How do I check if a website uses Shopify?

The most reliable method is a DNS CNAME lookup. Run 'dig www.example.com CNAME +short' and look for a result ending in 'shops.myshopify.com'. You can also view the page source (Ctrl+U) and search for 'cdn.shopify.com', which Shopify uses to serve theme assets and product images. Additionally, check for the cookies _shopify_s and _shopify_y in your browser's DevTools after visiting the site.

Can I detect Shopify on a custom domain?

Yes. Even when a Shopify store uses a custom domain like store.example.com instead of a .myshopify.com subdomain, the DNS CNAME record still points to shops.myshopify.com. This DNS record is required for Shopify to route traffic to the store, so it is always present regardless of how customized the storefront looks. The DetectZeStack API uses DNS-based detection to identify Shopify on custom domains reliably.

Can I detect Shopify programmatically with an API?

Yes. The DetectZeStack API detects Shopify via both DNS CNAME analysis and HTTP fingerprinting. Send a GET request to the /analyze endpoint with a target URL, and the response includes 'Shopify' in the technologies array if present, with a confidence score and detection source. The /demo endpoint works without an API key for quick testing. The free tier includes 100 requests per month.

What HTTP headers does Shopify set?

Shopify stores set several distinctive HTTP response headers. The 'x-shopify-stage' header appears on Shopify infrastructure responses. The 'x-storefront-renderer-rendered' header is set to '1' on storefront pages. Shopify CDN responses include 'x-shopid' with the numeric store ID. When using curl -sI to inspect headers, these values confirm Shopify hosting even before inspecting the page HTML.

How to Detect if a Website Uses Shopify: 5 Methods

April 7, 2026 · 11 min read

Shopify powers over four million online stores worldwide. Most of them use custom domains, custom themes, and no visible “Powered by Shopify” branding. From a URL like shop.example.com, there is nothing obvious that tells you the site is built on Shopify rather than WooCommerce, BigCommerce, or a custom stack.

Yet Shopify leaves reliable fingerprints at every layer of the stack: DNS records, HTML content, JavaScript globals, cookies, and HTTP headers. This guide covers five methods for detecting Shopify, from a single command-line DNS lookup to a fully automated API approach that works across thousands of domains.

Why Detect Shopify Websites

Identifying Shopify stores is useful across several workflows:

Sales and prospecting — If you sell a Shopify app, a Shopify-compatible payment provider, or a service that complements the Shopify ecosystem, every Shopify store is a potential customer. Technographic detection lets you build targeted prospect lists without manual research.
Competitive intelligence — Knowing whether a competitor runs Shopify or a custom platform tells you about their operational overhead, payment infrastructure, and extensibility constraints.
Migration planning — Before proposing a platform migration, you need to know the current state. A store that is deeply embedded in Shopify (custom apps, flow automation, Shopify Payments) requires a different migration plan than one using only the basic storefront.
Security audits — Auditing a client’s vendor footprint means knowing which of their domains rely on Shopify infrastructure, and whether those stores handle payment data in a way that affects their PCI compliance scope.

Each of the five methods below catches Shopify at a different layer. No single method is infallible—DNS changes, themes get stripped, headers get masked—but together they give you complete coverage.

Method 1 — Check DNS CNAME Records

DNS is the most reliable layer for detecting Shopify. When a merchant connects a custom domain to their Shopify store, they are required to create a CNAME record pointing to shops.myshopify.com. This record is what Shopify uses to route traffic from the custom domain to the store.

What Shopify DNS Looks Like

A standard DNS CNAME lookup reveals the target within seconds:

$ dig www.example.com CNAME +short
shops.myshopify.com.

If the CNAME resolves to shops.myshopify.com, the site is hosted on Shopify. This is a definitive signal—no other platform uses this CNAME target.

You can also use nslookup on Windows or macOS if dig is not available:

$ nslookup -type=CNAME www.example.com
Server:  8.8.8.8
Address:  8.8.8.8#53

www.example.com canonical name = shops.myshopify.com.

The DNS check works even on heavily customized stores. A merchant can change every pixel of their storefront theme, use a vanity domain, disable “Powered by Shopify” in the footer, and remove all visible branding—but they cannot change the CNAME record without taking their store offline. The DNS layer is immutable from the application side.

CNAME Target	Platform	Reliability
shops.myshopify.com	Shopify	Definitive
*.bigcommerce.com	BigCommerce	Definitive
ext-squarespace.com	Squarespace	Definitive
*.hubspot.net	HubSpot CMS	Definitive

Note: Some stores configure only the root domain (e.g., example.com) with an A record pointing to Shopify’s IP range, while the www subdomain carries the CNAME. Always check both. If you only check www and the store uses a bare domain, you may miss the CNAME. The DetectZeStack API checks both automatically.

For a deeper look at how DNS records reveal platform choices across e-commerce, CDNs, and marketing tools, see DNS-Based Technology Detection.

Method 2 — Inspect HTML and JavaScript Signatures

Even without DNS access, Shopify leaves clear traces in the page HTML and JavaScript. View the page source with Ctrl+U (or Cmd+Option+U on macOS) and search for the following strings.

Shopify-Specific Global Variables

Every Shopify storefront injects a global JavaScript object called Shopify into the page. It appears in inline script tags near the top of the <head>:

var Shopify = Shopify || {};
Shopify.shop = "your-store.myshopify.com";
Shopify.locale = "en";
Shopify.currency = {"active":"USD","rate":"1.0"};
Shopify.theme = {"name":"Dawn","id":123456789,"theme_store_id":887};

The Shopify.shop property contains the internal .myshopify.com subdomain for the store, even when the public-facing domain is a custom one. This is one of the most reliable HTML-layer signals: finding it in source confirms Shopify and reveals the store’s internal identifier.

Meta Generator Tag and CDN Paths

Shopify also identifies itself via a meta generator tag:

<meta name="generator" content="Shopify">

And virtually every Shopify storefront loads theme assets from Shopify’s CDN at cdn.shopify.com:

<link rel="stylesheet"
  href="https://cdn.shopify.com/s/files/1/0123/4567/8901/t/12/assets/base.css">
<script src="https://cdn.shopify.com/s/files/1/0123/4567/8901/t/12/assets/theme.js"></script>

The numeric path structure (/s/files/1/XXXX/XXXX/XXXX/) is Shopify’s file storage format. The first segment after /s/files/1/ encodes the store’s numeric ID. Finding cdn.shopify.com in any stylesheet or script tag is a strong indicator of Shopify, regardless of theme customization.

HTML Signal	Location	Notes
Shopify.shop	Inline <script> in <head>	Present on all standard Shopify themes
cdn.shopify.com	<link> and <script> tags	Catches even headless stores serving Shopify-hosted assets
meta generator="Shopify"	<head> meta tag	Can be removed by developers; not always present
/checkout	Cart and checkout links	Shopify’s checkout URL path is always `/checkout`

Limitation: Headless Shopify stores serve their storefront from a separate frontend (React, Next.js, etc.) that may not load any cdn.shopify.com assets or render the Shopify global. In these cases, HTML inspection alone is insufficient. Method 1 (DNS) and Method 5 (API) are more reliable for headless deployments.

Method 3 — Look for Shopify Cookies

Shopify sets distinctive cookies on every visitor’s browser. After visiting a Shopify store, open Chrome DevTools (F12), go to Application > Cookies, and look for these names:

Cookie Name	Purpose	Lifetime
_shopify_y	Persistent visitor identifier	1 year
_shopify_s	Session tracking within a visit	Session
_shopify_sa_t	Marketing attribution (traffic source)	30 minutes
_shopify_sa_p	Marketing attribution (persistent)	30 days
cart	Shopping cart token (not Shopify-exclusive, but common)	Session

The _shopify_y and _shopify_s cookies are set by Shopify’s analytics JavaScript and are present on virtually all non-headless Shopify stores. They are client-side cookies, so they appear in the browser after JavaScript executes—not in the initial HTTP response headers from a curl request.

You can inspect cookies from the command line, though you will only see cookies set by the server-side response (before JavaScript runs):

$ curl -sI -c /dev/stdout "https://www.example.com" 2>&1 | grep -i "_shopify"
# Server-set Shopify cookies appear here if present

Note: Cookie-based detection requires JavaScript execution to be reliable. If you are running automated checks with curl, you may miss client-side Shopify cookies. A headless browser or the DetectZeStack API (which performs full HTTP analysis including JavaScript-based detection) is more thorough.

Method 4 — Check HTTP Response Headers

Shopify’s infrastructure sets several HTTP response headers that identify the platform. These appear in the server’s HTTP response before any JavaScript executes, making them reliable for command-line detection with curl.

Fetch just the response headers using:

$ curl -sI "https://www.example.com"
HTTP/2 200
x-shopid: 12345678
x-shopify-stage: production
x-storefront-renderer-rendered: 1
x-sorting-hat-podid: pod01
x-sorting-hat-shopid: 12345678
...

Header	Value	Meaning
x-shopid	Numeric store ID	Shopify’s internal store identifier
x-shopify-stage	production	Confirms Shopify infrastructure
x-storefront-renderer-rendered	1	Page rendered by Shopify’s storefront renderer
x-sorting-hat-podid	pod01, pod02, etc.	Shopify’s internal pod routing system

Not all Shopify stores expose all of these headers—CDN caching layers and custom proxy configurations sometimes strip them. But if you see x-shopify-stage: production or x-sorting-hat-podid in the response, Shopify is confirmed without checking anything else.

You can also check for Shopify by requesting the /admin path. On all Shopify stores, this path redirects to accounts.shopify.com:

$ curl -sI "https://www.example.com/admin" | grep -i location
location: https://accounts.shopify.com/store/...

This redirect is hardcoded in Shopify’s routing layer. If visiting /admin on a domain redirects to accounts.shopify.com, the domain is on Shopify.

Method 5 — Use the DetectZeStack API

When you need to detect Shopify across a list of domains—for prospect qualification, market research, or vendor audits—running four manual checks per domain does not scale. The DetectZeStack API combines DNS CNAME analysis, HTTP fingerprinting, and header inspection in a single request, returning structured JSON that feeds directly into your pipeline.

Single Domain Scan with /analyze

Try it without signing up. The /demo endpoint is rate-limited to 20 requests per hour per IP and requires no authentication:

$ curl -s "https://detectzestack.com/demo?url=allbirds.com" | jq '.'
{
  "url": "https://allbirds.com",
  "domain": "allbirds.com",
  "technologies": [
    {
      "name": "Shopify",
      "categories": ["Ecommerce"],
      "confidence": 100,
      "source": "dns"
    },
    {
      "name": "Google Analytics",
      "categories": ["Analytics"],
      "confidence": 100,
      "source": "http"
    },
    ...
  ],
  "categories": {
    "Ecommerce": ["Shopify"],
    "Analytics": ["Google Analytics"],
    ...
  },
  "meta": {
    "status_code": 200,
    "tech_count": 18,
    "scan_depth": "full"
  },
  "cached": false,
  "response_ms": 612
}

The source: "dns" field on Shopify indicates the detection came from the CNAME record analysis. This is the same DNS method described in Method 1, but fully automated and returned as structured data alongside every other technology on the page.

For production use with higher rate limits, use the /analyze endpoint through RapidAPI:

$ curl -s "https://detectzestack.p.rapidapi.com/analyze?url=allbirds.com" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com" | jq '.'

Batch Scanning Multiple Domains with /analyze/batch

To scan a list of domains in one request, use the /analyze/batch endpoint:

$ curl -s -X POST "https://detectzestack.p.rapidapi.com/analyze/batch" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["allbirds.com", "gymshark.com", "fashionnova.com"]}' | jq '.'

The batch endpoint accepts up to 10 URLs per request and returns results for each domain in a single response. This is the most efficient way to build a spreadsheet of which stores run Shopify versus competing platforms.

Reading the API Response

To check programmatically whether Shopify appears in the response, filter the technologies array by name:

# Check a single domain for Shopify
$ curl -s "https://detectzestack.com/demo?url=example.com" | \
  jq '.technologies[] | select(.name == "Shopify")'

# Get just the detection source
$ curl -s "https://detectzestack.com/demo?url=example.com" | \
  jq '.technologies[] | select(.name == "Shopify") | .source'

The detection source tells you which layer caught Shopify:

Source	Detection Layer	What It Means
dns	CNAME record	Domain CNAME points to `shops.myshopify.com`
http	HTML / headers	Page source or response headers contain Shopify fingerprints

A high-confidence result with source: "dns" is the strongest signal—it means the store routes all traffic through Shopify’s infrastructure, including headless stores that may strip HTML fingerprints entirely.

Shopify Detection at Scale — Sales and Security Use Cases

Building a Shopify Prospect List

If you sell a product or service to Shopify merchants, you can scan a list of e-commerce domains and filter for Shopify. Here is a Python script that takes a list of domains and writes a CSV of Shopify stores:

import requests
import csv
import time

API_URL = "https://detectzestack.p.rapidapi.com/analyze"
HEADERS = {
    "X-RapidAPI-Key": "YOUR_KEY",
    "X-RapidAPI-Host": "detectzestack.p.rapidapi.com"
}

domains = ["allbirds.com", "gymshark.com", "fashionnova.com", "example.com"]

with open("shopify_stores.csv", "w", newline="") as f:
    writer = csv.writer(f)
    writer.writerow(["domain", "is_shopify", "source", "confidence"])

    for domain in domains:
        resp = requests.get(API_URL, headers=HEADERS, params={"url": domain})
        data = resp.json()

        shopify = [
            t for t in data.get("technologies", [])
            if t["name"] == "Shopify"
        ]

        if shopify:
            tech = shopify[0]
            writer.writerow([
                domain, True,
                tech.get("source", ""),
                tech.get("confidence", 0)
            ])
            print(f"{domain}: Shopify ({tech['source']}, {tech['confidence']}% confidence)")
        else:
            writer.writerow([domain, False, "", ""])
            print(f"{domain}: not Shopify")

        time.sleep(0.5)  # respect rate limits

This produces a CSV that you can filter, sort, and import into your CRM. For a full walkthrough of the Python API client including error handling and batch mode, see Detect Any Website’s Tech Stack with Python.

Identifying Shopify in a Vendor Audit

Security and compliance teams often need to inventory which of a company’s domains route traffic through third-party platforms. A subsidiary or acquired brand might have their store on Shopify without the parent’s security team being aware—with implications for PCI scope, data processing agreements, and incident response.

The batch endpoint makes it easy to scan a full domain inventory:

$ curl -s -X POST "https://detectzestack.p.rapidapi.com/analyze/batch" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["corp.example.com", "shop.example.com", "store.example-brand.com"]}' | \
  jq '[.[] | {domain: .domain, shopify: (.technologies[] | select(.name=="Shopify") | .source)}]'

The response lets you quickly see which domains in a portfolio are running Shopify and how the detection was confirmed. Combined with DNS and TLS analysis, you can map the full infrastructure footprint of a company without visiting each site manually.

For a broader view of technology detection use cases in sales and security, see Detect Any Website’s Tech Stack with a Single API Call and Shopify vs WooCommerce: How to Tell Which E-Commerce Platform a Site Uses.

Conclusion and Next Steps

Detecting Shopify manually is straightforward once you know where to look: the DNS CNAME record to shops.myshopify.com is the definitive signal, the cdn.shopify.com CDN domain and Shopify.shop JavaScript global cover most storefront pages, and HTTP response headers like x-shopify-stage confirm the platform at the infrastructure layer.

For automated detection at scale, the DetectZeStack API combines all five methods in a single request and returns structured JSON with confidence scores and detection sources. The free tier includes 100 requests per month—enough to audit a substantial domain list or run regular checks on a prospect database.

Get Your Free API Key

100 requests per month, no credit card required. Detect Shopify and 7,200+ technologies.

Get Your Free API Key

How to Detect if a Website Uses Shopify: 5 Methods

Why Detect Shopify Websites

Method 1 — Check DNS CNAME Records

What Shopify DNS Looks Like

Method 2 — Inspect HTML and JavaScript Signatures

Shopify-Specific Global Variables

Meta Generator Tag and CDN Paths

Method 3 — Look for Shopify Cookies

Method 4 — Check HTTP Response Headers

Method 5 — Use the DetectZeStack API

Single Domain Scan with /analyze

Batch Scanning Multiple Domains with /analyze/batch

Reading the API Response

Shopify Detection at Scale — Sales and Security Use Cases

Building a Shopify Prospect List

Identifying Shopify in a Vendor Audit

Conclusion and Next Steps

Get Your Free API Key

Related Reading

Get API updates and tech detection tips