 1 agency scored an A. 3 scored C- or below. 1 scored a D. The most common finding — missing security headers — appeared on 9 of 10 sites. 6 of 10 agencies have no HSTS at all. One agency has a session cookie without the Secure flag. That is the most concrete finding in the set. What was scanned Five categories per domain: TLS (HSTS presence and max-age), security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), cookie flags, DNS hardening (DNSSEC and CAA) and sensitive exposure paths. All scans run on 23 June 2026. This covers the agencies' own marketing sites — not the client stores they build. Results Agency Domain Score Grade 1Digital Agency 1digitalagency.com 94 A Acidgreen acidgreen.com.au 77 B 30 Acres 30acres.com.au 76 B Fourmeta fourmeta.com 76 B Blend Commerce blendcommerce.com 76 B Elkfox elkfox.com 76 B Charle Agency charleagency.com 62 C Fyresite fyresite.com 62 C Eastside Co eastsideco.com 58 C- Swanky Agency swankyagency.com 55 C- Blubolt blubolt.com 54 D Per-agency notes 1Digital Agency — A (94) HSTS at two years, X-Content-Type-Options and Referrer-Policy set correctly, Permissions-Policy restricting camera, microphone and geolocation, CSP frame-ancestors in place of X-Frame-Options. Only gap is HSTS missing includeSubDomains. Acidgreen — B (77) HSTS with two-year max-age, includeSubDomains and preload — the strongest TLS config in the set. But CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are all absent. Worth noting Acidgreen is multi-platform (Shopify Plus, Adobe Commerce, Magento) rather than Shopify-only. 30 Acres — B (76) A Shopify Plus Partner agency based in Byr

Turbo Start Aisle is our agentic e-commerce starter on Shopify and Sanity. Instead of filters...

When you build Shopify apps or integrations, pagination becomes important very quickly. A small test store may have a few products and orders. A real merchant store can have thousands of products, variants, orders, customers, inventory items, metafields, and fulfillment records. You cannot fetch all of that data in one Shopify GraphQL request. You need pagination. More importantly, you need pagination that performs well. Poor Shopify GraphQL pagination can create slow syncs, API throttling, timeout errors, duplicate processing, and incomplete exports. This post explains how Shopify GraphQL pagination works and how to handle large Shopify datasets in a practical way. What Shopify GraphQL Pagination Solves Pagination lets your app retrieve data in smaller chunks. Instead of asking Shopify for 50,000 products at once, your app asks for 100 or 250 products per request. Shopify returns the data and gives your app information about the next page. This protects your app from huge responses and protects Shopify from heavy requests. It also gives your integration more control over retries, progress tracking, and background processing. Shopify Uses Cursor-Based Pagination Shopify GraphQL uses cursor-based pagination. That means you do not request data using page numbers. You request the next page using a cursor from the previous response. A basic product pagination query looks like this: query GetProducts ( $cursor : String ) { products ( first : 100 , after : $cursor ) { nodes { id title handle updatedAt } pageInfo { hasNextPage endCursor } } } The first time you run this query, pass cursor as null. Shopify returns the first 100 products and gives you an endCursor . Use that endCursor as the after value in the next request. Keep doing this until hasNextPage is false. Why Cursors Work Better Than Page Numbers Offset pagination usually works like this: page=1 page=2 page=3 or: offset=5000&limit=100 This approach becomes inefficient when datasets grow. The system may need to sk

Last week I shipped something that would have sounded reckless two years ago: an MCP server that lets an AI agent write to a merchant's live Shopify store. Create discount codes. Build customer segments. Draft WhatsApp campaigns against real order data. Read-only agent integrations are everywhere now, and they're fine — but a read-only agent is just a chatbot wearing a dashboard. The useful version is the one that does the thing . The dangerous version is also the one that does the thing. A hallucinated SELECT is a wrong answer; a hallucinated discount code is free product going out the door. So before turning writes on, I sat down and listed every way an agent could hurt a store. Then I built one guardrail per failure mode. Here's the list — it's short, and I think it generalizes to any agent surface that touches business data. 1. Read-only by default. Writes are a per-token opt-in. The lazy design is one API key that can do everything the app can do. Instead, every agent token starts read-only — list customers, inspect segments, read campaign stats. Write capability is a separate flag the merchant flips per token: { "token" : "fav_mcp_…" , "scopes" : [ "read" ], // default "writeEnabled" : false // explicit opt-in , per token } This sounds obvious. It is obvious. It's also the single most-skipped step I see in agent integrations, because it's friction during development. Build the friction in anyway — "the agent could read everything but couldn't have sent that" is a sentence you really want available to you later. 2. Caps live in the tool schema, not the prompt. Early on I had a system prompt that said something like "never create discounts above 30%." You can guess how durable that is. Prompts are suggestions; schemas are physics. So the caps moved into the tool's input validation itself — the shape of it: // create_discount — validated server-side, not prompt-side { percentage : z . number (). min ( 1 ). max ( 100 ), // hard ceiling, enforced in the service exp

If you’ve ever built a slide-out cart drawer, a dynamic free-shipping bar, or custom analytics tracking for a Shopify store, you've run straight into this brick wall: Shopify themes do not emit consistent, trustworthy cart events. You write a perfect event listener, only to find out a third-party product-bundle app uses old-school XMLHttpRequest (XHR) instead of fetch to add items to the cart. Your listener misses it completely, the cart drawer stays shut, and your user thinks the button is broken. Most developers end up copying and pasting messy, brittle window.fetch overrides into their projects. Frustrated by solving this over and over again, I built Shopify Cart Broadcaster —a zero-dependency, 2 KB utility that intercepts both Fetch and XHR requests seamlessly to provide universal DOM events. 👉 Check out the source on GitHub: Rabin-p/shopify-cart-broadcast (If this saves you an afternoon of debugging, drop a ⭐!) The Nightmare of the /cart/add Response Even if you successfully listen to Shopify's /cart/add.js request, Shopify throws another curveball at you. When you add an item to the cart, the server responds with only the item(s) that were just added —not the updated state of the entire cart. If your slide-out cart drawer needs the new total price to see if a discount threshold is met, you are out of luck. You're forced to manually chain another fetch('/cart.js') request to get the true state. My utility handles this annoying race-condition out of the box. It detects the mutation type, intercepts it, pushes the true cart events to the window and displays it beautifully. window . addEventListener ( ' shopify:cart-updated ' , ( e ) => { // Always gives you the accurate, updated cart object! console . log ( ' New Cart Total: ' , e . detail . cart . total_price ); });

Server-side tracking on Shopify Plus is no longer optional in 2026. Browser-side analytics tags now miss around 30-40% of conversion events on Safari, Firefox, and ad-blocked sessions when ITP, consent rejection, and ad-blockers combine, and the server-side fix — a GTM server container or an equivalent gateway — is the difference between a usable Meta CAPI feed and a reporting hole that quietly tanks your paid-media ROAS. Why browser-side pixels broke first The structural decay started years ago and accelerated through 2025. Safari's Intelligent Tracking Prevention caps JavaScript-set first-party cookies (anything set via document.cookie ) at 7 days, and 24 hours when the URL carries a tracking parameter like fbclid or gclid . Server-set first-party cookies sent via the HTTPS Set-Cookie header can still persist up to 400 days, unless the cookie's host resolves through a CNAME to a third-party — then ITP collapses that lifetime back to 7 days. Combine that with Firefox Enhanced Tracking Protection (around 5-8% of UK desktop traffic), ad-blockers (around 30-35% adoption on desktop), and consent-management platform rejection (typically 20-40% of EU sessions), and a typical Shopify Plus storefront ships measurable signal for only 60-70% of real purchase events. We have audited stores where a server-side migration recovered around 28% of attributed purchases inside the first 7 days of switchover — not because the conversions stopped happening, but because the browser layer stopped reliably reporting them. What a server-side gateway actually does A server-side tracking gateway intercepts the event between the storefront and the destination platform (Meta, Google Ads, TikTok, etc.) and re-emits it from your domain. The browser still fires a lightweight web-side ping, but the heavy payload — order ID, customer hash, line items, value — travels server-to-server. Cookies stay first-party because the request originates from your own subdomain. The destination platform sees a c