Edition · November 2026 · published monthly
Shopify Leak Index, November 2026
48% of the 1,602 live Shopify stores we audited on 6 November 2026 carry at least one proven leak of medium or high severity.
95% have at least one proven leak of any size, and the median store has 2. The median Bucket Score is 75/100 (middle half 67 to 83). The stores are in 73 countries; 40% publish a contact inbox on their own domain.
Only checks whose failures we re-judged at 95% precision or better are counted (last measured 6 November 2026). Each rate is out of the stores where that check could be judged. No store is named.
The leaks, most common first
| Leak | Stores | Count | Check precision |
|---|---|---|---|
| Email domain not protected by an enforced DMARC policy Anyone can send mail as the store's domain; with no record at all, bulk mail can be rejected. | 77% | 1,227 of 1,602 | 100% (226) |
| Search snippet cut off, too short or missing (title or meta description) Search results show a cut or rewritten snippet instead of the store's own pitch. | 55% | 879 of 1,602 | 100% (158) |
| No returns window stated near the product A first-time buyer can't see what happens if the product is wrong. | 52% | 389 of 755 | 100% (84) |
| No Product structured data on the product page Search engines can't read price, stock or rating from the product page. | 35% | 425 of 1,230 | 100% (91) |
| No preview image when the homepage is shared Every shared link shows a blank or random image. | 24% | 392 of 1,601 | 100% (69) |
| No valid SPF record (missing, duplicated or over 10 lookups) Receiving servers can't tell which services may send as the domain. | 19% | 308 of 1,601 | 100% (49) |
| No reviews or star rating on the product page No social proof where the buying decision is made. | 13% | 145 of 1,089 | 96% (28) |
| No valid structured data on the homepage Search engines get no machine-readable facts about the business. | 9% | 137 of 1,601 | 100% (29) |
Email authentication in detail
Of 1,602 store domains with a DMARC answer: 21% have no DMARC record at all (329), 55% publish p=none, which monitors but stops nothing (879), 1% have several records or no valid policy (19), and 23% enforce quarantine or reject (375).
Gmail and Yahoo (since February 2024) and Microsoft (since May 2025) require a DMARC record, p=none included, from anyone sending 5,000 or more emails a day. Check a domain's DMARC free.
By country
Countries with at least 40 stores. Country is the one the store declares to Shopify.
| Country | Stores | Median score | Leak Index | Most common leak after DMARC |
|---|---|---|---|---|
| United States | 431 | 75 | 48% | Search snippet cut off, too short or missing (title or meta description) (58%) |
| India | 210 | 70 | 76% | Search snippet cut off, too short or missing (title or meta description) (66%) |
| United Kingdom | 122 | 78 | 48% | Search snippet cut off, too short or missing (title or meta description) (54%) |
| Germany | 66 | 78 | 21% | Search snippet cut off, too short or missing (title or meta description) (52%) |
| Australia | 62 | 78 | 44% | Search snippet cut off, too short or missing (title or meta description) (34%) |
| Pakistan | 54 | 69 | 85% | Search snippet cut off, too short or missing (title or meta description) (69%) |
| Japan | 51 | 73 | 51% | No Product structured data on the product page (61%) |
| Hong Kong SAR China | 44 | 78 | 48% | Search snippet cut off, too short or missing (title or meta description) (61%) |
| France | 44 | 78 | 30% | Search snippet cut off, too short or missing (title or meta description) (39%) |
By niche
Niches with at least 40 stores, guessed from each store's own title and description.
| Niche | Stores | Median score | Leak Index | Most common leak after DMARC |
|---|---|---|---|---|
| Apparel | 235 | 75 | 51% | Search snippet cut off, too short or missing (title or meta description) (49%) |
| Beauty | 90 | 75 | 52% | Search snippet cut off, too short or missing (title or meta description) (46%) |
| Home | 84 | 74 | 51% | Search snippet cut off, too short or missing (title or meta description) (56%) |
| Sports & outdoor | 72 | 76 | 49% | Search snippet cut off, too short or missing (title or meta description) (53%) |
| Art & stationery | 66 | 73 | 65% | Search snippet cut off, too short or missing (title or meta description) (65%) |
| Electronics | 61 | 74 | 43% | Search snippet cut off, too short or missing (title or meta description) (69%) |
| Shoes | 60 | 78 | 35% | Search snippet cut off, too short or missing (title or meta description) (55%) |
| Health | 49 | 77 | 51% | Search snippet cut off, too short or missing (title or meta description) (55%) |
| Jewellery & watches | 47 | 76 | 55% | Search snippet cut off, too short or missing (title or meta description) (57%) |
| Food & drink | 46 | 76 | 57% | Search snippet cut off, too short or missing (title or meta description) (61%) |
How it's made
The stores come from two public lists of the most visited sites, the Tranco top 1M and Chrome's real-user CrUX top 1M. A site counts as a Shopify store when its domain points at Shopify's storefront network and the storefront answers. Each store's homepage, a product page and its DNS are read once, the way a visitor and a mail server see them, honouring robots.txt and bot opt-outs. Password-protected and unreachable stores are left out. Checks version 2026.11.1.
These are well-visited stores, not all of Shopify, so the rates describe established stores. How we measured each check's precision.
Use the data: CSV · JSON. Free to reuse under CC BY 4.0 with a link to this page.
Is your store in the 48%?
Run the same checks on your own store in about 20 seconds, free and without signing up.
Check your store free Agencies: get stores with these leaks as leads