Shopify monitoring for theme, apps and checkout
Shopify provides the servers, the platform and the TLS certificates. XICTRAQ checks what can still break: the path from product page to checkout, scripts from apps and third parties, the look of your storefront after theme changes, your own domain and the tracking in your theme.
Check these paths first
- Uptime monitoringHomepage reachable, keyword instead of password page
/ - Script integrityExternal scripts from apps and third parties
/ - Browser monitoringProduct is added to the cart
/products/{handle} - Browser monitoringCart leads on to checkout
/cart - Uptime monitoringCatalogue page with all products responds
/collections/all - Uptime monitoringSitemap index is served
/sitemap.xml
What stays with you in a hosted shop
With Shopify, the provider takes care of servers, platform updates and TLS certificates. Part of the shop is still in your hands: the theme and its customisations, installed apps and embedded third-party scripts, your own domain with its DNS records, and the tracking. When something changes there, the homepage can keep answering normally while the add-to-cart button no longer responds or analytics data goes missing.
XICTRAQ therefore spreads the checks across several modules: uptime monitoring for homepage and subpages, browser checks for the path from product page to checkout, script integrity for external scripts, the visual changelog for visible changes, and DNS and domain monitoring for your own address.
In checkout you have less access than in the theme: checkout.liquid is no longer supported for the information, shipping and payment steps, and on the thank-you and order status pages Shopify replaces additional scripts with pixels that run in a sandbox. Whether checkout is reachable is therefore checked from outside by a browser check; the tracker usually does not read the purchase there.
Let browser checks end on the checkout page without entering payment details or submitting the order, so that no real orders are placed. The check browser blocks requests from the XICTRAQ tracker so that check runs are not counted as visits.
What typically breaks in Shopify shops
Theme update breaks the add-to-cart button
A new theme version, an edited template or an app embed can change the product form while every page answers normally. A browser check opens a product page, adds the item to the cart and checks the result; if a step fails, it raises an alert and usually captures a screenshot. The visual changelog also compares screenshots of the monitored page and reports large visible changes.
An app or third party changes a script
Apps and marketing tools embed scripts from external addresses whose content can change without any action on the shop’s side. When the page is scanned, script integrity reads up to twelve external scripts from the HTML, stores the SHA-256 hash for each address and then fetches these addresses regularly: if the content changes, it reports it; if an address is no longer reachable, it warns once. A script under a new address is only added as a new reference with the next scan, without an alert; scripts loaded later in the browser are not covered.
The path to checkout breaks off
A cart drawer, a discount app or a script error can stop the checkout button from opening checkout. A browser check walks this path from the cart and checks whether the address switches to checkout and expected content is visible. The tracker also reports JavaScript errors from real visits on the pages where it is loaded.
Your own domain no longer points to Shopify
For a domain you manage outside Shopify, the DNS records are with you or your registrar. If an A, AAAA or NS record changes, XICTRAQ writes it to the changelog; if the certificate served no longer matches the hostname or has expired, a critical SSL alert follows. If the domain registration is about to run out, XICTRAQ warns in advance, provided the registry supplies an expiry date.
Shop accidentally behind the password page
When the online store password protection is active, visitors see a password page instead of the shop. A keyword check for text that only appears in the open shop, such as a menu item, reports when it is missing. If Shopify answers with an error status in that case, the availability check already fires.
Tracking missing after a theme switch
The tracking snippet lives in the theme files, for example in layout/theme.liquid. If you publish a different theme, it is missing there until it is added again, and visitor numbers drop without the shop going down. A keyword check for the tracker script embed, such as the site ID in the data-site attribute, reports when the snippet is no longer in the HTML.
How XICTRAQ recognises Shopify
Server-side technology detection reads the HTML of the monitored page; this determines which apps appear in the scan and how a system change is recorded. The tracker decides separately in the browser which branch it uses.
- XICTRAQ recognises Shopify by traces such as cdn.shopify.com, Shopify.theme or shopify-section in the page HTML.
- The scan recognises embedded apps and services as far as their script addresses or markup traces are in its signature list.
- If the detected system changes, for example when a shop moves to Shopify, XICTRAQ writes a “CMS changed” entry to the changelog.
- In the browser, the tracker recognises Shopify by window.Shopify, window.ShopifyAnalytics or the shopify-checkout-api-token meta tag and then uses its own branch instead of the generic detection of add-to-cart buttons, checkout and purchase.
- XICTRAQ does not offer a version or vulnerability check for Shopify itself: platform updates are applied by Shopify.
What the tracker captures in Shopify
You add the tracker to your theme as a snippet. It sets no cookies and reads shop events from the data and requests the theme provides in the browser; it usually does not run in checkout.
Captured by the tracker on its own
- Page views with referrer, UTM parameters and device type, plus load times and Web Vitals such as LCP, CLS and INP.
- Product views on product pages with ID, name, SKU and price from the product data Shopify provides on the page.
- Add-to-cart requests the theme sends via fetch to /cart/add, with variant ID and quantity; name and price as far as they appear in the page markup.
- Signed-in customers via the customer ID, provided Shopify exposes it on the page.
- Consent from the Shopify Customer Privacy API. It decides on session recording; cookieless measurement runs independently of it.
- E-commerce events such as view_item, add_to_cart or purchase from a dataLayer, if an app or the theme places them there.
- JavaScript errors from real visits with message, file and line.
Not captured automatically
- As a rule, checkout start and purchase with revenue: theme scripts do not run in checkout, and on the thank-you and order status pages Shopify replaces additional scripts with sandboxed pixels.
- Add-to-cart actions sent as a classic form submission or via XMLHttpRequest instead of fetch.
- Quantity changes and removals via /cart/change. In the cart only generic selectors apply, and they have to match the theme.
- The selected variant on a product view: the data of the first variant is reported.
- The shop currency on product views and cart events: they are reported as EUR.
- Refunds and cancellations. There is no automatic event for them.
- Product and price with the Buy Button on other websites: at most clicks on the first buy button on the page are recorded.
Pass missing values from your theme through the JavaScript API, for example xictraq.cart("add", { id, name, price, currency, quantity, variant }) in themes that fill the cart by form instead of fetch, or xictraq.cart("remove", { id, name, price, currency, quantity }) when an item is removed from the cart. Pass amounts as decimals, not in cents. The API only works on pages where the tracker is loaded; XICTRAQ offers no server-side route for purchases made in checkout.
The right modules for Shopify
Frequently asked questions
Why monitor when Shopify runs the servers?
Shopify takes care of servers, platform and TLS certificates, not of your theme, your apps, your own domain and your tracking. That is where errors can occur that cost revenue while the homepage answers normally: an add-to-cart button that stops responding after a theme update, or a snippet that is missing after a theme switch. XICTRAQ checks these places with browser checks, script integrity, the visual changelog and keyword checks.
Can XICTRAQ test the Shopify checkout without placing orders?
Yes, with a browser check that adds a product to the cart, moves on to checkout and ends there without entering payment details. The check verifies the address and visible content of the checkout page and usually captures a screenshot of a failed step. The check browser blocks requests from the XICTRAQ tracker so that its page loads are not counted as visits.
Does XICTRAQ report when an app changes its script?
Script integrity reports when the content of an external script changes that it recorded under its address when the page was scanned; it records up to twelve such scripts per scan. If an app update brings a new script address, it is only added as a new reference with the next scan, without an alert. Scripts loaded later in the browser and scripts served from the shop’s own domain are not part of this check.
Do I need SSL monitoring if Shopify provides the certificates?
Shopify issues the certificate for your own domain when its DNS records point to Shopify. If the records no longer match, for example after changing registrar, the address can serve a certificate that does not match the hostname. XICTRAQ reports an invalid, expired or mismatched certificate as a critical alert and writes changes to A, AAAA and NS records to the changelog.
Does XICTRAQ detect Shopify password mode?
Not as a separate state. With a keyword check for text that only appears in the open shop, XICTRAQ reports when that text is missing because the password page is shown instead. If Shopify answers with an error status, the availability check already fires.
Does the tracker capture purchases in Shopify checkout?
As a rule, no. Theme scripts do not run in checkout, and on the thank-you and order status pages Shopify replaces additional scripts with pixels in a sandboxed environment. Product views and add-to-cart requests via fetch in the theme, on the other hand, are captured automatically, and purchase events from a dataLayer only on pages where the tracker is loaded.