The October 1 Index · Methodology

How the October 1 Index is measured

The index counts Shopify storefronts that still load at least one script through Shopify's deprecated ScriptTag API, attributed to the app that injected it. Every figure comes from fetching public storefront homepages from outside, with an identified user agent and one request per store per pass. A store enters the count when its rendered page carries Shopify's own storefront markers; a page that merely mentions Shopify is not a store. Every store reported as carrying a legacy script tag is confirmed on a second, separate fetch before it is counted.

Which storefronts are scanned?

The candidate list is the Tranco top one million domains. Each homepage is fetched once; hosts that time out, refuse automated requests or return a bot challenge are excluded rather than guessed. A host counts as a Shopify store only if its rendered page carries Shopify's own storefront markers. Pages that merely mention Shopify are not stores. A single fetch can miss a store (a timeout or a bot challenge) but does not invent one, so the store count is a floor.

What counts as a legacy script tag?

Shopify renders API-created script tags in one fixed form inside the document head, with the store's domain appended as a query parameter:

<script type="text/javascript" async="" src="https://vendor.example/script.js?shop=store.myshopify.com"></script>

Only scripts in exactly that form, in the head, are counted as legacy injections. Three other things load scripts with the same query parameter and are deliberately not counted, because none of them stop on March 1, 2027:

• Theme app extension embeds. Shopify wraps these in HTML comment markers (BEGIN app block and END app block). Scripts inside those markers are migrated.
• App blocks in the page body. Shopify wraps these in a shopify-block container. Also migrated.
• Hand-placed theme code. Snippets a developer pasted into the theme, in any other form. These are not affected by the deprecation.

What does "cleanup only" mean?

A store can carry both a migrated theme app extension and an old script tag from the same vendor. Nothing breaks on March 1 for that store; the old tag is redundant. The index reports these separately so that a vendor that has already migrated is not shown as a risk.

How are vendors named?

The script host is mapped to the app or company that operates it, using the vendor's own site and the script file's header. Where a host cannot be attributed, the hostname is shown as is. Vendor names identify the script host only. Every named vendor can send a correction, a migration notice or a request for a verified check to index@statusbird.io; corrections are published verbatim under the vendor's row within one business day.

What are the limits?

• Homepage only. Scripts injected on other page types are covered by the Exposure Report, not the index.
• A store behind a bot challenge at fetch time is excluded, not counted either way.
• Counts reflect the fetch dates shown on the index and change as the scan is repeated.
• The index records what a storefront loaded. It makes no statement about compliance with any law or standard.

Where do the dates come from?

Shopify's developer changelog entry of August 24, 2026: on October 1, 2026 the ScriptTag create and update calls return errors on every API version, and on March 1, 2027 Shopify stops injecting script tags into storefronts.