Shopify's November 20 App Delistings: What Changes and What to Check Before Black Friday

On November 20, 2026 at 11:59 PM ET, Shopify will delist every public app that hasn't set up an IP allowlist, a security control that limits where an app's access tokens work. Delisted apps keep working on stores that have them, but they're blocked from new installs and flagged in your admin. A related change on November 12 can break bulk data jobs sooner. Here's what's changing, what it means for your store, and what to check before Black Friday.

What happens on November 20, 2026?

Shopify delists public apps that haven't configured an IP allowlist. From November 20, 2026 at 11:59 PM ET, those apps are removed from the Shopify App Store, blocked from new installs, and flagged to merchants in Settings, then Apps. Existing installs keep working until April 1, 2027.

An IP allowlist limits the networks an app's access tokens can be used from, so a leaked token can't be used anywhere else. Shopify recommended it on October 27, after the October 2026 checkout hijack, and made it mandatory on November 5, according to its developer changelog.

Sources: Shopify's developer changelog and IP allowlist documentation, November 2026.

Will delisted apps stop working on my store?

No, not because of delisting. Shopify says existing installs keep working after November 20, until April 1, 2027; the app just can't be installed by new stores, and it's flagged in your admin. The exception is bulk operations: from November 12, bulk jobs from non-compliant public apps fail, even on stores that already have the app.

That makes November 12 the date to watch before Black Friday. Bulk operations are how apps move large amounts of data at once, so these are the kinds of apps that could be affected:

• Inventory and catalog sync, including ERP and warehouse connectors.
• Product feeds for Google, Meta and marketplaces.
• Bulk editors, importers and exporters.
• Reporting and analytics apps that pull large order histories.
• Migration tools.

If one of those apps stops updating after November 12, ask the developer whether it has set up an IP allowlist.

Which Shopify apps are affected?

Public apps, meaning apps listed in the Shopify App Store, that haven't configured an IP allowlist by the deadline. Custom apps and apps merchants create themselves in the Dev Dashboard or admin aren't affected. Shopify hasn't published a list of non-compliant apps, so check each app's status in your admin.

Most established app developers are likely to comply in time. The risk sits with smaller or less actively maintained apps. Shopify lets developers whose apps call the Admin API from merchant infrastructure request an extension.

How do you check your apps before November 20?

Open Settings, then Apps, in your Shopify admin and review each app's security setup, where Shopify now shows whether it uses an IP allowlist and expiring tokens. List the apps your sales depend on, ask those developers for their compliance date, and test your checkout and data syncs before the store freeze.

1. Review Settings, then Apps. Shopify now shows each app's security setup there, and will flag non-compliant apps after November 20.
2. List your critical apps: anything touching checkout, inventory, feeds, subscriptions, reviews or fulfillment.
3. Ask each critical app's developer whether it has set up an IP allowlist and expiring tokens, and when.
4. Check bulk-data apps after November 12. Confirm inventory, feeds and reports are still updating.
5. Remove apps you no longer use, while you're not under pressure, and check your theme's app embeds for leftovers.
6. Test checkout like a shopper: a private window, a product, the cart, your real checkout button, then confirm the address bar shows your domain or Shopify's.

What should you do if an app gets flagged?

Don't uninstall it in a rush. A flagged app keeps working, and once it's delisted you may not be able to install it again. Ask the developer when it will comply, keep it running through Black Friday if it works, and plan any replacement for after the holiday rush.

A simple rule of thumb:

• Flagged, working and critical: keep it, ask the developer for a date, and plan a replacement in December if there's no clear answer.
• Flagged and not critical: schedule its removal after Black Friday.
• Flagged and broken, for example a sync that stopped after November 12: contact the developer first, then replace it if needed.
• Not flagged: no action, beyond your usual app reviews.

Freeze new app installs during peak season anyway. Our Shopify Black Friday 2026 checklist recommends locking your theme and apps from November 16.

Is a delisted Shopify app a security risk?

Not on its own. Apps delisted on November 20 are removed for missing a security setting, not for being compromised. In the October 2026 checkout hijack, only three developers confirmed unauthorized code went out through their apps: Hulk Product Options, Selleasy and Swym Wishlist Plus.

Some October delistings were named in public reports without confirmation, including Privy, Consentmo and Boost. Several apps have since returned to the App Store. If you use any app tied to the hijack, follow its developer's guidance and test that your checkout stays on your domain or Shopify's.

How does this connect to the October 2026 delistings?

It's the next step. From October 14 to 27, 2026, hundreds of apps were delisted with little explanation, during and after a checkout hijack that used compromised apps. The November rules turn Shopify's response into requirements every public app must meet.

A tracker run by Revenue Shield, a checkout monitoring vendor, counted 563 apps delisted between October 14 and 27, 2026, using the heyapps.dev App Store archive, with some later returning. Delisted apps included well-known names such as Rebuy and Aftersell, most with no reason given. Our Rebuy alternatives guide covers one of the most-used apps affected.

What comes after November 20?

Two more deadlines. On January 1, 2027, public apps that haven't moved to expiring offline access tokens are delisted and flagged in the same way. On March 1, 2027, existing storefront script tags stop working, so older apps that still rely on them need to move to app embeds.

Script tags matter for store owners as much as developers. Since October 1, 2026, apps can't create or update script tags, and anything still using them stops on March 1. Ask your app developers now, so January and February don't bring surprises. Our Shopify Editions Fall 2026 guide covers the other platform changes.

Do you need help auditing your Shopify apps?

If your store runs more than a handful of apps, an audit before Black Friday is worth it. We review which apps touch checkout, data and the storefront, check their security setup, test checkout and syncs, and tell you what to keep, replace or remove after peak season.

We use our integration scorecard for every app review. Solo Media Group is a Shopify Platinum Partner, rated 5.0 from 38 reviews on the Shopify Partner Directory and 4.9 from 48 on Clutch.

Frequently asked questions

Summarize with AI

Summarize in ChatGPT · Summarize in Claude · Summarize in Perplexity