How Shopify App Detection Works

Detectify matches technical markers in the HTML returned by the submitted URL against a published signature database. It does not execute JavaScript or inspect private Shopify admin data. This page explains the implementation; use the investigation checklist for a page-by-page research workflow.

What a Shopify app detector actually sees

Detectify fetches the public storefront HTML and searches that text for known script URLs, asset paths, widget identifiers and service domains. It does not execute the page or access Shopify admin data. If an app only works in the backend, it usually leaves nothing for this type of detector to match.

The detection pipeline

1. Fetch one public page. The backend restricts URLs, checks public IP addresses and bounds time, redirects and response size. A denied request is a scan failure, not an empty app inventory.
2. Check Shopify signals. Recognizable Shopify assets and storefront markers determine whether app results can be shown. Headless or blocked pages can remain inconclusive.
3. Extract technical markup. The matcher uses tags, attributes and inline script/style content. Ordinary visible prose, HTML comments and JSON-LD or application/json blocks are excluded to reduce brand-name false positives.
4. Compare known patterns. Case-insensitive fragments are checked against this technical source. Google Analytics and Google Tag Manager use separate configuration/container rules.
5. Deduplicate and group. Multiple patterns for the same named tool collapse into one result. Apps, analytics and payment signals have separate panels and are sorted alphabetically.

Why a Google tag is not always Google Tag Manager

A script from googletagmanager.com can load either a Google tag or a Tag Manager container. A direct GA4 gtag configuration with a G- measurement ID is not, by itself, evidence of a GTM- container. Ads-only configuration should not be reported as Analytics. Detectify tests these cases separately using Google's tag-identification documentation.

Why no tool finds every Shopify app

Many Shopify apps operate in fulfillment, inventory, subscriptions, admin workflows or backend automation. Those apps may be critical to the merchant but completely invisible to the public storefront. This is why any honest Shopify app detector should explain its detection limits clearly.

What the confidence label means

Confidence is a heuristic about pattern specificity, not a measured probability, app quality rating or installation certificate. High requires a pattern of at least 12 characters containing a domain/path separator; other patterns of at least 8 characters are medium and shorter ones are low. A dot in a short filename is not sufficient for high confidence. Even a distinctive asset can be leftover code.

How to reproduce and preserve a finding

Record the exact URL and check time, not just a store domain. A product page can expose different widgets from the homepage. Use the CSV export to preserve matched names, categories, heuristic labels and vendor URLs. A copied scan link reruns the page and can return different results later.

• Inspect the published dataset, matching rules and checksums.
• Compare with the dated real-store observations, not an invented perfect demo.
• Use browser requests after consent or interaction to investigate a missing runtime signal.
• For your own store's actual installed-app list, check Shopify admin rather than inferring it from public code.