How to Tell If a Website Is Built With Shopify (and Find Its Theme & Apps)
Six reliable ways to confirm a store runs Shopify, then how to uncover its theme and apps — plus the tells that survive a custom domain or a headless build.
Want to know whether an online store runs on Shopify — and which theme and apps power it? You can usually confirm the platform in seconds, then dig into the theme and app stack from there. Shopify is one of the most widely used e-commerce platforms on the web, powering millions of live stores according to W3Techs, so for any unknown shop it is a sensible first guess. Here are six reliable signals, from fastest to most thorough.
This guide focuses on Shopify specifically. If you want the broader picture first, start with how to find out what a website is built with.
Why it is worth identifying Shopify
Knowing a store runs Shopify is genuinely useful. Merchants and dropshippers study competitors' themes and apps to see what a successful store actually uses. Agencies and developers size up a migration or redesign by understanding the current setup. App and theme makers research the market and find prospects. And for sales teams, every Shopify store is a qualified lead for complementary apps, themes or services. Because Shopify leaves such a clear fingerprint, this one check tends to unlock the rest of your research quickly.
1. Look for cdn.shopify.com and /cdn/shop/ asset paths
View the page source (Ctrl/Cmd + U) and search for cdn.shopify.com. Shopify serves theme assets, product images and scripts from this CDN, and its presence is the single strongest front-end indicator of the platform. Newer stores increasingly use the /cdn/shop/ path on the store's own domain (for example /cdn/shop/products/…), which is equally telling. Either pattern is hard to fake by accident.
2. Check the source for the Shopify JavaScript objects
Shopify storefronts initialise global JavaScript objects that are easy to spot. Open developer tools (F12), go to the Console, and type window.Shopify — on a Shopify store this returns an object describing the shop. The source also commonly contains Shopify.theme, ShopifyAnalytics and Shopify.shop (the latter often revealing the internal *.myshopify.com domain). These objects are part of how the storefront works, so they are present even when the store uses a polished custom domain.
3. Read the HTTP response headers
Open the Network tab, reload, and click the main document request. Shopify sets distinctive headers that themes cannot strip because they originate at the server:
x-shopify-stage— names the Shopify environment serving the request.x-shopidandx-sorting-hat-shopid— internal store identifiers.powered-by: Shopifyappears on some responses, and theserverheader may reference Shopify's infrastructure.
Headers are the most authoritative manual signal, so a Shopify header plus a cdn.shopify.com asset is about as certain as detection gets.
4. Inspect the public product and collection endpoints
Many Shopify stores expose structured data at predictable public endpoints — most notably /products.json and /collections.json — which return product information as JSON. A well-formed JSON response in Shopify's familiar shape is strong confirmation of the platform. (These endpoints are public by design; some merchants disable or restrict them, so a missing response is not proof a store is not on Shopify.)
5. Check the checkout flow
Shopify's checkout is a recognisable, centrally hosted experience. Historically it lived on checkout.shopify.com or a *.myshopify.com host, and even with custom domains the checkout markup and behaviour are distinctive. You do not need to complete a purchase — reaching the cart and beginning checkout is enough to see the platform's signature, which is especially useful when a store has aggressively customised its storefront theme.
How to find the active theme
The theme is the most readable layer once you have confirmed Shopify. The Shopify.theme object in the source typically carries the theme's name and numeric id. Search the page source or Console for Shopify.theme and read the value. Theme assets also load from a path like /cdn/shop/t/<n>/assets/…, where the structure hints at how the theme is organised. Popular commercial themes — Dawn (Shopify's free reference theme), and marketplace themes such as Debut, Impulse, Prestige and Turbo — have recognisable asset and class conventions. A heavily customised or agency-built theme may report a generic or blank name; in that case the asset structure and class naming are your best clues.
How to identify apps
Shopify's strength is its app ecosystem, and most apps announce themselves through the front-end resources they inject. In the Network tab, filter by JS and CSS and read the source domains and asset paths:
- Review and ratings apps, upsell and bundle apps, subscription apps, page builders and loyalty widgets each load scripts from their own domains.
- Snippet signatures in the HTML (distinctive class names,
data-attributes or container IDs) often name the app directly.
As with any platform, this detects apps that add front-end assets; purely back-office apps leave no public trace, so the list is a representative sample rather than a full inventory.
Common app categories and how they look
A few app types appear on a large share of stores, and each has a recognisable footprint:
- Reviews (such as Judge.me, Loox or Yotpo) inject star-rating widgets and load star and photo assets from the app's own domain.
- Upsell, bundle and cross-sell apps add cart-drawer and product-page widgets, often with distinctive container IDs.
- Subscriptions apps insert a "subscribe and save" selector near the buy button.
- Page builders (such as PageFly or GemPages) leave their own class prefixes across landing pages.
- Print-on-demand and dropshipping integrations are harder to see from the storefront alone, but a generic supplier theme, long shipping-time copy and certain fulfilment scripts are common tells.
Reading the app stack tells you how a store competes — on social proof, on average order value, on retention — which is often more revealing than the theme itself.
Shopify Plus and headless (Hydrogen) builds
Two variants change what you see. Shopify Plus is the enterprise tier; it uses the same storefront fingerprints, but you may notice Plus-only features such as checkout.liquid customisations or scripts tied to Plus apps. Headless Shopify built on Hydrogen renders the storefront through a separate React framework, so the classic theme tells can be absent — but the cart and checkout still run on Shopify, and the Storefront API calls in the Network tab give it away.
Shopify, or a different platform?
If the Shopify tells are absent, the store is probably on another platform with its own fingerprints. WooCommerce (on WordPress) exposes /wp-content/plugins/woocommerce/; BigCommerce serves assets from cdn11.bigcommerce.com; and Wix Stores or Squarespace Commerce show their builder's signature instead. Knowing the negative is as useful as the positive — if you came looking for Shopify and found WooCommerce, your whole read on that store changes.
When the signals are hidden
A store can run Shopify while showing fewer obvious tells: a fully headless build, an aggressive reverse proxy, or a custom checkout can mask the storefront. In those cases, combine the checkout signature, the presence of Shopify API requests in the Network tab, and any cdn.shopify.com or /cdn/shop/ asset that slips through to reach a confident answer.
How reliable is each signal?
| Signal | What it proves | Reliability |
|---|---|---|
cdn.shopify.com / /cdn/shop/ assets | Shopify storefront | Very high |
window.Shopify / Shopify.theme object | Shopify storefront | Very high |
x-shopify-stage / x-shopid headers | Shopify infrastructure | Very high |
Well-formed /products.json | Shopify storefront | High |
| Recognisable Shopify checkout | Shopify | High |
A quick worked example
Say you land on a polished store at a custom domain with no obvious branding. Open the source and search cdn.shopify.com — a hit on a product-image URL already strongly suggests Shopify. Open the Console and type Shopify.theme; it returns an object naming the theme (say, Impulse), confirming both the platform and the theme at once. Switch to the Network tab, reload, and you notice scripts from a reviews app and an upsell app loading from their own domains. In under a minute you know the platform, the theme and two key apps — without a single guess.
How accurate is Shopify detection?
For a standard storefront, Shopify detection is highly reliable — the CDN assets, JavaScript objects and headers triangulate quickly. Theme detection is dependable whenever the Shopify.theme object is populated. App detection is the softer layer: you catch front-end apps well but miss server-only ones, so read the app list as a sample. The professional habit applies as always — confirm the platform with at least two independent signals before you rely on the result.
The fast, reliable workflow
- Search the source for
cdn.shopify.comor/cdn/shop/. - Check the Console for
window.ShopifyandShopify.theme. - Read the response headers for
x-shopify-stageorx-shopid. - Try
/products.jsonfor a Shopify-shaped JSON response. - Glance at the checkout for the platform's signature.
- Cross-check at least two of the above before concluding.
Go deeper
- New to detection? Start with how to find out what a website is built with.
- Comparing platforms? See how to find out what e-commerce platform a website uses.
- Curious about infrastructure too? Read how to find out where a website is hosted.
Want all of this in one click? Analyse any store with StackOptic to see its platform, theme, apps and full stack instantly — free, no sign-up.
Frequently asked questions
How can I tell if a website is built on Shopify for free?
Open the page source and search for cdn.shopify.com or the newer /cdn/shop/ asset path. If either appears, the store is almost certainly on Shopify. You can also look for a Shopify.theme or window.Shopify object in the source, check the response headers for x-shopify-stage, or run the URL through a free detector such as StackOptic, which checks every signal at once.
How do I find out which Shopify theme a store uses?
The theme name and ID are commonly stored in the Shopify.theme JavaScript object in the page source. Open developer tools, search the Elements or Console for Shopify.theme, and the theme name appears alongside it. Some heavily customised or agency-built themes report a generic name, in which case the asset paths under /cdn/shop/t/ still hint at the theme structure.
Can you see what apps a Shopify store has installed?
You can detect many of them. Apps inject scripts and styles from their own domains, so the third-party resource domains in the Network tab name the apps in use — review widgets, upsell tools, subscriptions, page builders and so on. Apps that run only on the server or in the admin leave no front-end trace, so treat the list as a strong sample rather than a complete inventory.
Why does a Shopify store sometimes not look like Shopify?
Stores on a custom domain still load assets from cdn.shopify.com, so the platform is usually visible. The exception is a headless build with Shopify Hydrogen or a custom storefront, which renders through a separate framework and may hide the classic tells. In those cases the checkout flow and certain API responses are the giveaways.
Is it legal to check what platform a store is built on?
Yes. Platform detection only reads information the store already sends to every visitor — the public HTML, asset URLs and response headers. It does not access private data, the admin, or anything behind authentication. It is the same information your browser receives when you open the store.
Analyse any website with StackOptic
Get the full technology stack, performance, security and SEO report in seconds — free.
Analyse a websiteRelated articles
How to Tell if a Website Uses Progressive Web App (PWA) Features
A web app manifest, a registered service worker, installability and a theme-color tag are the PWA signals. Here is how to detect them in Chrome DevTools.
How to Tell if a Website Uses Akamai, Fastly, or CloudFront
Each major CDN leaves distinct header fingerprints — Fastly's x-served-by, Akamai's ghost markers, CloudFront's x-amz-cf-pop. Here is how to tell them apart.
How to Tell if a Website Uses Google reCAPTCHA
Google reCAPTCHA leaves signals: a recaptcha/api.js script, a grecaptcha global and a g-recaptcha data-sitekey. Here is how to detect it and tell v2 from v3.