Shopify narrowed its new leave-store confirmation on October 23 so it only appears for websites Shopify considers suspicious, while sites it has flagged as malicious are blocked and other outside links open normally. The original version, added to storefronts on October 20, stopped shoppers on any link to an outside website, displaying the address they were headed to and asking whether to continue or return. Merchants complained in Shopify’s community forums that it popped up on intentional links to partners, and one said Shopify Support told them it couldn’t be turned off. Shopify added the prompt a week after attackers changed settings in apps from HulkApps, Selleasy, and Swym to redirect checkout shoppers to fake payment pages, but its changelog doesn’t mention those attacks.
