Shopify just rolled out a safety net that asks shoppers to confirm before leaving your store for an external website. This new protection, announced in the Merchant Changelog, is designed to shield customers from unexpected redirects that can be used for phishing or malicious ads. As a merchant or developer, you’ll want to understand exactly how the feature works, which links trigger the confirmation, and what steps you can take to keep the checkout flow seamless while staying compliant with Shopify’s security standards.
What’s Changing?
Starting today, any link that points to a URL outside of the domain(s) officially connected to your Shopify store will display a brief modal. The modal shows the destination address and offers two choices: “Continue to site” or “Return to store.” The prompt only appears for domains that aren’t listed as ‘connected’ or recognised as official Shopify or supported social platforms. In practice, a link to a brand’s blog on a separate hosting provider will now pause the customer, whereas a link to an already‑connected custom domain (e.g., shop.mycustomdomain.com) will bypass the warning.
Why It Matters for Merchants
From a merchant’s perspective, the change protects your brand reputation. Unexpected redirects have been a common vector for fraud, and customers who encounter them often lose trust in the store that sent them. By surfacing a clear warning, Shopify gives shoppers the confidence to decide whether they really want to leave your checkout or product page. The downside is a potential friction point—if you rely heavily on external resources (e.g., a third‑party review site or a help center on a separate domain), the extra click could affect conversion rates. Knowing which URLs trigger the modal lets you plan accordingly.
Impact on Developers
Developers building themes or apps need to be aware that the redirect‑confirmation overlay is applied at the browser level, not via an API you can toggle. This means you can’t programmatically suppress the modal for a particular link unless the destination domain is added to the store’s connected list. However, you can influence the experience by flagging external links with a CSS class or data attribute, letting you style the link to set the right user expectations before the modal appears. Also, any app that generates outbound links (order‑status pages, email templates, or custom “Buy on Amazon” buttons) should audit its URLs for compliance.
How to Ensure a Smooth Experience
The first step is to audit every external link on your storefront. Pull a list from your theme’s Liquid files, navigation menus, and any custom sections. For each domain, ask: Is it already connected to the store? If not, add it under Settings → Domains → “Connect existing domain.” For domains you don’t own (e.g., partner affiliate links), consider opening them in a new tab and adding a clear “external link” icon so shoppers know a confirmation will appear. Finally, test the flow on both desktop and mobile browsers to make sure the modal behaves as expected.
Best Practices & Code Examples
Here’s a quick checklist you can turn into a script, plus a Liquid snippet that makes external links obvious to users:
liquid
{% assign external_domains = "example.com,partner.io" | split: "," %}
<a href="{{ link.url }}"
{% unless link.url contains shop.myshopify.com %}
target="_blank" rel="noopener" class="external-link"
{% endunless %}>
{{ link.title }}
</a>
The external-link class can be styled with an arrow icon and a tooltip that says “You’ll be taken to an external site.” If the destination domain is listed in your connected domains, Shopify will skip the confirmation automatically. For developers who generate URLs programmatically, you can reuse the same external_domains array to decide whether to add the class.
A simple bash one‑liner to extract URLs from your theme files might look like:
bash
grep -hoE 'https?://[^"\s]+' *.liquid | sort -u > external-urls.txt
Run the list through a domain‑extraction tool, compare against your connected domains, and you’ll have a concrete action plan.
Next Steps
Take the audit today, add any missing domains to your store’s Connected Domains section, and update your theme to flag external links. Keep an eye on Shopify’s developer changelog for any future API that lets you manage the confirmation behaviour directly. In the meantime, communicate the change to your support team so they can reassure customers who ask why they see the extra prompt. A proactive approach turns a security feature into a trust‑building opportunity. Need help auditing your links or updating your theme? Reach out to a Shopify Expert or drop a comment below—we’re happy to assist!
