Shopify's new leave-store warning: why it appeared and can you deactivate it?
Since 20 October 2026, your Shopify store asks customers to confirm before sending them to a website outside your store. The customer sees a short message with the destination address and can either continue or come back. You did not switch anything on - Shopify added this protection to stores automatically.
The change did not come out of nowhere. It followed an October attack in which shoppers were redirected to fake payment pages through third-party apps. The part that matters most to merchants is different: the message can appear on your own links too - for example on your second domain, if it is not connected to your store.
What is the Shopify leave-store confirmation?
The Shopify leave-store confirmation is a storefront protection, live since 20 October 2026, that shows a message with the destination website's address before a customer is sent there. The customer decides whether to continue or return to your store.
Shopify's changelog describes it in a single sentence:
"Customers see a short message with the website's address, and they can continue to the website or return to your store." - Shopify changelog, 2026-10-20
The feature works on the storefront, meaning your store's pages, not in the admin. There is no toggle and no merchant notification, which is why most merchants learn about it only when a customer asks.
Why did Shopify introduce the leave-store confirmation?
Shopify introduced the leave-store confirmation on 20 October 2026, in the middle of a checkout hijacking campaign. From 10 October, malicious code delivered through third-party apps redirected shoppers to fake payment pages on domains such as checkout-confirm[.]top.
The mechanism was simple, and that is what made it dangerous. An app script served from Shopify's CDN fetched roughly 22.7 KB of additional JavaScript from the app's API on page load. That code redirected each shopper once to a phishing page, collected card details, returned a fake confirmation and only then sent the shopper to the real checkout.
According to the investigation published by Roman Zipp, the main affected apps were Hulk Product Options, Swym Wishlist Plus and Selleasy, and by 22 October all of them had been fixed or de-listed from the App Store.
The practical takeaway here is not about the message itself. If your store has apps installed that you no longer use, remove them: every installed app has permission to inject code into your pages.
Which links trigger the message and which do not?
The Shopify leave-store confirmation does not appear on domains connected to your store, or on supported Shopify and social websites. Everything else is a risk zone, and Shopify flags one case explicitly.
Shopify puts it plainly: websites you own but have not connected to your store may still trigger the message. In practice that usually means:
- a separate
b2b.orinfo.subdomain that is not in your Shopify domain list - an old domain left over from a migration
- a second store for another market that you link to from a country selector
- a financing or booking system running on its own address
- a courier tracking link
- partner and supplier links in product descriptions
Merchants in the Shopify Community report that the behaviour is not entirely consistent: some external links open directly, others show the message. Reasoning about it is not enough - you need to click your own links.
The multi-store case deserves a separate note. If a country selector sends customers from one store to another on a different domain, the message appears at the most sensitive point of the journey. If you are expanding into new markets through separate stores, it is worth reviewing your store connection logic.
How do you check whether the message reached your store?
The check takes about 15 minutes and needs no developer. You can only see the Shopify leave-store confirmation from the customer's side, so test it on your live store rather than in the theme editor.
- Open Settings > Domains and connect every domain and subdomain you own and link to.
- Review Online Store > Navigation - every menu, including the footer.
- Check links in pages, blog posts and product descriptions.
- Click them on a phone in a private window - that is what your customer sees.
- Write down which links show the message, then decide which of them actually lead towards a purchase.
If a link sits on the purchase path rather than being informational, fixing it is the priority. The rest can wait.
Can you turn off the Shopify leave-store confirmation?
No. As of 23 October 2026, Shopify has announced neither a way to switch off the leave-store confirmation nor a trusted-domains list. The changelog entry contains no setting, and merchants are asking for one publicly.
A report on the Shopify developer forum from 21 October describes exactly the multi-store case, and reaches the same conclusion: "currently no way to mark that verified destination domain as trusted".
If you have read somewhere that the setting already exists under Online Store > Preferences, check the primary source - there is no such entry in Shopify's changelog.
Is there a workaround?
Merchants in the Shopify Community report one: create an internal URL redirect in your store (Online Store > Navigation > URL redirects) pointing to the external address, then point your links at that short internal path. In their tests, that path does not show the message. Shopify has not confirmed this officially, so treat it as a temporary fix rather than a recommendation - and connect your own domains first.
What to check before Black Friday
There is less than a month until the seasonal peak, so the list is short:
- connect all your domains and subdomains under Settings > Domains
- click the external links on your purchase path from a phone
- remove apps you no longer use
- prepare an answer for customer support, because some shoppers will read the message as a scam
- if you run several stores, check your country selector links
All of this is part of a standard store audit - it just has a specific reason this week.
Shopify increasingly ships protections that merchants neither enable nor can disable. That makes checking your own store through your customer's eyes a recurring job rather than a one-off.
Frequently asked questions
Does the leave-store confirmation apply to all Shopify plans and all countries?
Yes. Shopify announced no plan or market restrictions - the protection is described as an online store change applying to stores generally, regardless of plan or country.
Will customers arriving from Google Ads or Facebook see this message?
No. The message appears when leaving your store, not when entering it. Merchants also report that links to supported social websites do not trigger it.
Does the message mean my store is infected?
Not necessarily. It appears on any external link, including ones you added yourself. But if it shows up where you placed no link at all, review your installed apps.
Does connecting a domain definitely remove the message?
Shopify states that connected domains do not trigger the message. Public merchant test results have not confirmed this yet, so click the link yourself after connecting.
If you are not sure which of your store's links lead outside Shopify, and which of those sit on the purchase path, get in touch - we will review them with you. Get in touch.
