October 22, 2026 · The lunalink.ai team

Can a Shopify app audit your store without asking you to install it?

Close-up of App Store icon on iPhone screen with notification badge, highlighting app updates. — Photo by Brett Jordan on Pexels

You find an app that says it can audit your Shopify store. Before it shows you anything, it asks to install.

That might be necessary. It might not.

A store has two sides. One is public: the pages a shopper, search engine, or AI assistant can request. The other is inside Shopify admin: orders, customers, unpublished products, settings, and other account data.

A useful audit can cover a surprising amount from the public side. It just needs to be honest about its limits.

We built our free scanner around that idea. It reads public URLs only: `robots.txt`, catalogue data where available, product markup, and policy pages. No install. No login. A merchant should not have to trust a stranger’s app with their admin account just to learn the basics.

Start with the job, not the permission screen

Before approving an app, ask one plain question:

What does this app need to read or change to do the job it describes?

An app that checks broken links, reads product pages, or reviews public search signals may be able to work without installation.

An app that needs to send email, create discounts, edit products, change your theme, or inspect customer records needs access for a reason. The important part is whether that reason is clear and narrow.

Permissions are not automatically bad. They are a request to trust someone with part of your shop.

What a public audit can read

A public audit starts where any visitor can start: your storefront domain.

`robots.txt`

Open this URL in your browser:

`https://yourstore.com/robots.txt`

Shopify automatically creates a `robots.txt` file for stores. Its default rules allow crawlers to request public product, collection, page, blog, and policy pages.

That makes it a useful first check. An audit tool can see which parts of the public storefront you are asking crawlers to avoid.

But `robots.txt` does not protect private information. Shopify describes its rules as directional and advisory. Not every crawler has to follow them.

So do not treat a disallow rule as a lock on a door. Treat it as a sign on the door.

Your sitemap

Try:

`https://yourstore.com/sitemap.xml`

Shopify automatically generates a sitemap for a store. It contains links to products, primary product images, pages, collections, and blog posts.

A tool can use those links to find public pages without guessing every URL.

The sitemap is a map, though. It is not a full product export. It tells a crawler where content lives and how pages relate. It does not necessarily provide every product field an audit may want.

That distinction matters when an app claims it has checked your entire catalogue. Ask how it found the products, and what it actually read from each one.

`/products.json`

Some Shopify storefronts expose a public product feed at:

`https://yourstore.com/products.json?limit=250&page=1`

Current technical testing reports that this can return product and variant details without credentials, including titles, handles, descriptions, vendors, tags, images, prices, SKUs, and availability.

It is useful when it works. It is not a guarantee.

The endpoint is not formally documented by Shopify, and testing has found stores where it returns a `403`, a `404`, or no usable catalogue because the store uses a headless storefront.

We ran into another quiet problem while building our own `llms.txt` builder. Shopify’s `/products.json` returned at most 250 products per page. A catalogue read can look complete when it is not.

If your store has more than 250 products, open the URL above and check the result. Then try page two:

`https://yourstore.com/products.json?limit=250&page=2`

A tool that uses this feed needs to handle pagination. Otherwise it may audit only the first part of your catalogue and never tell you.

Product pages and product schema

Public product pages contain useful information even when a product feed is unavailable.

Shopify theme requirements cover visible product details such as the product title, variant prices, unit prices, compare-at prices, descriptions, option names and values, and product images. Shopify also requires themes to include Google rich-product snippets.

A public audit can request a product page and inspect what the browser receives. It can look for missing descriptions, unclear option labels, visible price information, or product structured data.

You can do a quick version yourself. Open one product page, right-click, and choose View page source. Search for `application/ld+json`. That is a common place to find structured data in the page source.

A source check is useful, but it is not the same as seeing your Shopify product editor. A public tool can report what the storefront shows. It cannot reliably tell you why a field is missing or which admin setting produced it.

Policy pages

Policy pages are another public source worth checking. Shopify’s Storefront API describes policies with a title, body, handle, and public URL.

An audit can read the public return policy, privacy policy, shipping policy, or terms page if they are linked and available on the storefront.

That can help identify a missing page, a broken policy link, or a policy that is hard for customers to find. It does not give the tool access to the separate authenticated admin interface Shopify provides for managing policies.

What public access cannot show

A tool that has not been installed cannot use the Shopify Admin API. It also cannot see data that is only available inside your Shopify admin account.

That means a public audit cannot inspect things such as:

Customer records
Orders and fulfilment details
Internal store settings
Draft or unpublished products
Private app settings
Admin-side editing history

It also cannot make changes.

A public scanner can tell you that a product page lacks visible structured data. It cannot fix the theme for you. A public scanner can find a policy page. It cannot edit its wording inside Shopify admin.

Those are different jobs. They should come with different access requests.

A practical way to judge an app request

Read the requested permissions after you understand the task.

If an app says it only performs a public SEO or storefront audit, ask why installation is required. It may have a sound answer. For example, it may need admin data that is not visible publicly, or it may be designed to write fixes rather than only report them.

Then ask two follow-up questions:

Could the first audit happen from public URLs?
Which specific feature needs each requested permission?

Good answers name a feature and a boundary. “We need theme access to add this file.” “We need product access to update these fields.”

Vague answers make it hard to judge the risk.

We ship Descriva without theme-write permission on purpose. That means anything that must live in the theme, such as a custom `llms.txt`, reaches the merchant as a template to paste. Afterwards, Descriva reads the live URL rather than assuming the paste worked.

That trade is not right for every app. But it is a useful pattern: request less access where possible, and verify the public result.

Sources

Before installing an audit app, open its permission screen and match every request to a job you expect it to do.

shopifyapp permissionsstore auditsseo