CMS
Shopify Website Audit
Shopify audit: app JS, images, and headers Shopify will not let you set
· Configuration notes, not a newsroom.
SiteRune's Shopify fingerprint, Hydrogen vs Online Store, and why Cloudflare in front is in the playbook.
SHWhat SiteRune checks on this stack
- CMS / framework fingerprint from HTML, headers, cookies, and generator tags — fingerprint-based, not a plugin inventory
- Titles, meta descriptions, canonicals, H1, and robots on the homepage and walked interiors
- Security headers a crawler can see: HTTPS, HSTS, CSP, framing, nosniff, Referrer-Policy, Permissions-Policy
- HTML TTFB, compression, and Cache-Control on the document — not a Lighthouse filmstrip
- AI-bot robots policy, llms.txt, and Organization / FAQ / Article JSON-LD
Common problems
- Marketing homepage looks finished; interior templates ship empty titles or leftover noindex
- Hosted CMS cannot set HSTS/CSP, so the brief tells you to put a proxy in front instead of inventing an admin UI
- A security plugin's 'block AI' preset Disallows GPTBot on a site that wanted citations
- Session cookies or no-store on every anonymous GET, so the CDN never caches HTML
The tax is almost always apps
Shopify TTFB and INP on storefronts we fetch are usually app embeds plus unoptimized product images. The playbook: remove unused apps, defer remaining embeds, image_url with width and webp, keep JSON-LD product schema intact.
Online Store and Hydrogen fingerprint differently. We will not tell a Hydrogen storefront to install a theme app.
Headers you cannot set in the admin
CSP, HSTS, and frame-ancestors often need a proxy. SiteRune will say to put Cloudflare (or equivalent) in front for headers Shopify's admin will not expose. That is configuration, not a CDN upsell essay.
FAQ
How do you know this is my stack?
Fingerprints in HTML, headers, cookies, and generator tags. Confidence is a score, not a certificate. Unknown stacks stay generic — we will not invent a CMS.
Do I need an account?
Three guest scans, no card. Create a free account when you want history and more interiors.
Run it on a live URL
Same scan engine. Guest scans stay free.