When a competitor's store has a polished review section, a loyalty widget or a subscription option, it is natural to wonder what powers it. Most of these apps leave traces in the storefront's code: the scripts it loads, the stylesheets, element ids and data attributes. Reading those traces is how you can tell what apps a Shopify store is using, at least the ones that show up publicly.
This guide explains how the free ORVX Shopify App Detector reads those signals, how it decides how confident to be, and why no outside tool can give a complete list.
Every example and amount on this page is illustrative. It shows the method and is not a benchmark, a quote or advice.
What the detector reads
It fetches the page you enter and, when it can find one, a product page from the same store, because review, upsell and subscription apps often load only there. From each page it collects:
- script, iframe and preload addresses;
- stylesheet addresses;
- inline script text;
- element ids, class names and data attribute names.
It then compares them with a registry of 73 signatures across reviews and social proof, marketing and analytics, customer support, loyalty and rewards, upselling and conversion, subscriptions and other tools. It never reads links: a link to an app's website is not evidence that the store uses the app.
How confidence is decided: a worked example
Each signature lists signals with a strength of High, Medium or Low. A detection takes the strength of its best signal, and moves up one step when two different kinds of signal agree. A Low signal on its own is not shown. Here is how that plays out on three hypothetical findings:
| Evidence found | Signal kinds | Reported confidence |
|---|---|---|
| The app's script address on its own domain | Script URL (High) | High |
| An app-specific element id and a matching data attribute | Element id (Medium) and data attribute (Medium) | High, because two different kinds agree |
| A single generic class name | Class name (Low) | Not shown |
Every detection lists up to three pieces of evidence with their type, so you can check a finding yourself in the page source. Theme app extension folders that match no signature are listed separately as unidentified app embeds, with the folder name as the only claim.
How to use the results
- Research a competitor's toolkit. Seeing that a rival uses a particular reviews or loyalty app tells you what shoppers in your category may already expect.
- Audit your own store. Apps you uninstalled sometimes leave scripts in the theme. If the detector still finds one, check the theme code.
- Count the scripts. Each app adds code a shopper's browser has to load. The Shopify Store Health Checker reports the technical side of the page, and performance where it can be measured.
- Combine with catalog research. The Competitor Store Analyzer adds observed prices and merchandising to the picture.
- Check where apps appear. Run the detector on a product page as well as the home page; the result can differ.
Reading a result well
Group the detections by category before drawing any conclusion. A store with one reviews app, one email tool and a chat widget has a fairly standard setup. A store with three upselling tools and two pop-up apps is making a deliberate bet on on-page offers, and its pages may be heavier for it. The evidence column matters as much as the name: a High detection backed by the app's own script address is far stronger than one backed only by markup that a theme developer could have copied.
Common mistakes
- Treating the list as complete. Back-office apps for shipping, accounting or inventory leave no trace in the storefront.
- Assuming an app causes a result. A competitor's success is not explained by the apps it runs.
- Installing every app a rival uses. Each one adds cost and scripts. Start from the problem you need to solve.
- Ignoring client-rendered pages. When most of a page is drawn by JavaScript, fewer technologies are visible in its HTML, and the detector says so.
Where detection stops
Only publicly detectable technologies are shown; this is not a complete list of installed Shopify apps. Apps that run in the admin, at checkout or on the server are invisible from outside. Apps that load only after a click or a scroll may be missed. Signatures are maintained by hand and can lag behind an app's code changes, which is why every detection shows its evidence. The detector respects robots.txt and has a daily limit per visitor.
To check whether a page's content and calls to action are doing their job, the Landing Page Conversion Auditor is the next step.
Beyond the storefront
The apps on a store are visible. Whether the store makes money is not. ORVX Core connects to your own Shopify store and reports real profit per order and product, with ad spend from Meta and Google counted in net profit.
The $1.9M Commerce Initiative makes ORVX Core free for 12 months for 10,000 eligible Shopify stores, with no credit card. After the free year, Core is the standard $19 per month or $190 per year if you choose to continue. The other free tools are in the ORVX tools hub.
Frequently asked questions
Can any tool list every app a Shopify store has installed?
No. Many apps work only in the admin or the back office and leave nothing in the storefront. An outside tool can only report what the public pages load.
Why are low-confidence matches hidden?
A single weak signal, such as a generic class name, can come from many sources. Showing it would turn guesses into claims, so the detector reports High and Medium confidence only.
What is an unidentified app embed?
A Shopify theme app extension folder that loads on the page but matches no known signature. The detector lists the folder name and claims nothing more about it.
Does the detector read links to app websites?
No. A link to a vendor is not an installation, so anchors are ignored.
Does it work on non-Shopify sites?
Technologies that work on any site, such as some analytics and chat tools, are still detected. Shopify-specific app embeds only exist on Shopify stores.
Sources
- The $1.9M Commerce Initiative: terms and FAQ (ORVX, checked 26 October 2026)