We passively checked the homepages of 1,106 online stores and sorted them by the platform they turned out to run on. The result splits cleanly in two, and the split is the finding.
Shopify stores: 98.5% perfect headers, 25.8% protected customers
Take the 341 Shopify stores on their own. On everything Shopify controls, they are close to flawless: 98.5% send HSTS, 98.5% send a Content-Security-Policy, 99.1% send X-Content-Type-Options, and 99.4% have no high-severity finding at all.
The same 341 stores, on the one thing Shopify cannot do for them: 25.8% enforce DMARC. The other three quarters can be impersonated in an email — a fake order confirmation, a fake “payment failed, re-enter your card” — sent from their own domain to their own customers.
The half the platform does for you
Hosted platforms terminate TLS and set response headers at their own edge, for every store on them, whether or not the merchant has ever heard of HSTS. That produces the widest gaps in the dataset — and they are gaps between vendors' defaults, not between merchants' diligence.
| Check (homepage, passive) | Shopify (341) | WooCommerce (71) | Everything else (661) |
|---|---|---|---|
| No HSTS | 1.5% (5/341) | 81.4% (57/70) | 57.2% (335/586) |
| No Content-Security-Policy | 1.5% (5/341) | 84.3% (59/70) | 60.1% (352/586) |
| No X-Frame-Options / frame-ancestors | 4.4% (15/341) | 77.1% (54/70) | 44.4% (260/586) |
| No X-Content-Type-Options | 0.9% (3/341) | 77.1% (54/70) | 45.4% (266/586) |
| Server / framework version disclosed | 0.0% (0/341) | 25.7% (18/70) | 14.3% (84/586) |
| Plain HTTP serves content or doesn't redirect | 0.6% (2/341) | 2.9% (2/70) | 20.0% (117/586) |
| Legacy TLS 1.0/1.1 accepted | 0.0% (0/341) | 0.0% (0/71) | 0.0% (0/661) |
| Certificate problem (expired / untrusted / mismatch) | 0.0% (0/341) | 0.0% (0/71) | 0.6% (4/661) |
| At least one HIGH-severity finding | 0.6% (2/341) | 4.2% (3/71) | 29.0% (192/661) |
Read those rows as a statement about Shopify and about WooCommerce, not about the people running the shops. A WordPress store owner who installs WooCommerce inherits an empty header configuration and a CSP that a page builder will break the moment it is switched on (MDN). A Shopify merchant inherits HSTS without a decision. Same diligence, different defaults.
The half that stays yours
Now the checks no platform can make for you, because they live in your registrar account and your own content: email authentication, mixed content, files left in the web root.
| Check (homepage, passive) | Shopify (341) | WooCommerce (71) | Everything else (661) |
|---|---|---|---|
| DMARC actually enforcing (quarantine / reject) | 25.8% (88/341) | 7.0% (5/71) | 37.7% (249/661) |
| No DMARC record at all | 17.6% (60/341) | 35.2% (25/71) | 23.0% (152/661) |
| DMARC published but p=none (monitor only) | 56.6% (193/341) | 57.7% (41/71) | 39.3% (260/661) |
| No SPF record | 14.7% (50/341) | 15.5% (11/71) | 10.9% (72/661) |
| Mixed content on the HTTPS homepage | 5.3% (18/341) | 27.1% (19/70) | 12.5% (73/586) |
| Exposed sensitive file or panel | 0.9% (3/340) | 2.7% (1/37) | 10.5% (55/524) |
The advantage collapses. On DMARC enforcement Shopify merchants are not merely no better — at 25.8% they sit below the 37.7% of the heterogeneous “everything else” bucket, and 56.6% of them are parked on p=none, which reports spoofing and blocks none of it. WooCommerce is worse still: 5 of 71 stores enforce DMARC.
One caveat belongs right here rather than at the end. The “everything else” bucket contains large retailers with in-house security teams, and larger companies are more likely to have done a DMARC rollout. So the cross-platform comparison on this row is confounded with merchant size and should not be read as “Shopify merchants are more careless.” The within-Shopify contradiction above is the finding that survives; this table is what makes it visible.
Across all 1,106 stores
- 31.3% (346/1,106) enforce DMARC. 46.2% publish
p=noneand 22.5% publish nothing. - 68.5% of the 454 stores that send both HSTS and CSP — the ones that look well-configured from a browser — still cannot stop an email being sent in their name.
- 43.2% send no Content-Security-Policy; 40.3% no HSTS.
- 12.1% still serve content over plain HTTP or fail to redirect to HTTPS.
- 7.3% (68/926) expose a sensitive file or panel — a
.gitdirectory, an.env, a backup, aphpinfo. - Zero accepted TLS 1.0 or 1.1, and four had a broken certificate. That war is over.
If you run a store, this is the one thing
Check your DMARC policy today. If it says p=none or does not exist, your domain is available to anyone who wants to email your customers as you — and a fake order confirmation is the most effective phishing pretext there is, because the customer is expecting one.
Moving to p=quarantine is not a one-line change, which is why so few have done it: first every legitimate sender — the store platform, the invoicing tool, the newsletter, the support desk — has to be authorised in SPF and signing with DKIM, or you will start bouncing your own receipts. Publish p=none with a rua address, read the reports for a few weeks, fix what fails, then tighten. The steps are in DMARC policy not enabled, and you can see your current state with the free email / DMARC checker.
If you are choosing a platform
The honest reading of this data: a managed platform genuinely removes an entire class of work, and the numbers are not close — 1.5% versus 81.4% on HSTS is not a rounding difference. It also does nothing whatsoever for your email authentication, your third-party scripts, or what you leave in your web root. Budget for the second half; nobody is doing it for you.
What this sample is and is not
- The population is online stores on their own registrable domain. Shops living on
*.myshopify.comor*.wixsite.comare out of scope — a platform subdomain has no merchant DNS, so half of what we measure cannot apply. That exclusion is not platform-neutral: it removes small Shopify and Wix merchants specifically, so the Shopify bucket is a sample of Shopify merchants established enough to have bought a domain. - Platform was detected during the scan, never used to select the sample. No query mentioned a platform. Sampling on the variable you intend to measure manufactures the answer. The platform mix here is therefore not a market-share estimate — do not quote it as one.
- “Everything else” is 661 heterogeneous stores — bespoke builds, headless stacks, and platforms we do not fingerprint. It is a residual, not a category, and its internal variation is large.
- WooCommerce is n=71, below the n=100 we set as the bar for a stable percentage. Its rates carry roughly ±9 points of sampling error — which does not trouble a comparison of 81.4% against 1.5%, but does mean its exact figures should be quoted with the count, not alone. PrestaShop (17), OpenCart (8), Wix (5) and Squarespace (3) are too small for percentages and are left out of the tables entirely.
- Denominators differ by row. A host that did not answer in time for a given category is excluded from that row rather than counted as a pass. The exposed-files row is worst affected (926 of 1,106), because that check is the slowest.
- The sample is not random. Domains came from public search results across ten retail categories. Search visibility correlates with company size and technical investment, so the real population of online stores is probably no better than these figures and may be worse.
- 217 entries are localised storefronts of the same operator (one chain across several countries), which are not independent observations. Recomputing with them removed moves nothing material: Shopify's no-HSTS rate goes 1.5%→1.0%, WooCommerce's 81.4%→83.6%, and Shopify's
p=noneshare 56.6%→58.9%. - No store is named, and no individual result is published. The point is the population.
Method
1,106 stores, measured 20–21 September 2026. One ordinary HTTPS GET of each homepage plus public DNS lookups — the same passive check set as our free Website Security Score, run in batch. No login, no crawling, no port scanning, no payloads, no active testing of any kind. Severity is our calibrated scale: a missing SameSite is informational, platform-managed edge headers are down-ranked, and nothing here is a vulnerability claim — these are configuration facts. Full sampling documentation, including every query, lives with the dataset; the series, the citation terms and the method live at MySecScan Research. Figures are free to quote with attribution.