StoreCheck Visibility · Guides

Is my Shopify store public? — storefront data surfaces

In short: Yes — a standard Shopify store exposes a surprising amount of data by design: your full catalog with prices and timestamps at /products.json, store identity and geography at /meta.json, installed apps in the page source, and your myshopify backend domain via the /admin redirect. These are platform behaviours you cannot disable — but you control which data you put where.

Which data is public on a Shopify store?

On a stock Shopify storefront the following URLs work with no login and no API key:

• /products.json?limit=250 — the full catalog: product name, price, compare-at price, SKU, variants, tags, created_at and updated_at. Pagination pulls thousands of products.
• /meta.json — store name, country, city, currency, the myshopify.com backend domain, published product/collection counts, shipping countries.
• /collections.json, /pages.json — every collection and page body (including legal texts).
• /admin — a 301 redirect that reveals your store.myshopify.com backend domain.
• Page source — cdn.shopify.com/extensions/… URLs list your installed apps; Shopify.theme discloses your theme name and version.

Some of these (like /cart.js and search suggestions) are documented Ajax APIs; bulk endpoints such as /products.json and /meta.json are undocumented legacy surfaces that Shopify intentionally keeps serving — staff have acknowledged this on the community forums.

Is this a security vulnerability?

No — technically this is deliberate platform design, not a flaw. Shopify serves this data publicly so themes and apps can function; there is no per-store switch to disable it. That is why scan reports flag these as "public surfaces", not vulnerabilities.

But "not a bug" doesn't mean "irrelevant": because the data is public, the question of who reads it and what they infer is a competitive-position question — and that part is in your control.

What can a competitor do with it?

Practical scenarios:

• Price and catalog intelligence: /products.json hands over your full price list, variants and SKU structure in one request — competitor price tracking becomes fully automated.
• Sales-velocity signal: when a product sells, stock updates and updated_at shifts — anyone polling hourly can estimate which products move fastest. The best-selling sort exposes your sales ranking directly.
• Product lifecycle: created_at fields reveal your launch cadence and catalog growth rate.
• Technology inventory: extensions/ traces in the page source show which marketing, reviews, consent and operations apps you run — your stack is open to competitors.
• Phishing surface: the myshopify.com domain from the /admin redirect is ready-made material for targeted credential-phishing pages.

Verify it yourself

Three commands against your own store:

curl -s "https://yourstore.com/meta.json" — returns country, currency, backend domain and catalog counts.

curl -s "https://yourstore.com/products.json?limit=5" — lists your product records with prices and timestamps.

curl -sI "https://yourstore.com/admin" | grep -i location — shows your myshopify.com backend address.

Also open the page source (Ctrl+U) and search for extensions/ — you will see your installed apps the same way a competitor does.

What you can and cannot change

You cannot disable these endpoints — on standard Shopify there is no control; on Plus/headless setups they can be partly turned off but that is the exception.

You can:

• Move sensitive data out of product fields: descriptions, tags and variant fields land in the public JSON. Keep supplier codes, margins and internal notes in metafields — they don't appear in these endpoints.
• Hide the best-selling sort: change the default collection sort that leaks your sales ranking, via theme settings or an app.
• Audit consent coverage: your app list is public, so "trackers installed, no CMP" shows up in reports — if marketing apps are installed, a consent solution needs to be actually running too.
• Plan with awareness: price and launch timing decisions should assume your catalog data is readable — what you think is hidden may already be scraped.

Frequently asked

Can I disable products.json entirely?

Not on standard Shopify — the endpoint is served by the platform. What you can do is move sensitive data to metafields and limit what leaks through sort/collection settings.

Would a competitor actually use this?

The data is one GET request away, so price-tracking tools and scraping services use it routinely. Even if you're not individually targeted, being included in bulk crawls is normal.

Does this count as a data-protection violation?

The endpoints themselves are platform behaviour; however if product/page fields contain personal data (addresses, notes, order info), that content is public and becomes a separate compliance risk — keep personal data out of product text.

How do I measure this on my store?

Our free scan checks three things: meta.json exposure, the installed-app inventory (including consent gaps) and catalog/backend exposure — findings land in the report with evidence.

This page is technical guidance; no ranking or AI citation guarantee is claimed.