A Shopify store starts from a better position than most sites because the platform makes the hard decisions for you: pages are rendered on the server, the theme usually emits product structured data, and the checkout is built to work without an account. Where a store loses points is at the edges of what a theme can control, chiefly files at the root of the domain and HTTP headers, and in the layer of apps that inject scripts into every page. This guide sets out what the platform does by default, what tends to go wrong, and the fixes in order of effort. Shopify's own documentation is at shopify.dev/docs for themes and the Help Centre for store settings; where this guide describes platform behaviour, it describes documented defaults as of this writing, and the live file on your own store is the thing to trust.
What a theme gives you by default
Server-rendered pages. A theme is a set of Liquid templates rendered by Shopify's servers, so the HTML a plain fetch receives carries the product title, description, price and availability. That is what A7 measures, and a standard theme passes it without effort. The exception is a headless build that renders products in the browser from the Storefront API, which is a different architecture and not what this guide covers.
Product structured data. Liquid provides a structured_data filter for product and article objects, and many current themes, including Shopify's reference theme, use it to emit a Product block with an Offer carrying price and availability. Two checks read this. B2 awards three points for a commerce site when any crawled page carries Product or Offer, plus two for Organization or WebSite somewhere on the site. C5 tests for the presence of an Offer type on the product page the crawler found; it is a presence test, not a comparison of the schema price with the visible one, though Product and Offer schema that matches the page explains why the two should still agree.
Guest checkout and accelerated payment. Customer accounts are optional in checkout settings, and Shop Pay, Apple Pay and Google Pay are offered as accelerated checkouts on many stores. C5 looks for the strings shop pay, apple pay, google pay or guest checkout in the cart page HTML when the crawler reached one, and otherwise in the homepage HTML. A footer that lists accepted payment methods usually carries the names in its markup. Guest checkout is an agent feature covers what each signal means for an agent completing a purchase.
A sitemap, a robots.txt and search. Shopify generates /sitemap.xml and declares it in a default robots.txt, which covers A3. Theme search forms use GET with a q parameter against /search, which is exactly what C6 wants. Policy pages for privacy, refunds and shipping are generated from store settings and linked from most theme footers, which covers D3 if all three are filled in.
What tends to go wrong
The default robots.txt disallows the cart. As of this writing the default file disallows /cart and /checkout for all user agents, which is sensible for a search index. The scanner obeys robots.txt for its own user agent, so on a default store it never fetches the cart, and the C5 point for a cart path returning 200 is not measured. The express checkout signal then falls back to the homepage. This is a limit of what the scan can evidence rather than a fault in the store, and the report says so in the C5 evidence.
The sitemap is an index. Shopify's root sitemap points at child sitemaps for products, collections, pages and blogs. The scanner reads the first sitemap declared in robots.txt and, when it finds no page entries, records the child sitemap locations instead. That earns the A3 points but leaves D4 with no lastmod values to read, because the scanner does not descend into an index as of rubric v1.0.1. The other D4 signals, visible dates and datePublished in article schema, are still available on the blog.
Root files. A theme serves templates, not arbitrary files at the root of the domain. llms.txt, llms-full.txt, agents.json and /.well-known/security.txt are all fetched at fixed paths, and by default a store returns a 404 for each. A4 is four points and D6 is two.
Apps. Every app that adds a pop-up, a review widget, a chat bubble or a consent banner does so by injecting script and markup into the storefront. The consent banner is the one A6 detects, from the same class and id patterns any consent tool uses. The rest add markup weight that B5 counts, since script contents are excluded but injected elements are not, and any app that rewrites page content in the browser widens the A7 gap.
Headers. As of this writing, response headers are not something a theme controls. Whether your store sends Strict-Transport-Security for D1 is a platform decision; read the header with curl -I and believe what you see rather than what you expect.
Fixes, in order of effort
Low
robots.txt is editable through the robots.txt.liquid theme template, as documented. The default file does not, as of this writing, carry groups for the six crawlers A2 names, so they fall under the * group and are allowed. Read the live file anyway: a theme or an app may have added directives you did not write, and the check scores whatever is served.
For llms.txt, the workable route without an app is a URL redirect in store navigation settings from /llms.txt to a text file you have uploaded under Files. The scanner follows redirects and reads the body it lands on, and A4 scores the file on its contents: three or more links, each with a description after the colon, earns three points, and an llms-full.txt reached the same way adds one. How to write an llms.txt that earns its place has the format. The same redirect approach can serve agents.json, which counts for C4 if the body parses as JSON. Whether the platform accepts a redirect from a dotted path such as /.well-known/security.txt is something to test on your own store; if it does not, an app that serves root files is the alternative, and if neither works the two D6 points are the cost.
Fill in every policy page in settings, so that privacy, refund and shipping links all appear in the footer. D3 looks for href values containing privacy, shipping or delivery, and returns or refund.
Medium
Audit the app layer. Open the storefront with a plain fetch, count the third-party script tags, and ask what each one adds for a buyer. Remove what you cannot answer for. If you need a consent banner for your jurisdiction, keep it, but know that A6 will score one of two rather than zero as long as nothing else dominates the page. Add Organization schema to the theme's layout if your theme does not emit it; B2's two sitewide points depend on it, and D2 wants a sameAs array in the same block.
Check that every product page carries the Offer block and that the theme's Open Graph snippet emits og:title, og:description and og:image on every template, including collections and pages, because B4 scores all crawled pages, not only products.
High
There is not much High-effort work on a standard theme, which is the point of using one. A store that has gone headless has taken on the A7 problem itself, and the fix is the same as for any framework: render on the server.
What is not fixable without leaving the platform
Response headers, the sitemap's structure, and whether a file can be served natively from the root are platform decisions. If a redirect for the dotted security.txt path does not work on your store, and you do not want an app for it, those two points stay unearned. The cart's Disallow is worth keeping; the scan simply records that it could not test that path.
Check your own site
Run the free scan on your store and read the C5 and A4 evidence lines, then compare your score with other stores on the e-commerce leaderboard. The check definitions are on the methodology page under understanding and actionability.