Is your checkout still yours?
Cart Police shops your Shopify store every few minutes like a real customer. If checkout breaks, gets hijacked, or the store starts loading code nobody added, you hear about it in minutes, not from an angry email six hours later.
Free to join. Nothing to install in your theme or apps. It detects and alerts, it does not block. We email you when your spot opens.
Your store can be up and your checkout can be gone.
Every Shopify store runs code its owner did not write: app embeds, pixels, script tags, custom-code boxes inside apps, snippets from an agency three years ago. If any one of those vendors is breached, the page still loads. The theme still looks right. Only the moment a shopper presses Checkout goes wrong.
Uptime monitors check that the door is there. Nobody checks where it leads.
Some of what can run on a typical store. Shine a light on it.
In September and October 2026, merchants on the Shopify Community forum (thread 698208) reported that attackers had breached app vendors and written checkout-redirect code into stores' app custom JavaScript settings, sending shoppers to throwaway .top domains. Cart Police exists to catch exactly this kind of change, whichever app it comes through.
It does what your customers do. Then it checks where they end up.
Shops your store
A fresh browser opens a product page and adds it to the cart with your own Add to cart button, exactly as a shopper would.
every few minutesPresses Checkout, twice
From the cart drawer and from the cart page. An attacker can target one and leave the other, so we press both.
drawer + cart pageChecks where it heads
If the browser goes to your own checkout, pass, and we stop right there. If it goes anywhere else, or nothing happens, you get an alert in minutes.
alert in minutesFour things that tell you something is wrong before a customer does.
The checkout path
Add to cart, then Checkout from the drawer and the cart page. Pass, redirected, or does nothing: all three are told apart.
New outside domains
Every page records which servers its scripts come from. A domain the store has never loaded before raises a flag.
App custom-code files
The scripts that apps serve from their own settings can change without touching your theme. We watch for any change.
Theme file changes
A daily note of which live theme files changed, with the difference, so edits never go unseen.
Checkout goes off-site, does nothing, or a known hijack marker shows up. To your whole team, now.
A new script domain or a changed custom-code file. Worth a look; sent once per change.
A bot screen or timeout blocked us. We say so quietly, to the owner only. We never call that "broken".
Police your checkout, not your customers.
Built around lessons from a real checkout hijack: a monitor must watch hard and still leave your store, your data and your sleep alone.
Nothing to install in your theme or apps
No app, no snippet, no new door for an attacker to walk through. Setup is your store URL plus one small access step so your store recognizes our visits as friendly.
Stops before a checkout exists
The check ends at the request for your checkout. No orders, no abandoned-checkout emails chasing a robot.
Keeps your analytics clean
Our visits do not count as shoppers: tracking and ad pixel requests are blocked, and every visit is tagged so leftovers can be filtered.
"Broken" is not "could not check"
If a bot screen blinds us, we say we were blind. Your team only gets woken for a store that is actually wrong.
Built to stay quiet
Alerts need a repeat failure, reminders space out instead of nagging, and you get a "Fixed" note when it clears.
Sees what a shopper sees
It sees what a shopper sees, including app code that your own API tokens and theme history can never show you.
One store, or fifty.
Store owners
You sell on Shopify, you did not write most of the code on your store, and you cannot afford to find out about a broken checkout from a customer.
- Alerts by email, to the people who can act
- Plain words, no security jargon
- Start with your store URL and one access step
Agencies
You look after many stores and one bad app update can hit all of them at once. One watchdog, one place, every client.
- Many stores under one account
- See which client needs you first
- Know before the client calls
Be first in line. We will be straight with you about where we are.
- Cart Police is not open to the public yet. This list is how we decide who gets in first.
- We ask for an email, and optionally your store address. That is all. No card, no store login.
- Pricing will be simple, per store. Early access members get founding pricing.
Straight answers.
Is it safe to point at my store?
It is designed to be an outside visitor only. Nothing is installed in your store, and the core checks need only your store address, not your Shopify login. It behaves like one careful shopper, and it never loads an off-site page it catches your checkout heading to.
Does it create orders?
No. It adds an item to a cart, like any visitor, then presses Checkout and stops the moment the browser asks for your checkout. No checkout is created, so no order and no abandoned-checkout record.
Will it mess up my analytics or ad numbers?
It is built not to. Analytics and ad pixel requests from our visits are blocked, so we do not show up as shoppers, and visits are tagged so you can filter any leftovers.
What do I need to give you?
An email for alerts and your store address. Later, optional read-only connections can unlock extras, such as naming the apps behind each script. They will never be required for the core checkout watch.
Which platforms do you support?
Shopify first. Other platforms are not planned yet, and we will not claim them until they work.
What if my store sits behind a bot screen?
Some stores answer automated browsers with a challenge page. Cart Police recognises that and reports "could not check" to the owner instead of crying "broken" at your team. Ask us on the waitlist form if your store uses strict bot protection.
Is it live? How much does it cost?
Not yet: this is an early access waitlist. Pricing will be simple, per store, and early access members get founding pricing. We will not charge anyone before the service is open and you have said yes.