Custom app security sweep
Custom apps built for your store by an agency or freelancer need an IP allowlist, and existing apps need one by 1 January 2027. It’s a quick list now, or a broken integration in January.
What to do
- List your custom appsIn Settings > Apps, note any custom apps an agency or freelancer built. Shopify now shows each app’s security status, including IP restrictions.
- Email whoever built themAsk each one to set up an IP allowlist, the networks the app is allowed to connect from, and when they’ll do it.
- Check apps that sync lots of dataFor App Store apps that handle stock, orders or customers, ask the developer whether they have an allowlist too.
- Test once it’s doneAfter each change, check stock syncs, order exports and other integrations still work.
Related: Custom apps need a security setting before New Year
Your result
Send this to your director
Hi [name], Shopify now requires custom apps built for our store to have an IP allowlist, with existing apps needing one by 1 January 2027. I’ve listed our custom apps and sorted or chased [number] of them, so our integrations don’t break in the new year. [Your name]
Share your result
Post it on LinkedIn with #EcomWireChallenge. We read every one and shout out the best results each month.
Did the #EcomWireChallenge custom app security sweep 🛡️ Sorted or chased a few custom apps before Shopify’s 1 January deadline. Took about 20 minutes. Your turn 👇 https://www.ecomwire.co.uk/challenges/custom-app-security
Weekly digest
Get updates like this every week