shopify.com

Missing. Limits where scripts may load from, which is the main defence against injected code and card skimmers.

Add a Content-Security-Policy header, starting in report-only mode.

Cookies are set without the Secure and/or HttpOnly flags, so they can be read by scripts or sent over insecure connections.

_shopify_essential_=921af435-3b50-44ba-bd22-88b56eb6a4e0; Domain=shopify.com; Path=/; Expires=Tue, 17 Aug 2027 21:28:22 GMT; Secure; SameSite=Lax

Add Secure, HttpOnly and SameSite to every cookie you set.

Missing. Stops your site being framed inside someone else's.

Send X-Frame-Options: SAMEORIGIN, or use CSP frame-ancestors.

Missing. Controls how much of your URL is leaked to other sites.

Send Referrer-Policy: strict-origin-when-cross-origin

Secure connection working.

Plain HTTP requests are redirected to the secure version.

All resources load securely.

Certificate valid for another 82 days (expires 2026-11-08).

Negotiated TLSv1.3.

HSTS is set.

MIME sniffing protection is set.

No MTA-STS policy, so mail to you can be delivered unencrypted if an attacker strips TLS.

Publish an MTA-STS policy and the _mta-sts TXT record.

No TLS-RPT record, so delivery-encryption failures go unreported.

Publish a _smtp._tls TXT record with a reporting address.

DKIM keys published on selector(s): google, mail.

5 mail server(s) configured.

Ends in ~all (soft fail) — the usual safe setting.

The record forces about 3 DNS lookups. Comfortably within the limit of 10.

Aggregate reports are being sent to a reporting address.

One SPF record, as required.

DMARC policy is p=reject.

BIMI record present — your logo can appear beside your emails.

26 of 52 images declare dimensions. Images without dimensions cause the page to jump as they load, which is what Cumulative Layout Shift measures.

Set width and height attributes on every image.

96 of 212 image(s) provide a srcset. Without one, a phone downloads the full desktop image and then scales it down — paying for pixels it never shows.

Add srcset and sizes so each device downloads an appropriate image.

Served with gzip compression.

Median response across 12 page(s) was 93 ms.

Homepage HTML is 417 KB.

0 external script file(s) on the homepage.

Pages may be cached by browsers and CDNs.

29 image(s) are served as WebP or AVIF.

47 of 52 images use lazy loading.

Title is 66 characters. Google truncates around 60 characters, and a title under 10 tells it almost nothing.

Shopify: The All-in-One Commerce Platform for Businesses - Shopify

Write 50-60 characters covering what you do and where you do it.

No BreadcrumbList markup. Google replaces the raw URL in your listing with a readable breadcrumb trail when this is present, which is more legible and measurably more clickable — and it is one of the cheapest rich results to earn.

Add BreadcrumbList JSON-LD to every page below the homepage.

No WebSite markup. With a SearchAction it can give you a search box directly inside your Google listing for branded queries.

Add WebSite JSON-LD, with potentialAction/SearchAction if the site has its own search.

No /llms.txt. It is a short, plain-text map of what a site is and which pages matter — a convention some assistants read to decide what to quote, and cheap to publish. It is not yet a standard anyone is obliged to honour, so treat it as a low-cost bet rather than a requirement.

Publish /llms.txt: a heading, one paragraph describing the business, and a linked list of your most important pages.

Homepage is open to indexing.

Mobile viewport is declared.

Sitemap found listing 833 URLs.

Description is 142 characters.

Canonical points at this page.

Structured data found: ContactPoint, Corporation.

robots.txt present and open to search engines.

Every canonical points at a page that is allowed to be indexed.

Every hreflang reference is reciprocated by the page it names.

Canonical targets all return 200.

All structured data blocks are valid JSON.

No page relies on a directive Google is blocked from reading.

Every hreflang value is a valid language or language-region code.

Every marked-up entity carries the properties Google requires.

10 of 12 crawled page(s) (83%) can actually be indexed.

Every page with hreflang annotations includes itself.

Every hreflang target is a live, indexable page.

Identified as Corporation.

No canonical points at a page that then canonicals somewhere else.

Every sitemap URL is its own canonical.

All structured data is present in the HTML the server sends.

Every major assistant is allowed to read and cite these pages.

Every crawled page sits within four levels of the homepage (deepest: 4).

6 Open Graph tags found.

An x-default version is declared for visitors whose language matches none of your versions.

URLs use lowercase, hyphenated, extension-free paths.

0 of 12 crawled URLs carry query parameters other than tracking tags.

Language attribute present.

5 twitter: tag(s) found.

2 structured data object(s) across 12 page(s): ContactPoint, Corporation.

No model-training crawler is blocked, so this content may be used to train future models. This is a business decision rather than an SEO one, and it is separate from being cited in answers: refusing training does not remove you from AI results, and allowing it does not put you in them.

49 link(s) appear on nearly every page — the site-wide navigation, which is where most internal authority is allocated. 7 of them point at legal, account or administrative pages, and 5 of those sit among the eight best-linked pages on the site — level with, or above, the pages you sell from. Nobody decides this: a crawler counts every footer link as an endorsement repeated on every page, while visitors ignore footers. Those pages must exist and should not be among the best-linked things you publish.

shopify.com/  0.2%
shopify.com/careers  0.2%  [utility]
shopify.com/investors  0.2%
shopify.com/news  0.2%
shopify.com/climate  0.2%
shopify.com/partners  0.2%
shopify.com/affiliates  0.2%
shopify.com/partners/directory  0.2%

9 crawled page(s) are not linked from any other page we fetched. A page reachable only from a sitemap receives no internal authority at all, and is crawled rarely — it can rank, but it starts from nothing and stays there.

shopify.com/investors/ir-direct
shopify.com/resource/ai-series
shopify.com/compare/time-to-value
shopify.com/first-sale/seo-checklist
shopify.com/print-on-demand/dog-tags
shopify.com/legal/eu-terms

Link them from a relevant hub page or from navigation, using the subject as the link text.

One page receives more than half of all internal links found. That concentrates authority in one place while the rest of the site is starved of it.

Link deliberately to the pages you want to rank, not only to the same one from every template.

No publisher in your structured data. It ties each page back to the organisation that stands behind it, which is what carries trust from your brand to an individual article.

Add a publisher property naming your Organization, with its logo.

All 12 crawled pages have distinct titles.

Across 12 page(s), the median page is 67% its own content and the rest navigation, footer and legal text.

All 12 crawled pages carry substantial content.

0 of 12 crawled pages have no meta description.

0 of 212 images across the crawl have no alt attribute. Alt text is how search engines read images and how screen readers describe them.

Every crawled page carries at least three internal links, so navigation is consistently rendered.

No two crawled pages share substantially the same text.

All 12 crawled pages returned successfully.

No page answers 200 while telling the visitor nothing was found.

No two crawled pages appear to target the same subject.

Every page's body covers the subject its title and heading announce.

All 12 descriptions found are distinct.

Authorship is declared.

5 of 2250 internal link(s) use text like 'click here' or no text at all.

No phrase dominates a page's text.

An about or contact page is linked.

Median reading ease is 60.1 — readable.

2 of 12 pages do not have exactly one H1 heading.

No multi-step redirects found.

Sitemap lists 833 URLs; we reached 12 by crawling. 821 sitemap URLs were not linked from the pages we visited.

Every crawled page links onward.

Internal links concentrate authority on the pages below, in order. This is the site's own ranking of itself, derived from how it links — read it against what the business actually sells, because search engines read it the same way. Only the crawled sample is modelled, so this describes the navigation rather than every page.

The terms that distinguish each page from the others on this site — not the most frequent words, but the ones this page uses and the others do not. Read them as what a search engine would take the page to be about, and check that it matches what it is for.

All 833 sitemap URLs share just 1 lastmod value(s), which makes it a build timestamp rather than a real modification date. Google detects this and stops trusting lastmod for the whole site, so genuinely updated pages are no longer recrawled promptly.

['2026-08-17', '2026-08-17', '2026-08-17']

Emit lastmod from the date the page content actually changed, not from the time the sitemap was generated.

DNSSEC is not enabled, so DNS answers for your domain can't be cryptographically verified.

Enable DNSSEC at your DNS provider.

No CAA record, so any certificate authority may issue certificates for your domain.

Publish a CAA record naming the certificate authority you use.

3 nameserver(s) configured.

Checked 0 subdomain(s); none point at a cloud service that has released them.

No filter, session or calendar URLs that would generate an unbounded space were found.

Every page was reached directly or in a single hop.

0 of 12 URL(s) followed during this crawl returned a redirect or an error (0%).

Your certificate covers only your own domain.

Every sitemap file is within the 50,000 URL and 50 MB limits.

0 internal link(s) are marked nofollow.

No version numbers advertised in response headers.

Served from AS13335 (CLOUDFLARENET - Cloudflare, Inc.), announced in 23.227.38.0/23 — a block of 512 addresses.

12 page(s) were examined, chosen to cover 11 of the 416 distinct page templates found across 833 known URLs. Pages are sampled by template rather than in sitemap order, because the first pages of a sitemap are usually all the same kind — a sample of one template would describe that template rather than the site. Findings below therefore apply to the templates listed, and a fault in a template is normally a fault on every page built from it.

89 of 104 tappable element(s) are smaller than 48x48 pixels, and 37 sit closer than 8 pixels to a neighbour. On a phone that means links and buttons that are hard to hit without zooming, and mis-taps on a checkout or contact button cost conversions directly.

Toggle Consent Management Menu (32x32)
svg (32x32)
Accept all (100x32)
Reject (76x32)
BUTTON (32x32)

Give tappable elements at least 48x48 CSS pixels and 8 pixels of spacing — usually padding on the link rather than a bigger font.

JavaScript rewrites the page title after load. Google usually indexes the served title, so the one you see in the browser may not be the one shown in search results.

served:   Shopify: The All-in-One Commerce Platform for Businesses - Shopify
rendered: Shopify France

Set the final title server-side rather than changing it in script.

The title tag changes after JavaScript runs. Google usually indexes the rendered title, but rendering is queued separately and can lag the first crawl, so for a while the served title is what appears in results.

served:   Shopify: The All-in-One Commerce Platform for Businesses - Shopify
rendered: Shopify France

Render the final title server-side.

The served HTML contains 1259 words and the rendered page 1254 — the content is present before JavaScript runs.

What the server sends a phone matches what it sends a desktop browser.

328 links in the served HTML, 325 after rendering — navigation is discoverable.

Cumulative Layout Shift measured at 0.000 (good is 0.1 or less).

The page loaded without JavaScript errors.

Every image, script and stylesheet loaded.

The page fits the mobile viewport with no sideways scrolling.

0 long JavaScript task(s) blocked the main thread while loading.

2 of 156 text block(s) render below 12px on a mobile viewport.

The page made 74 network requests to load.