#BlinkTank: Shopify delists hundreds of apps after the checkout hacks
Last week I said security was likely to become a much bigger issue, even on a platform as locked down as Shopify, and it hasn't taken long. Following the checkout hacks, Shopify has delisted hundreds of apps, including some well-known names, and told developers that tighter security requirements are on the way.
Elsewhere, Shopify has also moved Knowledge Base into the admin, with a January deadline for anyone still using the app, UK VAT on Great Britain orders now follows fulfilment location, and Rollouts can schedule price and availability changes.
There are two more things to check before peak. EU parcels need product identifiers on their customs paperwork from 1 November or risk being turned back, and Performance Max may already be pulling videos from your social accounts into your ads.
On to the news!
Shopify delists hundreds of apps after the checkout hacks
Between 14 and 22 October Shopify delisted 478 apps following the checkout hacks in which compromised apps sent customers to fake payment pages. New stores can't install a delisted app, but most keep working on the stores that already have them, so if you have a few dozen apps, there's a fair chance at least one of yours is on the list. We obviously recommend auditing this as soon as possible.
Only three developers have confirmed that unauthorised code got into their apps - HulkApps, Logbase (Selleasy) and Swym, which switched Wishlist Plus off for every merchant on 18 October. The list also includes Privy, Consentmo, Rebuy, ReConvert, 17TRACK and several Bold apps with no public link to the attacks.
On 20 October Shopify asked developers to use expiring access tokens and switch on two-step authentication, and said stricter rules for storefront app code and App Store listings are coming, although no dates have yet been given.
The process here should be pretty simple - check your installed apps against the list, and disable the app embed before uninstalling anything you no longer use, because you won't be able to reinstall the delisted app.
π Securing your app, together (Shopify developer forum)β
π Delisted Shopify apps list (Revenue Shield)β
Shopify moves Knowledge Base into the admin
Knowledge Base has been around for a while, but, as we keep saying, it's largely unused by most brands. However on 26 October Shopify moved Knowledge Base into the admin, under Sales channels, and said the standalone app will be withdrawn on 15 January 2027.
It's pretty clear what Shopify is trying to do - it's pushing Knowledge Base as a built-in source of what AI agents are told about your store. The really interesting part is that Shopify is drafting this information from your live pages and giving you the option to publish it to AI. This looks like the overhaul we guessed was coming when Andy Russell on our team spotted the new Knowledge Base metaobject a couple of weeks ago.
Stores with fewer than 1,000 facts in the old app have had them moved across and published, while stores with more have had nothing moved and need to re-add the ones they want before 15 January. Shopify has emailed the stores affected.
The drafts will repeat whatever your pages say, including where they contradict each other, and the changelog doesn't say whether a published fact updates when its source page changes.
When we used our FAQ tool on client sites this week, it found returns windows that differed between the shipping policy, refund policy and FAQs on more than one store, so most brands are going to have a fair bit of cleaning to do.
π Knowledge base is now built into your admin (Shopify Changelog)β
EU product identifiers become mandatory on 1 November
From Sunday, every item in a direct-to-consumer parcel to the EU worth under β¬150 needs product identifiers on its customs paperwork, and parcels without them may be rejected at customs and returned at your cost. If you buy labels through Shopify Shipping or Managed Markets, Shopify pulls the identifiers from your product data and won't sell you a label for an item that's missing them.
Two fields matter. A standard identifier (GTIN, EAN, UPC or ISBN) goes in the barcode field, with a declaration on the product page if the product doesn't have one, and a manufacturer's model number, part number or style code goes in as a second barcode, with your own SKU accepted where there's nothing else. Both can be added in bulk, and Shopify uses HS codes to apply exemptions automatically.
Stores that already keep GTINs clean for Merchant Center will barely notice this, but on a large catalogue with patchy supplier data (which is plenty of stores we come across), four days is a tight window. If you buy labels outside Shopify, ask your carrier or 3PL how they're handling it.
π New EU product identifiers supported on Shopify Shipping & Managed Markets labels (Shopify Changelog)β
Performance Max can now pull your social videos into ads
Here's one to check before Black Friday if you use Performance Max. Google can now add up to 10 videos per asset group from sources you approve, such as your social accounts, landing pages and YouTube channel, and the setting is on by default for new campaigns and may already have been switched on for some existing ones during what Google calls a recent platform update.
For most brands a short product clip from Instagram will do no harm, but an old promotion, a creator video licensed only for organic use or a clip for a discontinued range could end up in your ads at the busiest point of the year. To check, open the campaign, go to Asset optimization in the asset group section and look for Sourced videos, where Manage sources shows which URLs Google can take from.
π About sourced videos in Performance Max campaigns (Google Ads Help)β
π Google Ads adds a sourced videos toggle (Search Engine Roundtable)β
UK VAT now follows fulfilment location
Shopify now treats an order to Great Britain over Β£135 as an import if it's routed to a location outside the UK, and doesn't charge VAT at checkout even if you have a UK location, which in most cases means the customer is asked for import VAT and a handling fee on delivery.
If you have stock in more than one country, check your order routing rules and either assign these orders to a UK location or collect duties and import taxes at checkout. Orders of Β£135 or less, orders to Northern Ireland and existing orders are unaffected.
π More accurate UK VAT based on fulfillment location (Shopify Changelog)β
Rollouts can now schedule price and availability changes
You can now use Rollouts to schedule pricing and product availability changes per market, and release them together with theme and checkout changes, which should take some of the manual work out of switching Black Friday pricing on and off.
Shopify says you can also test catalogues against each other, but the changelog doesn't explain how traffic is split, how results are measured or which plans it appears on.
π Schedule and test catalog changes with Rollouts (Shopify Changelog)β
Jobs
Pentland Brands, the family business behind sport, outdoor and lifestyle brands, are looking for a Senior Ecommerce Manager to lead trading across its brands and markets following its recent move to Shopify. It's hybrid, based in Farringdon.
βAvon are looking for a Digital Product Owner to own the technical side of its Shopify setup, across B2C and B2B in more than 33 markets. It's a permanent, on-site role in Northampton.
βDermalogica are looking for a Head of Digitalisation to own its newly launched Shopify B2B shop for professional skin therapists and lead a CRM rollout. It's hybrid in Leatherhead, at Β£65,000 to Β£75,000.
βColart are looking for an Ecommerce Manager to manage the Winsor & Newton and Snazaroo stores across the UK, North America and the EU, with Shopify experience preferred. It's hybrid in London, at Β£45,000 to Β£55,000 plus bonus.
If you are hiring and the role fits someone with large-catalogue Shopify experience, or you are looking and have direct experience of this kind of work, send me a message.
As ever, thanks for reading. If you found this useful, forwarding it on to someone else who runs or works on a large-catalogue Shopify store helps us more than just about anything.
See you next week.
Sam
Who am I and what does Blink do?
I'm Sam Wright, Managing Director and co-founder of Blink SEO. We're a search marketing agency that works exclusively with large-catalogue Shopify stores - the kind where the challenge isn't just visibility, but helping customers find the right product in the first place.
We specialise in SEO and PPC for merchants managing hundreds or thousands of products. Most of our work starts with taxonomy: how a store is structured and categorised, and what that means for organic performance, paid efficiency, and on-site discovery.
If you found this useful and aren't already subscribed, you can sign up at blinkseo.co.uk/blinktank.
If you run a large-catalogue Shopify store and want to talk about organic or paid performance, reply to this email or find me at blinkseo.co.uk.