CommerceGeek @CommerceGeek

Across the 321 stores we scanned, only 6% show any site search tool we can detect, so Shopify's native filtering is still the norm. Before trialling an app, write down the three merchandising jobs you can't do today. #Shopify #Ecommerce commercegeek.com/s/otntzdx

Shopify CLI 4.0 brings semantic versioning and automatic updates, and drops deprecated flags and commands. Check your CI scripts before they surprise you.

Shop User metafields can now be read during checkout through Shopify Functions, so partners can use buyer-specific data to customize checkout. Lots of room for personalization here.

Handy for anyone building apps or themes. If you're updating the CLI, we track its removed flags and commands in our deprecation tracker, so it's worth a look before upgrading. commercegeek.com/deprecations x.com/i/status/21132…

Notify Me! Back in Stock & PreOrder @notifyme_io

a day ago

Small but useful: you can now create and delete dev stores right from Shopify CLI. Spinning up test stores just got a lot less clicky.

0 0 0 22 0

We've summarised the checklist, including the expiring offline token step that public apps need by 1 January 2027. Worth working through it with your team this week. commercegeek.com/s/l0hf6gx x.com/i/status/21129…

Shopify Developers @ShopifyDevs

2 days ago

Yesterday, we shared in our Community Forum what you should be doing to secure your apps and maintain merchant trust. These are the steps you should take now: community.shopify.dev/t/securing-you…

7 15 73 7K 38

Yesterday, we shared in our Community Forum what you should be doing to secure your apps and maintain merchant trust. These are the steps you should take now: community.shopify.dev/t/securing-you…

What do well-known stores run on, and how many have gone headless? Shopify runs 244 of the 321 stores we track. 18% of the 244 Shopify stores we track run a headless front end. #Shopify #Headless commercegeek.com/stores

Reviews appear on 73% of the 287 product pages we read, and recommendations on 64%. Subscriptions sit at 26%. Our guide covers what each feature does and how to build it on Shopify. #Shopify #CRO commercegeek.com/s/mld0vgx

Most app-free speed gains start with the hero image: never lazy-load it, and add fetchpriority high. In our sample, 72% of 193 Liquid theme stores pass all three Core Web Vitals, with a median LCP of 1.9 seconds. #Shopify #CoreWebVitals commercegeek.com/s/mkuqxix

Any scope that writes a resource also grants read access to it, so a write permission is never just a write permission. Check each scope an app asks for against what it actually does before you install it. #Shopify #CyberSecurity commercegeek.com/s/1vdpwqx

Should my new project use PHP or Node?

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

Public apps making GraphQL Admin API requests must move to expiring offline access tokens by 1 January 2027, or merchants lose access until they re-authenticate. Shopify also asks developers to run its security checklist. #ShopifyDev #ShopifyApps commercegeek.com/s/l0hf6gx

Which testing and personalisation tools do well-known stores use? For A/B testing: Intelligems is on 37 of the 321 stores we track. For personalisation: Rebuy is on 25 of the 321 stores we track. #CRO #Ecommerce commercegeek.com/tools

Merchant trust is everything Which means security is everything Introducing `app security check` A tool that finds common vulnerability patterns in Shopify apps Run it with AI Toolkit

Phones carry most Chrome visits in every sector we looked at, yet only 36% of big retailers pass all Core Web Vitals, against 73% in food and drink. Check your own field data, not just lab scores. #CoreWebVitals #WebPerf commercegeek.com/s/76h2jpx

In our sample, 72% of Liquid theme stores pass all three Core Web Vitals, against 51% of headless ones. The gap is mostly layout shift and load time: interactions feel the same at 150 ms. #CoreWebVitals #Headless #shopify commercegeek.com/s/3mq64gx

Which reviews apps do well-known stores use? Yotpo is on 72 of the 321 stores we track. Then Okendo is on 52 of the 321 stores we track. #ShopifyApps #Ecommerce commercegeek.com/tools

52% of the stores we scanned load a reviews or UGC tool we can detect, with Yotpo on 22% and Okendo on 16%. Our guide covers theme app extensions, API access and what these widgets can cost in page speed. #Shopify #WebPerf #yotpo commercegeek.com/s/j04b0vx

I have been watching the #NFT space develop so rapidly on #Hedera. Tuesday is going to be exciting to see the aftershock of @ZuseMarket being down for a while. #HBAR #NFTs are the way for creators and collectibles to capitalize on profits, instead of them being eaten by gas fees.