The Person Who Built Your Online Store Is Gone. Ask Whoever Touches It Next These Five Questions.

The person who built your store is gone. Maybe it was a nephew, a freelancer, or an agency that moved on years ago. The store still takes orders, so nobody wants to touch it. I understand that.

But 2026 platform changes land hardest on stores with no clear owner. A review widget, tracking code, pop-up, or old app can keep sitting there until a platform change turns it into a quiet problem. No warning bell. Just lost data, a missing feature, or uncertainty about who is responsible.

What I found in a passive check of 35 regional stores

On September 25, 2026, I looked at the public homepage and cart page of 35 small online stores in Virginia, North Carolina, Maryland, West Virginia, Tennessee, and DC. These included wineries, cideries, outfitters, fly shops, boutiques, and gift shops. I made one request per page and did not log in or test checkout.

I found 13 Shopify stores, 5 Squarespace stores, 4 WordPress stores, 3 WooCommerce stores, 3 Square Online stores, and 7 stores whose platform I could not identify. None showed signs of Magento or BigCommerce.

Seven of the 35 stores, about 1 in 5, still loaded a Universal Analytics tag. Of the 13 Shopify stores, I could read the app loader on 9. Every one of those 9 loaded storefront app code through Shopify script tags, from 1 to 9 apps per store. The ones I read by hand ran things like review widgets, form builders, Instagram feeds, product customizers and a chat button. I was looking at storefront code, not checkout.

Two of the 21 stores that showed a copyright year in the footer showed 2022 or earlier. One still said 2011. A footer date does not prove a store is unsafe, and a leftover tag or script tag does not prove something is broken today. It is a fair reason to ask who is looking after the store.

The dates that matter

1. Which apps load through script tags, and has each one moved?

Shopify announced that, starting October 1, 2026, apps can no longer create or update script tags. Existing script tags can continue running for now, but Shopify will stop injecting them into the online store on March 1, 2027. If an app vendor has not moved its feature to an app embed block or web pixel by then, that feature can stop loading.

All 9 Shopify stores where I could read the app loader were using script-tag-loaded apps. That does not mean all those apps will fail. It means each one needs an owner and a clear answer from its vendor.

Ask your web person to name every app that still uses this route, say what it does on the storefront, and confirm whether its replacement is installed and enabled. Do not settle for "the app is up to date." An app can be current while its old delivery method is still waiting on the vendor's migration.

A forgotten review widget may be a minor annoyance. A form builder that stops loading can cost leads. A product recommendation tool or subscription prompt may affect sales without anyone noticing why.

2. Did our ad and sales tracking survive August 26?

For Shopify stores on Basic, Shopify, and Advanced plans, August 26, 2026 ended the "Additional scripts" box and script tags on Thank you and Order status pages. Tracking tags pasted into those old locations stopped firing.

If you have ever asked, "Which ad brought that order?" this is worth checking. It can affect conversion tracking for ad platforms, affiliate tracking, and post-purchase measurement. Your ad account may still show activity, while some completed orders no longer reach the place you use to judge campaign results.

Ask the person touching your store to place one real test order, then follow that order through the tracking tools you rely on. Check whether the purchase event arrives, whether its value is right, and whether the order is attributed in the expected place. Shopify points merchants toward app pixels (under Customer events in Settings) or the ad platform's official app as the replacement.

1. Make a low-cost real purchase, then refund it.
2. Confirm the order appears in Shopify and in the sales reports you use.
3. Confirm the purchase event reaches the advertising or analytics platform tied to that campaign.

One real order tells you more than a screenshot of settings from years ago.

3. Are we still loading Universal Analytics?

Universal Analytics standard properties stopped processing data on July 1, 2023. A UA tag left on a page records nothing. It is dead code.

I still found it on 7 of the 35 regional stores I checked. The danger is not the tag itself. The danger is assuming you have analytics because somebody sees Google code in the page source, when the only tag present is an old Universal Analytics tag that has not collected data in years.

Ask for a simple answer: do we have a working analytics property, and can you show me a current visit arriving there? Then ask whether the old UA code can be removed. Cleaning it up reduces confusion for the next person who inherits the site.

Keep this question separate from your ad-tracking question. Website traffic reporting and ad conversion reporting overlap, but they are not always set up through the same tools or by the same person.

4. What version are we on, and who applies security updates?

The answer should include a version number, a maintenance owner, and a routine for handling urgent notices. "Our host takes care of it" is not enough unless somebody can say which parts the host covers and which parts belong to the store owner, developer, theme vendor, or plugin vendor.

On a WordPress store, the core update is the easy part. Themes, plugins, form tools, payment extensions and old administrator logins need someone watching them too. I wrote about why timely WordPress core updates matter during the 2026 attack wave, but a store still needs someone assigned to review the rest of its setup.

Magento 2.4.6 standard support ended August 11, 2026. If that is your version, ask which fixes you can still get and what the upgrade plan looks like. I found no sign of Magento among the 35 stores I checked, but if yours runs it, the warning above is for you.

WooCommerce owners can relax on one point. WooCommerce's Cart and Checkout blocks have been the default for new stores since version 8.3 in November 2023, but WooCommerce still lets a store switch back to the classic checkout if the new one causes trouble. Not every platform change is an emergency, and a good web person can tell you which ones are.

5. Which apps can see customer data, and who removes the ones nobody uses?

Apps are often installed to solve one immediate need, then forgotten after a redesign, seasonal promotion, or staff change. Some can see more than a storefront visitor realizes. They may handle customer names, email addresses, phone numbers, order details, or shipping information.

From September 13 through 17, 2026, stolen credentials for Ribon apps were used to inject scripts into some BigCommerce stores. BigCommerce said customer names, emails, phone numbers, and addresses were exposed, while card numbers and passwords were not. The apps were uninstalled.

I did not find BigCommerce in my 35-store check, but the lesson applies to every platform. An app with access to customer data keeps that access after everyone forgets it is there.

I wrote a similar ask-your-web-person list for a different problem. Same idea: you ask, they answer, and a vague answer is itself the finding.

A small check before a bigger problem

If your store has no clear technical owner, I offer a free store check. I look at your storefront the same way I looked at these 35 and tell you which of the five questions apply to you. I am MySEODesk in Lynchburg, and I answer my own phone at (434) 236-9027. You can also read about website maintenance, see my Virginia web design work, or contact me when you are ready.