How to tell if a website is built on Shopify (5 checks that still work)

“Is this Shopify?” used to be a five-second question. Then merchants moved to custom domains, checkout moved to checkout. subdomains, and headless builds started serving React from a CDN with no Shopify markup in sight.

Most of the advice online still tells you to look for /cart.js. Here is what actually works in 2026, in the order I’d try it.

1. Add /products.json to the domain

The fastest check by a distance. Almost every Shopify store exposes a public product feed:

https://example.com/products.json

If you get JSON back with a products array, it is Shopify. This works through custom domains, because it is the storefront responding, not a Shopify-branded URL.

Why it is reliable: the endpoint is part of the Storefront API surface, and turning it off breaks apps merchants actually use — so most never do.

When it fails: a store can rate-limit or block it, and password-protected stores return nothing. A 404 here is weak evidence of “not Shopify”, but a 200 is strong evidence of “Shopify”.

2. Look for cdn.shopify.com in the page source

Open DevTools, go to the Network tab, reload, and filter for shopify. Product images, theme CSS and JS assets are nearly always served from cdn.shopify.com.

This survives custom domains and most headless setups, because even a headless front end usually still pulls its images from Shopify’s CDN. Moving product imagery off it is a deliberate, unusual choice.

3. Check for the Shopify global in the console

In the browser console:

window.Shopify;

On a standard Shopify theme this returns an object with shop, locale, currency and often theme. It tells you the myshopify domain even when the site runs on a custom one — which is useful when you want the canonical store identity rather than the marketing domain.

When it fails: headless storefronts do not load the theme runtime, so this is empty even though the backend is Shopify.

4. Follow the checkout

Add anything to the cart and start checkout. Shopify checkout lives at checkout.shopify.com, at shop.app for Shop Pay, or on the merchant’s own checkout. subdomain with unmistakable Shopify markup.

Slow, but nearly impossible to fake — the checkout is the one part merchants cannot easily rebuild.

5. Check the DNS

example.com pointing at shops.myshopify.com via CNAME, or A-record 23.227.38.x, is Shopify’s hosting range.

dig +short example.com
dig +short www.example.com CNAME

The A record is the giveaway: 23.227.38.0/24 belongs to Shopify. A site behind Cloudflare will hide this, so treat a miss as inconclusive.

Two checks that stopped working

The /cart.js endpoint. Still present on most themes, but headless storefronts do not serve it and some apps intercept it. It gives false negatives often enough now that I would not lead with it.

“Powered by Shopify” in the footer. Every theme lets a merchant remove this in about ten seconds, and virtually every serious store has. Its absence tells you nothing at all.

Doing it in one click

The manual checks are worth knowing because they tell you why an answer is what it is. But when you are checking twenty stores in a row, use a tool.

• The Shopify Store Detector runs these checks against a URL and tells you what it found — free, no signup.
• The Store Detector extension does it automatically on every page you visit, and if the answer is yes, it also gives you the store’s traffic, revenue estimate, apps, theme and ads.

A note on what “Shopify” means here

One thing worth being precise about: these checks identify the storefront platform, not who runs the business. A brand can operate a Shopify store for one market and something else entirely for another, and large groups often run a mix. Confirming the platform is the beginning of the research, not the end of it.