Run a report on a Shopify store and the findings split into three piles: things you can change in the admin or the theme, things Shopify decided for every store and will not let you touch, and things the report flags on every Shopify store that are not worth a minute of your time. Most guides pretend the first pile is the only one. This guide sorts all three so you spend your time on the fixes that move the numbers, which on Shopify are almost always apps and images.
Quick answer
- You control: the theme and its code, which apps are installed and which app embeds are on, image sizes and alt text, fonts, the title and description of every product, collection and page, redirects, the social sharing image, the robots.txt template and the JSON-LD the theme prints.
- Shopify controls: hosting, CDN and TTFB, the protocol and TLS, compression, cache headers on assets, response headers (HSTS, framing, no CSP of yours), the
/products/and/collections/URL structure, the sitemap and canonicals. - Ignore on Shopify: missing Content-Security-Policy and Permissions-Policy, cookie flag findings on Shopify's own cookies, the server response time on a page you cannot cache differently.
- The biggest lever is apps: each one adds scripts to every page. Remove what nobody uses, then look at the theme's hero image.
- Run the speed test on a collection page and a product page, not just the home page; that is where the weight is.
Why the three piles matter
A report is a to-do list, and a to-do list with items you cannot do is demoralising and slow. On a self-hosted site every finding has an owner; on Shopify a third of them have no owner on your side. Knowing which third saves the afternoon you would otherwise spend searching for "shopify add security header" (you cannot) and lets you spend it on the app that adds 400 KB of JavaScript to every page (you can remove it in two clicks).
The second reason is that Shopify's defaults are good. The platform terminates TLS properly, serves everything through a CDN, compresses text, converts images to WebP on its CDN and prints canonicals and a sitemap without help. A new store on a Theme Store theme with no apps scores well. Stores get slow one install at a time: a reviews app, a pop-up app, a currency converter, a chat widget, a tracking pixel pasted into theme.liquid, a hero image uploaded at 5000 px. Every one of those is in your pile.
How getReport checks it
The tool runs Lighthouse through Google's PageSpeed API on a throttled phone and on desktop, and shows real-user Core Web Vitals from the Chrome UX Report beside the lab values. On a Shopify store, the findings to read first are the LCP element and the third-party weight:
The SEO module runs on the same page. Two of its findings behave in a Shopify-specific way: the canonical is printed by every Theme Store theme, so a missing one means the theme's <head> was edited, and breadcrumbs are absent from most Shopify themes by default, so the breadcrumb finding is informational rather than something to chase.
The security module will list headers Shopify does not send. Those findings are correct and not yours to fix; see "What to ignore" below.
What Shopify controls
You cannot change any of these, and the report's findings on them describe the platform, not your work:
| Area | What Shopify does | What the report shows |
|---|---|---|
| Hosting, CDN, TTFB | Every store is on Shopify's infrastructure behind its CDN | TTFB and server response time are the platform's; a slow value on a product page is usually the theme's Liquid, not the server |
| Protocol and TLS | HTTP/2 and newer, TLS managed, certificates renewed | Pass |
| Compression and asset caching | Brotli/gzip on text, long cache lifetimes on theme assets with version parameters | Pass; any cache finding lists third-party app scripts |
| Response headers | HSTS, framing protection and the rest are Shopify's; there is no place to add a header | CSP and Permissions-Policy findings fail on every store |
| URL structure | /products/handle, /collections/handle, /pages/handle, /blogs/name/handle | URL length and structure findings reflect the handles you chose, not the folders |
| Canonicals | Printed by the theme from canonical_url; variant URLs and collection-scoped product URLs canonicalise to /products/handle | Pass unless the theme's head was edited |
| Sitemap | /sitemap.xml with product, collection, page and blog sub-sitemaps, updated automatically | Pass |
| Checkout | Hosted by Shopify; no theme code or app scripts of yours beyond approved extensions | Not part of the report; test the storefront pages |
The one item that moved from this pile to yours: since 2021 you can edit robots.txt by adding a robots.txt.liquid template (Online Store → Themes → Edit code → Add a new template → robots). Keep Shopify's default rules and add yours after them; the AI crawlers guide has the template.
What you can fix
Apps, in order of weight
Every app that touches the storefront adds at least one script to every page, and most add a stylesheet and a few requests to their own domain. The third-party finding lists them by domain with bytes and main-thread blocking time. Work down that list:
- Online Store → Themes → Customize, then the App embeds panel in the editor's sidebar: each toggle is an app injecting code into every page. Turn off the ones whose feature you do not use. Some apps stay installed for their admin side but need no storefront code.
- Settings → Apps and sales channels: uninstall apps nobody has opened in months. A reviews app with no reviews and an upsell app with no upsells still load.
- After uninstalling, view the source of a product page and search for the app's name. Apps that predate app embeds pasted their snippet into
theme.liquidor a section, and uninstalling does not remove it. Delete the snippet in Edit code. - Tracking pixels (Meta, TikTok, Pinterest, Google Ads) belong in Settings → Customer events as custom pixels, where they respect the consent setting under Settings → Customer privacy and load after the page, not in
theme.liquid.
The general method for anything that survives is in Third-party scripts: tag managers, chat and ads.
The theme and the hero image
Themes from the Theme Store have to meet Shopify's performance requirements, and the current generation (Dawn and the themes built on it) sizes images with srcset and lazy-loads below the fold. Two things still go wrong:
The hero image is lazy-loaded. Some themes and most slideshow sections lazy-load every slide, including the first. The LCP finding names the element; if it is the first banner and it carries loading="lazy", change the section's Liquid so the first image is eager. In a theme built on Dawn, the image banner section has this pattern:
{%- comment -%} sections/image-banner.liquid: first image eager, the rest lazy {%- endcomment -%}
{{ section.settings.image
| image_url: width: 3840
| image_tag: loading: 'eager', fetchpriority: 'high', widths: '375, 750, 1100, 1500, 1780, 2000, 3000, 3840', sizes: '100vw' }}image_url asks Shopify's CDN for a resized copy; image_tag writes the <img> with srcset, width and height. Shopify's CDN serves WebP to browsers that accept it, so the format finding usually passes without work.
The upload is enormous. The CDN resizes, but a 5000 px, 8 MB upload still produces a large 2000 px variant. Export heroes at 2000–2500 px wide before uploading. The report's image table shows the served size per image.
Fonts
Theme settings → Typography. Each font family is a download per weight; two families in two weights is a reasonable budget. The picker's system fonts (Helvetica, Arial, Georgia and the like) download nothing. If the report flags web fonts hiding text, the theme's font_face filter already includes font-display: swap in current themes; older themes need the setting or the CSS edited.
Titles, descriptions and social images
Every product, collection, page and blog post has a Search engine listing section at the bottom of its edit screen: page title, meta description and URL handle. Left empty, Shopify uses the product title and the first lines of the description, which is fine for products and poor for collections. Write the collection ones by hand; they are the pages that rank for category terms. The rules are in Title and meta description: writing for the result page.
The home page title and description live under Online Store → Preferences, and so does the Social sharing image, the fallback card image for pages without a featured image. Set it to a 1200×630 px image so shared links to the home page and collections get a card; the link preview guide covers what each network shows.
Redirects
Online Store → Navigation → URL redirects. Shopify offers to create one when you change a product or collection handle; take it. Deleted products get none, so add them by hand or import a CSV with Redirect from and Redirect to columns. Shopify serves them as 301.
Structured data
The theme prints Product and Article JSON-LD; current themes build it with the structured_data Liquid filter from the product object, so the price and availability follow the variant data. Apps for reviews and for "SEO schema" often add a second Product block. The schema module lists the types on the page; if it shows Product ×2, turn the app's schema option off and keep the theme's. Product schema: price, availability and reviews has the Shopify section.
Alt text and image sizes
Alt text is set per image in the product's Media section (click the image → Add alt text). The report's image alt finding lists the images without it. Collection images and section images get alt text in the theme editor's image picker.
What to ignore
- Content-Security-Policy and Permissions-Policy missing. Shopify sets the response headers and provides no way to add these. The findings are accurate, the score is capped, and there is nothing to do.
- Cookie flags on Shopify's cookies.
_shopify_y,_secure_session_id, cart and checkout cookies are Shopify's. Cookies set by your theme's JavaScript or by apps are the only ones you can change, and usually only by removing the app. - Server response time on an uncached page. You cannot add a page cache. If TTFB is high on one page and normal on others, look at that page's Liquid (a loop over all products in a mega-menu is the classic cause), not at the platform.
- Text compression, HTTP/2, cache lifetimes on Shopify's CDN. Already handled; any listed files are app scripts on other domains.
- Breadcrumb navigation not found. Most Shopify themes ship without breadcrumbs. Add them if the store is more than two levels deep; otherwise leave the info finding.
Shopify's dashboard versus the report
Online Store → Themes shows Shopify's Web performance dashboard with LCP, CLS and INP from real visitors to your store. It is the same kind of data as the field numbers in the report (real Chrome users, 75th percentile), and it is the number to watch over time. The report adds what the dashboard does not: the lab diagnosis of which element and which scripts, the SEO, schema and social checks of the same page, and a permanent link for the before-and-after. Use the dashboard to see whether the store passes, and the report to see what to change.
Verify
- The third-party finding lists only apps you decided to keep, and the total blocking time it reports has dropped.
- The LCP finding names the hero image with no
loading="lazy"on it, and the LCP metric on the collection page is under 2.5 s in the lab. - Search engine listing fields are filled on every collection, and the meta description finding passes on a sample of them.
- Shopify's Web performance dashboard shows the store passing all three vitals after 28 days of the changes.
Common mistakes
- Chasing the security score. Hours spent on headers you cannot set. Note them once and move on.
- Uninstalling an app without removing its snippet. The script still loads from
theme.liquid. Search the theme code for the app's domain after every uninstall. - Switching themes to fix speed. A new theme with the same 14 apps is the same speed. Fix the apps first; then a lighter theme shows a difference.
- Pixels pasted into theme.liquid. They load before the page and ignore consent. Move them to Customer events.
- Testing only the home page. Collection pages carry 24 product images and most of the app widgets. Test one of those and one product page.
- Uploading camera-size images because "the CDN resizes". It does, but the largest variant is still large, and the CDN cannot invent sharpness you did not need. Export at 2500 px.