2026 Shopify and WooCommerce Changes: A Store Checklist

If orders are still coming in, it is natural to assume the store is fine. Most of what went wrong for online stores in 2026 does not show up on the storefront at all.

It shows up in Google Ads, where sales quietly stop being counted. It shows up in an affiliate dashboard, or in an app that keeps working right up to the day Shopify switches it off. On Magento it shows up as a critical security patch that the regular update did not include.

During a September 2026 check of client stores, J.M. Field found one store still loading 15 apps through the old Shopify script-tag method. Two others loaded 10 and 8 (those apps keep working until March 1, 2027, so there is time). We also found a lapsed domain sending shoppers to a domain-for-sale page while the store behind it was fine.

None of those stores had an error message. Nobody knew until we looked.

The dates that matter

1. Aug 28, 2025Shopify PlusThank you page scripts removed
2. June 30, 2026Shopify PlusShopify Scripts stop running
3. Aug 11, 2026MagentoStandard support for 2.4.6 ends
4. Aug 26, 2026ShopifyThank you page scripts removed for all other plans
5. Sept 7, 2026MagentoStyleSmuggler hotfix VULN-39341 released
6. Sept 13 to 17, 2026BigCommerceRibon app incident
7. Oct 1, 2026ComingShopifyApps can no longer add or update script tags
8. March 1, 2027ComingShopifyExisting script tags stop running

Did Shopify break your checkout tracking?

On August 26, 2026, Shopify removed checkout.liquid, the Additional scripts box, and script tags from the Thank you and Order status pages for Basic, Shopify, and Advanced plans. Plus stores lost the same options a year earlier, on August 28, 2025. Shopify explains the checkout upgrade here.

This affects stores that pasted tracking code into those pages. Common examples include Google Ads, Meta, TikTok, affiliate-network tags, and other conversion scripts.

Your storefront was not affected. The trouble starts after an order is placed, where the conversion needs to be recorded.

How to check:

1. Place a test order.
2. Check whether the order appears as a conversion in Google Ads or Meta.
3. Review any affiliate dashboard that is supposed to receive order information.
4. Ask whoever manages your ads where the conversion tag was installed.

The fix is to rebuild tracking in Shopify Settings > Customer events using web pixels, or install the advertising platform's official app. Do not assume a tag is working because it remains visible in an old document or a note from a previous developer. A fresh test order is the only proof that counts.

Tracking can also be broken for older reasons. One store we checked still runs only the old Universal Analytics tag. Google stopped processing Universal Analytics data on July 1, 2023, so that owner has had no Google Analytics data for more than three years. Three other stores send data to two or three separate GA4 properties. That can be on purpose, say an agency property plus the owner's, but if nobody knows why the extra one is there, nobody is watching the numbers in it.

Are your Shopify apps still using script tags?

Shopify script tags are an older way for apps to put code into a storefront. Starting October 1, 2026, apps can no longer create or update those script tags. Existing tags keep running until March 1, 2027, when Shopify stops injecting them into storefronts. Shopify's script-tag deprecation notice lays out the change.

This affects apps that add widgets, reviews, popups, personalization, tracking, or other storefront features through script tags. A store can have many of these without the owner realizing how they were installed.

Ask each app vendor a direct question: have you moved from script tags to app embed blocks or web pixels?

App embed blocks are enabled in the Shopify theme editor. Web pixels are Shopify's replacement for pasted-in tracking code. If an app vendor has no replacement, update or replace the app before the old tag disappears. Removing outdated apps can also reduce unnecessary storefront code, which is often a speed win.

Start with your installed-app list. Keep the apps tied to a current business need. Check the rest with the vendor, then remove apps you no longer use.

Did your Shopify Scripts stop running?

Shopify Scripts were Plus-only Ruby code used for custom discounts, wholesale pricing, shipping rules, and payment rules. Editing stopped on April 15, 2026. All Shopify Scripts stopped running on June 30, 2026. Shopify announced the Scripts retirement here.

This is a concern for Plus stores with custom checkout behavior. A promotion, customer-specific price rule, shipping rule, or payment restriction may have relied on a Script.

Check your store's old custom logic. Compare a few real scenarios with the intended result. For example, test a discount, a wholesale customer, or a shipping condition that used to be controlled by a Script.

Shopify Functions replace Scripts. Custom Functions apps require Plus. Stores on other plans use public apps from the Shopify App Store. Go rule by rule. A general discount app may cover your summer sale and still miss the wholesale price one account depends on.

If you are choosing between platforms for a future store or fulfillment workflow, our Shopify versus WooCommerce comparison may help frame the maintenance differences.

Is your WooCommerce store up to date?

WooCommerce Cart and Checkout blocks have been the default for new stores since WooCommerce 8.3 in November 2023. The classic shortcode checkout still works, but new features are built for blocks.

You do not have to move an existing checkout to blocks. Before making that choice, check whether your payment and shipping plugins are block-compatible.

WooCommerce also has High-Performance Order Storage, usually called HPOS. It stores orders in a faster, purpose-built way, which helps stores with a lot of orders, and it has been on by default for new stores since WooCommerce 8.2. WooCommerce documents HPOS here.

The more common WooCommerce problem is plain old updates. In our September check, one client store was still on WooCommerce 10.2.2, a release from September 2025, while other client stores were already on 11.1.

Check the WordPress update screen, then review plugin updates and compatibility notes before applying them. Include payment, shipping, tax, subscription, and fulfillment plugins in the review. WordPress itself had an active attack wave this July, which is one more reason not to let updates pile up. Test on a copy of the site first if you can, since a payment plugin update is the one you least want to discover live.

Is your Magento store patched against StyleSmuggler?

Magento Open Source and Adobe Commerce stores running versions 2.4.4 through 2.4.9 need immediate attention to CVE-2026-75650, nicknamed StyleSmuggler by security firm Sansec. Sansec describes it as unauthenticated remote code execution with a CVSS score of 10.0, exploited in the wild since September 4, 2026. Read Sansec's report.

Adobe published bulletin APSB26-146 and hotfix VULN-39341 on September 7, 2026. The August releases do not include this fix. The hotfix must be applied separately. Adobe's bulletin has the affected-product and hotfix details.

Check the exact Magento version first. Then verify that VULN-39341 was applied, rather than relying on an August release alone. Adobe also advises rotating encryption keys and credentials because a store can have been compromised before it was patched.

Separately, standard support for Magento 2.4.6 ended August 11, 2026. Adobe's lifecycle policy lists extended support for 2.4.6 through August 31, 2027, but that policy is written for Adobe Commerce. If you run the free Magento Open Source edition, ask your developer exactly which fixes you can still get, and plan the upgrade now.

Why BigCommerce stores should review their apps

Between September 13 and 17, 2026, stolen credentials for third-party Ribon apps were used to inject scripts into some BigCommerce stores. BigCommerce says payment cards and passwords were not exposed. Names, emails, phone numbers, and shipping addresses were. BigCommerce removed the apps. BleepingComputer's report on the Ribon incident.

The stores hit had done nothing wrong except install an app. Every app you keep has access to your store. Delete the ones nobody uses, and keep a short list of what the rest do.

Quick checklist

A free 15-minute store check

It starts with the same outside look we gave our own clients' stores this month. In 15 minutes we look at which apps still load the old way and whether a test order reaches your ad accounts. We also check when your domain renews and which platform version you run. It is free, and you get the list whether or not you hire us.

If you would rather not think about any of this again, that is what our website maintenance plans are for. Send us a note and tell us which platform you run.