So it seems that as part of the recent security outbreak on Shopify Apps, Shopify has introduced a new modal popup that shows when the website tries to navigate them away from the store.
There’s a problem with this though, many sites are still setup using separate Shopify stores for international sales i.e. www.mystore.com and us.mystore.com
We have “store switchers” across a lot of these, they’re now however being caught up in the new modal popup - can it be updated to allow redirects when they’re on the same domain (just a different sub-domain).
Exactly. Merchants need a way to tell Shopify, “This destination is part of the shopping experience I intentionally provide.”
Separate storefronts are a normal operating model for international brands, multiple brands, distributors, and franchise networks. A customer may deliberately choose a country or store in a selector, only to be stopped by a warning that makes the expected destination look suspicious. That adds friction to a journey the merchant has intentionally designed, and can undermine customer trust and conversions.
Shopify has launched this without previous notice to any merchant, and again without understanding the setup of their customers. It’s a joke…
The current exception for a store’s own domains and subdomains doesn’t cover every legitimate setup. Some merchants operate separate Shopify stores on distinct domains, or direct customers to distributor/franchise storefronts that they are authorized to use. From the customer’s perspective, those are still the merchant’s intended destinations, but Shopify has no merchant-facing way to register them as trusted.
Security is important, but a blanket confirmation for destinations the merchant has deliberately configured is a poor trade-off. Shopify could preserve the warning for unknown destinations while letting merchants add verified domains to a trusted-destination list, with domain ownership verification and clear controls to review or revoke access.
Really think it should be an urgent change and update here from Shopify, as this is affecting conversion and bounce rate of merchants.
Adding another scenario to the problematic pot, all of our headless stores also have the same problem now. We use Next.js rather than Hydrogen, so rely on a redirect from a subdomain to the primary domain (checkout.[domain].com to [domain].com) and now all of our stores have this exact same problem when someone clicks on the store logo or is redirected post-checkout.
Raised via support chat earlier, but wanted to add it to the considerations for hopefully quick resolution from the dev team to allow whitelisting of primary domains.
The customer journey on our editorial discovery platform gets interrupted by this change. The link to our merchant partners is part of the intended expeirence and now gets interrupted. We need a possibility to opt out or at least provide a whitelist of merchant urls that we can update at all time (with no limit!).
As stated here, this is urgent as this is affecting our conversion and brand experience.
I was able to get plus support to remove it from my store - however while waiting I did figure out a workaround that works, although it requires adding a script tag prior to the tag of the layout. What I did was add the following script tag prior to the head tag in the theme. I know its unorthodox to place a script outside of the head and body - but the browser doesnt seem to care. There may be adverse side effects, but if you need this to work - here it is - just change the WHITELISTED DOMAINS in the list of EXTRA_HOSTS to whatever you want to allow. Also you could adjust this so that it just overrides the Shopify logic entirely:
<script>
(() => {
// Hosts to treat as allowed (suffix match, like Shopify's own check)
const EXTRA_HOSTS = ['WHITELISTED DOMAIN 1','WHITELISTED DOMAIN 2'];
const isExtra = (host) =>
EXTRA_HOSTS.some((h) => host === h || host.endsWith('.' + h));
const hostOf = (href, base) => {
try { return new URL(href, base).hostname; } catch { return null; }
};
const linkHref = (e) => {
for (const node of e.composedPath()) {
const tag = node.localName;
if (tag === 'a' || tag === 'area') {
const h = node.getAttribute('href') ??
node.getAttributeNS('http://www.w3.org/1999/xlink', 'href');
if (h !== null) return h;
}
}
return null;
};
const proto = EventTarget.prototype;
const originalAEL = proto.addEventListener;
proto.addEventListener = function (type, listener, options) {
const s = document.currentScript;
if (s && s.dataset.sourceAttribution === 'shopify.exit_interstitial' &&
typeof listener === 'function') {
const inner = listener;
if ((type === 'click' || type === 'auxclick') && this === window) {
listener = function (e) {
const href = linkHref(e);
const host = href && hostOf(href, document.baseURI);
if (host && isExtra(host)) return; // let it through
return inner.call(this, e);
};
} else if (type === 'navigate' && this === window.navigation) {
listener = function (e) {
const host = hostOf(e.destination.url);
if (host && isExtra(host)) return; // let it through
return inner.call(this, e);
};
}
}
return originalAEL.call(this, type, listener, options);
};
window.__nplRestoreAEL = () => { proto.addEventListener = originalAEL; };
})();
</script>
Starting October 21, you’ll be able to add other trusted domains, such as a booking tool or a partner site, in Online Store > Preferences. Customers go directly to trusted domains without seeing the message.
Adding another perspective here, from the app side.
We run a returns and claims solution used by around 700 Shopify merchants. Our return portal is linked from merchants’ storefronts, so the customer journey naturally goes from the store to our portal and back.
From one day to the next, every customer starting a return across all 700 merchants is now met with this warning, with no prior notice to us or to the merchants. A customer who is already unhappy enough to return something is now told they’re about to leave the store for a possibly unsafe site. That’s not a great start to a returns experience, and it’s already creating support tickets from merchants who think something is broken.
Changelog was released way to late. Our support team has been flooded today with little to no information from Shopify Support - including no information about whitelisting was just a few hours away. Incredibly disappointed in Shopify.
Curious, has the exit intent interstitial popup been rolled back by Shopify? I’m no longer seeing it (nor the script) on the affected merchant sites I’ve been tracking all day. Anyone seen news to this effect?
