TL;DR
- Ghost code is leftover code from uninstalled apps that stays in your Shopify theme: script tags in
theme.liquid, app blocks insettings_data.json, JavaScript bundles in/assets, orphan Liquid snippets. - When you uninstall an app, Shopify only revokes API access — it does not remove the code the app wrote into your theme.
- Consequence: 2-5 seconds longer load times, worse Core Web Vitals, supply-chain risk from stale CDN scripts, fragile theme migrations.
- Manual cleanup: 3-5 hours per store. Automated: under 3 minutes.
What is ghost code?
Ghost code describes the code residue that uninstalled Shopify apps leave in your theme. The term is established in the Shopify community since 2024 — also called "leftover app code", "orphan scripts" or "dead scripts".
The forms ghost code takes:
- Script tags in Liquid files:
<script src="//cdn.judge.me/widget.js">insidetheme.liquid,layout/theme.liquidor section files. - JSON app blocks in
settings_data.json: Shopify Online Store 2.0 themes store app blocks as structured JSON. When you uninstall an app, the entries often remain — and sometimes break the theme editor. - Liquid snippets in
/snippets: files likeklaviyo-subscribe.liquidthat are no longer{% render %}-referenced anywhere. - Section files in
/sections: outdatedpagefly-landing.liquidorshogun-hero.liquidno longer referenced. - Assets in
/assets: JavaScript bundles (often 20-80 KB), icon fonts, CSS files. - Locale keys in
de.json,en.json: translations for UI strings that no longer exist.
Why does the code stay after uninstall?
Shopify's app installation model is designed this way on purpose: when installing, an app writes required assets into the theme via API (that's what the write_themes scope is for — Shopify has restricted it heavily since April 2023). When uninstalling, Shopify revokes API access but does not actively delete theme files. This is by design: Shopify wants to prevent an app from breaking something the merchant customized themselves during the uninstall.
The consequence: every uninstalled app leaves traces. According to StoreCensus Shopify App Statistics 2026, over 455,000 install/uninstall events happen monthly across the Shopify ecosystem. The average store has 6.4 active apps installed — meaning dozens of uninstalled apps over time, with residue still lying around.
Performance costs
Ghost code is not a theoretical problem. Measured costs:
- Average mobile page: 251 KB of unused JavaScript (Web Almanac 2025, HTTP Archive)
- Only 48 % of Shopify stores pass Google's Mobile Core Web Vitals (pagespeedmatters.com 2026)
- Third-party scripts can account for >50 % of load time (DebugBear)
- Every 100ms mobile delay costs up to 7 % of your conversion rate (Akamai 2017, 10 billion user visits)
- Amazon: 100ms delay = 1 % revenue loss (Greg Linden, 2006 — scaled to today ~$3.8B/year)
- Deloitte/Google 2020 "Milliseconds Make Millions": 0.1 seconds faster = +8.4 % conversions in retail, +9.2 % AOV
Concrete scenario for a DACH Shopify store at €500,000 yearly revenue: 300-800 KB of ghost code typically worsens LCP by 0.5-1.5 seconds. Expected conversion lift after cleanup: 2-6 % = €10,000-€30,000 additional revenue per year.
The security problem
Ghost code isn't just a performance issue — it's a supply-chain risk.
Example: the Polyfill.io supply-chain attack in June 2024 compromised 384,773 hosts — primarily in Germany. Hulu, Mercedes-Benz, Warner Bros and thousands of e-commerce stores that still had script tags from Polyfill.io in their themes — even though many had long uninstalled the originating app.
Magecart attacks (formjacking) happen every 16 minutes according to RiskIQ. Over 74 % of all web-based data breaches are formjacking. An old script tag from a long-dead app is the perfect entry point.
Shopify gets serious in 2025
With the February 1, 2025 release, Shopify deprecated the creation of new ScriptTags. Legacy ScriptTags continue to load: until August 28, 2025 on Shopify Plus, until August 26, 2026 on non-Plus stores. After these deadlines, all remaining ScriptTags will be blocked — for stores with ghost code, this can cascade errors when old script loaders suddenly 404.
That gives you a tight window to clean up your store before Shopify does it for you.
How do you find ghost code?
The painful manual method:
- Duplicate the theme (backup).
- List every app name you ever installed (often no longer available — Shopify only shows currently active apps).
- Search per app for patterns:
judge.me,klaviyo,bold,loox,yotpo... - Check script tags in the
<head>area oftheme.liquid. - Check
settings_data.jsonfor app block entries (dangerous — a syntax error breaks the theme editor). - Walk through the snippets folder for orphan files.
- Clean up the assets folder.
- Test nothing productive got broken.
- Repeat for every store.
Realistic effort: 3-5 hours per store — and only if you have documented every app you ever had.
The automated alternative: GhostCode
Exactly for this problem we built GhostCode. The app:
- scans your entire theme in under 30 seconds
- detects 200+ app patterns (Judge.me, Loox, Klaviyo, Bold, Yotpo, PageFly, GemPages, Shogun, ReCharge and many more)
- detects 50+ CDN signatures (third-party script loaders)
- shows every finding with file path, line, severity and code diff
- cleans per click — individually or in bulk
- creates a backup before every change, retained for 90 days
- offers one-click restore if something goes wrong
- shows a Health Score 0-100, live-updated
GhostCode holds an official Asset API exemption from Shopify since March 2026. Not a marketing claim, a prerequisite: without that exemption, a public app can't write to the theme — it can only display ghost code, not remove it. Most "theme cleanup scanners" in the App Store are therefore read-only.
FAQ
Is the code automatically removed when I uninstall a Shopify app? No. Shopify only revokes the app's API access. The code the app wrote into your theme stays.
Can I find ghost code myself? Yes, but it takes hours and carries risks with settings_data.json. An automated scan is orders of magnitude faster and safer.
What about settings_data.json? Online Store 2.0 themes store app blocks there structurally. Manual editing is risky — a syntax error breaks the theme editor. Automated tools like GhostCode use safe JSON parsing with a string-based fallback.
Don't speed apps like Hyperspeed or TinyIMG do this? No. Speed apps optimize loading (defer, minify, lazy-load) — they hide ghost code behind defer, but do not remove it. The root cause stays.
When do I need to clean up? Technically any time. Practically: before the next traffic peak (BFCM, summer sale, Black Friday). And at the latest before Shopify's ScriptTag deactivation in August 2026.
Next step
Try GhostCode for free in the Shopify App Store. A scan takes 30 seconds. Result: a clear list of how much baggage your theme drags around — and a one-click path to get rid of it.
Sources: StoreCensus Shopify App Statistics 2026, Web Almanac 2025 (HTTP Archive), Deloitte/Google "Milliseconds Make Millions" 2020, Akamai State of Online Retail Performance Report 2017, pagespeedmatters.com E-Commerce Platforms Speed Ranking 2026, Censys Polyfill.io analysis, Shopify Dev Docs ScriptTag deprecation.