Published: 22 October 2026 Website security is something every business owner should take seriously, particularly when your website is responsible for generating revenue, processing customer orders and handling sensitive information. On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities in PHP, one of the world's most widely used programming languages. The announcement prompted urgent warnings from cybersecurity organisations, including the UK's National Cyber Security Centre (NCSC), encouraging businesses to identify vulnerable systems and apply security updates immediately. For businesses running websites on platforms such as WordPress, WooCommerce, Magento, Drupal or Joomla, understanding these vulnerabilities and taking the appropriate action should be a priority. But what exactly has happened, what does it mean for your website, and how can you protect your business? In this article, we explain the latest PHP security vulnerabilities in simple terms, what website owners should do next, and why choosing the right eCommerce platform is an important part of building a secure, sustainable online business. What Has Happened With PHP Security? PHP is a server-side programming language used to power millions of websites and web applications around the world. It works behind the scenes, helping websites communicate with databases, display dynamic content and manage functionality such as customer accounts, shopping baskets and online transactions. On 21 October 2026, PHP released security updates addressing two critical vulnerabilities: CVE-2026-109618 CVE-2026-109619 Both vulnerabilities received a critical severity rating of 9.2 out of 10 under the CVSS v4.0 scoring system. In certain circumstances, these vulnerabilities could allow an unauthorised attacker to remotely execute malicious code on an affected web server without needing to log in. What does that mean in simple terms? Imagine someone finding a way into the systems running your website without needing a username or password. Depending on the server environment and the attacker's capabilities, this could potentially allow them to access sensitive information, interfere with website functionality or compromise the underlying server. For an eCommerce business, the consequences could include website downtime, disruption to online orders, reputational damage and potential exposure of customer information. Importantly, the discovery of these vulnerabilities does not mean every website running PHP has been hacked. It does, however, mean businesses should act quickly to establish whether their systems are affected. The UK National Cyber Security Centre has published an official security alert, recommending that organisations identify PHP installations, apply the latest security updates and investigate any signs of compromise. Which Website Platforms Could Be Affected? Because PHP is used by several popular content management systems and eCommerce platforms, the potential impact extends beyond one website provider. Platforms that commonly rely on PHP include: WordPress WordPress is one of the most widely used content management systems, supporting everything from small business websites to complex websites with extensive functionality. Although WordPress itself is not responsible for these PHP vulnerabilities, websites running affected PHP versions on their hosting servers could be exposed. Businesses should contact their hosting provider to confirm that the necessary PHP security updates have been applied. The official WordPress security announcement provides further guidance. WooCommerce WooCommerce is an eCommerce plugin built on WordPress, making it a popular choice for businesses selling products online. Because WooCommerce depends on WordPress and its underlying PHP environment, affected hosting configurations could introduce security risks. For online retailers, this makes PHP updates particularly important, alongside maintaining secure plugins, themes, payment integrations and administrator access. Businesses should also check that their hosting provider has applied the necessary PHP security fixes rather than assuming an update to the WooCommerce plugin alone will resolve the issue. Magento / Adobe Commerce Magento, now part of Adobe Commerce, is another established eCommerce platform that relies on PHP. Magento websites can involve complex hosting environments, custom development and multiple third-party extensions. Businesses using Magento should work with their hosting provider or development team to assess their PHP installation, review compatibility and apply the appropriate security updates. Drupal and Joomla Drupal and Joomla are also PHP-based content management systems. As with WordPress and Magento, the level of exposure depends on the PHP versions, server configuration and security updates in place. The key point is that this is a PHP security issue, not a vulnerability unique to any individual website platform. A website running one of these systems is not automatically compromised. However, any internet-facing server using an affected PHP installation requires attention. Which PHP Versions Need Updating? The PHP development team released security fixes on 21 October 2026. The relevant fixed releases include: PHP branch Fixed security release PHP 8.5 8.5.12 PHP 8.4 8.4.27 PHP 8.3 8.3.36 PHP 8.2 8.2.35 Businesses using these PHP branches should ensure they are running the fixed release or a later security-maintained version. Older unsupported PHP versions, including PHP 8.1 and earlier, require particular attention. These versions no longer receive standard security releases from the PHP project, although certain hosting or operating system vendors may provide independently maintained security patches. If your website runs an unsupported PHP version, speak to your hosting provider or developer about upgrading to a supported release. You can find the latest versions and official security information directly on the PHP website. What Should Website Owners Do Now? If your website uses PHP, there are several practical steps you should take to reduce your exposure and protect your business. 1. Contact Your Website Hosting Provider Your hosting provider should be your first point of contact. Ask them to confirm which PHP version your website is running and whether the latest security fixes have been applied. If you're using managed WordPress or WooCommerce hosting, your provider may already have deployed the required patches. However, it's important to confirm this rather than assume your website is protected. 2. Apply the Latest PHP Security Updates Updating PHP to a fixed, supported version is the most important action. Your developer or hosting provider should assess compatibility with your website, plugins and integrations before applying the update, while treating remediation as urgent. If updating is not immediately possible, follow the official temporary mitigation guidance and consider whether affected services need to be isolated or temporarily taken offline. 3. Check Your Website for Suspicious Activity Review your website and hosting environment for unusual activity. Warning signs may include: Unexpected administrator accounts or changes to user permissions Unknown files or changes to existing website code Unusual server activity or suspicious requests Unexpected redirects to unfamiliar websites Changes to customer information or website functionality Unexplained website downtime or performance problems These signs do not necessarily confirm a breach, but they should be investigated. If you suspect your website has been compromised, seek specialist incident response assistance before making changes that could destroy important evidence. 4. Review Website Backups Make sure your business has recent, secure backups of its website and critical data. Backups should be stored separately from your live website and should be recoverable if needed. For eCommerce businesses, this is particularly important because website data may include product information, order history, customer accounts and other commercially valuable information. A reliable backup process is an essential part of any website security and business continuity strategy. 5. Review Your Wider Website Security While PHP updates address the immediate vulnerabilities, they should also prompt a wider website security review. Check that your website software, themes, plugins, third-party integrations and user accounts are being managed securely. Enable multifactor authentication wherever available, remove unnecessary administrator access and review any integrations that are no longer required. Security should be treated as an ongoing responsibility rather than something addressed only when a major vulnerability is announced. For further advice, visit the National Cyber Security Centre. Why Website Security Matters for eCommerce Businesses For an eCommerce business, your website is much more than an online shopfront. It's where customers discover products, make purchasing decisions, enter payment information and build trust in your brand. When a website experiences security problems, the commercial impact can extend well beyond the immediate technical issue. Lost revenue from downtime If customers cannot access your website or complete a purchase, your business could lose orders and revenue. For retailers investing heavily in Google Ads, SEO and paid social, website downtime can also mean wasted marketing spend as customers arrive at a website that cannot convert. Reduced customer confidence Customers expect their personal information and payment details to be handled securely. A compromised website can damage customer confidence and affect whether people feel comfortable purchasing from your business again. Search visibility and SEO problems A website security incident can also affect organic search performance. Malicious redirects, injected spam pages, inaccessible content and unexpected website changes can create crawling, indexing and user experience problems. Recovering from these issues may require technical development, website cleanup and ongoing search performance monitoring. Additional operational costs Security incidents can create unplanned costs for emergency development work, investigations, recovery and ongoing monitoring. This is why security, hosting infrastructure and platform maintenance should form part of a business's wider eCommerce strategy. Why We Choose to Build on Shopify At Lionheart Marketing, we've made a deliberate decision to specialise in Shopify for our eCommerce website design and development projects. That decision isn't simply about the design flexibility, user experience or eCommerce functionality Shopify offers. It's also about providing businesses with a platform that reduces the technical burden of managing core website infrastructure and allows teams to focus more of their time on growing their business. As a specialist Shopify eCommerce agency, we believe businesses should be able to invest their time and resources into attracting customers, improving conversion rates and generating sales, rather than constantly worrying about hosting infrastructure and maintaining the underlying eCommerce platform. There are several reasons why Shopify has become our platform of choice. 1. Shopify Is a Fully Hosted eCommerce Platform Unlike self-hosted solutions, Shopify provides the hosting infrastructure as part of its platform. This means merchants don't need to separately arrange and maintain the servers responsible for running their core online store. Shopify manages its platform infrastructure, hosting environment and core security updates centrally. For business owners, this removes a significant amount of technical responsibility that can otherwise sit with an internal development team, website agency or hosting provider. This doesn't eliminate every security concern, but it does reduce the amount of infrastructure merchants need to maintain themselves. 2. Shopify Is Level 1 PCI DSS Compliant One of the reasons we value Shopify is its approach to payment security. Shopify is certified Level 1 PCI DSS compliant, which is the highest level of PCI DSS validation. But what does that actually mean? PCI DSS stands for Payment Card Industry Data Security Standard. It's a set of security requirements designed to help businesses and technology providers protect payment card information. These requirements cover areas such as secure networks, protection of cardholder data, access controls, ongoing monitoring and security testing. In simple terms, Shopify has been independently assessed against stringent standards for protecting payment card information. For merchants using Shopify's supported checkout and payment infrastructure, this significantly reduces the complexity involved in meeting payment security requirements. However, it's important to understand that PCI DSS compliance doesn't guarantee a website can never be hacked. Merchants are still responsible for areas such as account security, third-party integrations, appropriate staff permissions and their own applicable compliance obligations. You can read more about Shopify's certifications and approach to protecting merchant data on the official Shopify security page. 3. Less Responsibility for Core Security Updates One of the challenges businesses can face with self-hosted eCommerce platforms is maintaining the underlying software environment. That can involve managing server updates, PHP versions, databases, application compatibility and security patches. With Shopify, these core platform responsibilities are managed by Shopify itself. For merchants, this creates a more straightforward operating environment. Rather than coordinating every underlying server update, businesses can concentrate on their products, customers, website content and commercial performance. It's still important to manage third-party apps, custom integrations and account access securely, but much of the core infrastructure maintenance is handled centrally. 4. Built Around eCommerce Performance and Growth Security is important, but an eCommerce website also needs to deliver commercially. A secure website that struggles to attract visitors or convert customers is unlikely to support long-term growth. This is why our approach at Lionheart Marketing combines Shopify development with search marketing, conversion rate optimisation and customer experience. We design and develop Shopify stores with a focus on helping brands: Improve organic search visibility and technical SEO Create better product and collection page experiences Reduce friction across the customer journey Improve checkout and conversion performance Connect marketing, analytics and customer retention tools Support sustainable eCommerce growth Our Shopify marketing services are designed to bring these areas together, ensuring that website performance, search visibility and conversion strategy work towards the same commercial objectives. We believe your website should be an asset that helps grow your business, not simply another system that requires constant maintenance. Is It Time to Consider Migrating From WooCommerce or Magento to Shopify? The latest PHP vulnerabilities have understandably raised questions about website security and platform maintenance. However, a security warning alone shouldn't automatically trigger a rushed website migration. WordPress, WooCommerce, Magento and other PHP-based platforms can all be operated securely when they are properly maintained, patched and supported. For businesses already experiencing ongoing technical challenges, though, it may be a useful opportunity to review whether their current platform remains the right fit. Common reasons businesses consider moving to Shopify include: Increasing website maintenance and development costs Frequent plugin or software compatibility issues Concerns about hosting and security responsibilities Difficulties managing website updates internally Poor website performance or conversion rates Limited internal resources to manage a complex eCommerce environment If these challenges sound familiar, reviewing your current platform and its long-term costs could be a sensible next step. At Lionheart Marketing, we support businesses with WooCommerce to Shopify and Magento to Shopify migrations, helping them move to a platform that better supports their operational and commercial requirements. Importantly, a successful eCommerce migration involves much more than transferring products. It requires careful planning around SEO, existing URL structures, redirects, customer and order data, integrations, analytics and the overall customer journey. Our migration approach focuses on protecting the search visibility and customer experience businesses have already invested in, while creating opportunities to improve performance after launch. Moving platforms should be a strategic business decision, not a reaction driven by fear. Frequently Asked Questions About the PHP Security Vulnerabilities Has WordPress Been Hacked? The PHP security vulnerabilities do not mean WordPress itself has been hacked or that every WordPress website has been compromised. The vulnerabilities affect PHP, which WordPress uses to operate. WordPress websites running vulnerable PHP installations may be exposed and should receive the relevant updates. Does WooCommerce Need a Security Update? WooCommerce website owners should check that their hosting provider has applied the relevant PHP security updates. Updating the WooCommerce plugin alone does not address vulnerabilities in the underlying PHP runtime. Businesses should also continue maintaining their WordPress installation, plugins, themes and third-party integrations. Can These PHP Vulnerabilities Affect Customer Data? Potentially, yes. Successful exploitation could allow attackers to run malicious code or gain access to information available within a compromised server environment. The actual impact depends on the server configuration, security controls and what an attacker can access. Businesses concerned about potential exposure of personal information should seek appropriate technical and data protection advice. Is Shopify Affected by These PHP Vulnerabilities? Shopify's core hosted eCommerce platform is not built around a merchant-managed PHP server, so merchants do not need to patch the underlying Shopify platform for these vulnerabilities. However, businesses using external PHP-based applications, middleware or third-party integrations should review those systems independently. No eCommerce platform should be considered completely immune from cybersecurity risks. Is Shopify More Secure Than WooCommerce? The platforms operate using different security and maintenance models. Shopify centrally manages its core hosting infrastructure and platform security, reducing the maintenance responsibilities placed on merchants. WooCommerce offers greater control over the hosting environment, but that also means someone must take responsibility for keeping the underlying infrastructure, WordPress software, plugins and integrations secure. Both can be operated securely when the appropriate controls are in place. The right choice depends on your business requirements, internal resources and technical capabilities. What Does Shopify PCI DSS Level 1 Compliance Mean? Shopify's Level 1 PCI DSS certification means its payment infrastructure meets the highest level of PCI DSS validation. It demonstrates that Shopify has been assessed against stringent security requirements designed to protect payment card information. However, merchants must still maintain good security practices and meet any responsibilities that apply to their own operations. Our Door Is Open if You Need Support If your business has been impacted by the recent PHP security vulnerabilities, or you're concerned about the security and long-term suitability of your website, our door is open. We understand how important your website is to your business, particularly when it plays a central role in generating enquiries, processing orders and delivering revenue. Whether you're unsure what the latest security announcement means, need guidance on your next steps or are considering whether Shopify could be a better fit for your business, the team at Lionheart Marketing is here to help. As a North East-based Shopify and eCommerce agency working with businesses across the UK, we help brands build, migrate and grow websites designed around long-term performance. Need some guidance or want to talk through your options? Get in touch with the Lionheart Marketing team. We're always happy to have a conversation and point you in the right direction.

Choosing the right Shopify marketing agency can be one of the most important decisions your ecommerce business makes. The right agency can help you overcome growth challenges, improve marketing performance and build a more profitable business. The wrong agency can leave you spending thousands of pounds on activity that delivers very little commercial value. With so many Shopify digital marketing agencies offering SEO, Google Ads, paid social, conversion rate optimisation and ecommerce growth services, how do you know which one is right for your business? Agency websites often look similar. You'll see promises of increased traffic, improved conversions, stronger return on investment and scalable growth. But what happens before you sign a contract is often a much better indication of what the relationship will look like afterwards. At Lionheart Marketing, we believe choosing an agency should start with three things: understanding your challenges, identifying the outcomes you want to achieve and establishing whether those outcomes are commercially realistic. This guide explores what to look for when choosing a Shopify marketing partner, the questions worth asking and the potential red flags that should make you think twice. A Trusted Shopify Marketing Agency Should Understand Your Challenges Before Offering Solutions One of the biggest warning signs when speaking to a potential ecommerce marketing agency is how quickly the conversation moves towards services and pricing. You've probably experienced something similar. You explain that your ecommerce sales have slowed down, and within minutes you're being offered an SEO package, a Google Ads retainer or a paid social strategy. But has the agency actually understood why your sales have slowed? Perhaps you're already generating plenty of traffic, but your Shopify conversion rate is below expectations. Maybe your paid advertising is delivering revenue, but rising customer acquisition costs are putting pressure on profitability. Or your biggest opportunity might be existing customers who purchase once and never return. These challenges require very different approaches. A good Shopify digital marketing agency should take the time to understand: Where your ecommerce business is today and where you want it to be. What challenges are preventing you from achieving your growth objectives. Why those challenges exist and how long they have been affecting performance. Which marketing channels are currently generating customers and revenue. How your Shopify website performs throughout the customer journey. What your current marketing investment looks like. Whether your existing resources, margins and budget can support your ambitions. The first conversation shouldn't be about what an agency wants to sell you. It should be about what your business actually needs. If an agency hasn't established why you are struggling, how can it confidently recommend the solution? Be Cautious of Shopify Marketing Agencies Providing Fixed Costs Without Reviewing Your Current Setup Every agency needs to have a commercial model, and there's nothing wrong with discussing indicative pricing early. However, we'd be cautious of any Shopify marketing agency that provides a detailed, fixed proposal promising specific outcomes without properly reviewing your existing marketing setup. For example, imagine contacting three agencies about your Google Ads performance. One immediately offers you a £1,500 monthly management package. Another recommends increasing your advertising budget by 30%. The third asks for a discovery call, discusses your commercial challenges and requests access to review your current campaigns before proposing a strategy. Which approach gives you greater confidence? The reality is that without understanding your current performance, an agency is making assumptions. What Should a Shopify Marketing Audit Include? Depending on your requirements, an initial review might include: Google Ads and paid media: Campaign structure, search terms, bidding strategies, conversion tracking, product feeds, budget allocation, attribution and return on advertising spend. Shopify SEO: Organic search visibility, technical SEO, collection and product page optimisation, keyword rankings, content performance, site architecture and potential opportunities across Google and AI-powered search. Conversion rate optimisation: Customer journeys, mobile usability, product pages, checkout behaviour, conversion rates, average order value and areas where visitors may be abandoning their journey. CRM and customer retention: Email marketing performance, automated lifecycle flows, customer segmentation, repeat purchase behaviour and opportunities to improve customer lifetime value. Analytics and measurement: GA4, Google Tag Manager, conversion accuracy, reporting, channel performance and whether the data being used to make decisions can actually be trusted. You can learn more about how these channels work together through our Shopify marketing services. A comprehensive technical audit or detailed strategic consultancy may reasonably be a paid service, particularly when substantial specialist time is involved. However, there is an important difference between charging for an agreed piece of consultancy and proposing ongoing marketing investment without first establishing what needs to change. An agency should be able to explain what it has reviewed, what it has identified and why its proposed investment makes commercial sense. Does the Shopify Agency Understand the Outcomes You Actually Want to Achieve? Increasing traffic isn't necessarily a successful outcome. Neither is improving Google Ads clicks, increasing impressions or achieving better keyword rankings in isolation. These metrics have their place, but they don't always tell you whether your business is becoming more profitable. Before recommending an ecommerce growth strategy, a good agency should establish what success actually looks like for your brand. For example: Your challenge The commercial outcome you may want Rising Google Ads costs Lower customer acquisition costs and more profitable sales Poor organic search visibility More relevant, high-intent organic traffic and revenue High website traffic but low sales Improved ecommerce conversion rate Customers rarely purchasing again Higher repeat purchase rates and customer lifetime value Poor-performing product pages Better engagement, add-to-cart rates and conversions Heavy reliance on paid advertising A more balanced, sustainable customer acquisition strategy High revenue but disappointing profits Improved contribution margins and marketing efficiency The agency should then work backwards from these outcomes. If your ambition is to double online revenue over the next 12 months, that's an important starting point. But is it achievable? What does your current revenue look like? How much traffic are you generating? What's your average order value? What are your margins? How much additional investment can the business realistically support? An agency should be comfortable discussing these questions, even when the answers challenge your original expectations. It's better to have an honest conversation before entering a partnership than spend six months discovering your original objectives were never commercially realistic. Look for an Agency That Challenges Your Thinking, Not One That Agrees With Everything It's natural to want an agency that feels enthusiastic about your business. But enthusiasm and agreement aren't the same as expertise. A strong Shopify marketing partner should be prepared to challenge your assumptions when the data suggests a different approach. For example, you might believe you need more traffic. But what if your existing customers are abandoning their baskets because your delivery proposition isn't competitive? You might want to double your Google Ads budget. But what if conversion tracking is inaccurate, meaning the campaigns are being optimised towards the wrong outcomes? Or perhaps you want to invest heavily in SEO when your immediate challenge is customer retention. A good agency should feel comfortable explaining why a different strategy may deliver a stronger commercial return. At Lionheart Marketing, we believe recommendations should be supported by evidence and a clear understanding of the business. Sometimes that means recommending investment in a new channel. Other times, it means suggesting that you fix what isn't working before spending more money attracting visitors to your website. You aren't employing an agency simply to agree with you. You're partnering with specialists who should help you make better decisions. Should Your Shopify Marketing Agency Have Experience in Your Industry? Industry experience can absolutely be an advantage. An agency that has worked with similar ecommerce brands may already understand relevant customer behaviours, seasonal demand, competitive pressures and which marketing channels tend to perform well. However, we don't believe that experience in your exact industry should automatically be the deciding factor. A Shopify SEO agency that has worked primarily with fashion retailers may still have the technical expertise, commercial understanding and problem-solving skills to support a homeware or health and beauty brand. The fundamentals of ecommerce growth often remain similar. Customers need to discover your products, understand your proposition, trust your business and feel confident enough to purchase. What changes is the audience, their buying motivations, the competitive environment and the channels that influence their decisions. The Questions That Matter More Than Industry Experience Rather than simply asking whether an agency has worked in your sector, consider asking: How would you approach understanding our customers and their buying behaviour? Which marketing channels would you investigate first, and why? How would you identify the biggest opportunities for our business? What challenges have you solved for brands with similar commercial problems? How would you prioritise activity against our available budget? What would you need to understand before recommending a strategy? A good agency should be able to explain its approach clearly, even if it hasn't previously worked with a business selling exactly the same products. Industry experience is a positive. Understanding the challenge, identifying its causes and building the right solution is essential. Frequently Asked Questions About Choosing a Shopify Marketing Agency Does a Shopify Marketing Agency Need Experience in My Industry? Not necessarily. While experience in your industry can be beneficial, it shouldn't be the deciding factor when choosing a Shopify marketing agency. An agency that understands Shopify, customer behaviour, ecommerce marketing channels and the challenges affecting online growth can often deliver excellent results across multiple industries. What matters most is whether the agency takes the time to understand your target audience, identifies the reasons behind your current challenges and develops a strategy designed to overcome them. Relevant industry experience is a bonus. Strong commercial understanding, problem solving and the ability to develop the right solution are essential. Should a Shopify Marketing Agency Audit My Website Before Providing a Quote? A reputable Shopify digital marketing agency should take time to understand your current website performance, marketing activity and commercial objectives before recommending a detailed strategy or ongoing investment. This might involve reviewing Google Ads, SEO performance, conversion tracking, website usability, customer journeys and existing analytics. While some agencies charge for comprehensive marketing audits, at Lionheart Marketing we believe an initial review is an important part of establishing whether we're the right fit. Following a successful discovery conversation, we're happy to invest some of our own time investigating the relevant platforms before making recommendations. We want to understand the challenges and identify potential opportunities before asking a business to commit to working with us. How Do I Know Whether a Shopify Marketing Agency Is Delivering Results? Success should be measured against the commercial outcomes agreed at the beginning of the partnership, rather than marketing metrics alone. Website traffic, keyword rankings and advertising clicks provide useful insights, but they don't necessarily demonstrate profitable ecommerce growth. Depending on your business objectives, more meaningful measurements might include: Increased ecommerce revenue and profitability Improved Shopify conversion rates Lower customer acquisition costs Higher average order values Increased organic search revenue Improved return on advertising spend Stronger customer retention and repeat purchase rates Increased customer lifetime value A good Shopify marketing agency should provide transparent reporting, explain what's working, identify what's not and clearly communicate what actions are being taken to improve results. How Long Does It Take for Shopify Marketing to Deliver Results? The time required to achieve meaningful results depends on your starting position, competition, marketing channels, available budget and the challenges you're trying to overcome. Google Ads and paid advertising can begin generating relevant traffic relatively quickly, although achieving consistent, profitable performance often takes testing and optimisation. Shopify SEO typically requires a longer term approach, particularly in competitive markets where improving organic visibility involves technical improvements, content optimisation and building search authority. Conversion rate optimisation and customer retention strategies can also deliver measurable improvements, but results depend on traffic volumes, customer behaviour and the opportunities identified. A trustworthy Shopify digital marketing agency should explain realistic timescales, the factors that could affect performance and what progress you should expect at different stages of the partnership. Be cautious of any agency guaranteeing specific results within a fixed timeframe before understanding your current performance and commercial objectives. Check Reviews, But Don't Stop at Google Ratings Online reviews are an important starting point when evaluating a Shopify digital marketing agency. They can help you understand how an agency communicates, how clients feel about its service and whether it delivers on its commitments. But a five-star rating shouldn't be the only deciding factor. Look at what clients are actually saying. Do reviews mention transparency, communication, commercial understanding, proactive recommendations and the quality of the working relationship? Or are they simply short comments with little detail? Ask to Speak to Existing Clients This is something we feel particularly strongly about. In our eyes, a positive sign is an agency that openly offers to introduce you to existing clients rather than waiting for you to request references. Ideally, you should have the opportunity to speak with a handful of clients across different industries, business sizes or service types. Why? Because it allows you to understand how the agency adapts its approach to different challenges rather than simply following the same process with every client. When speaking to references, ask about their experience beyond the results shown in case studies. How responsive is the team? How are challenges communicated? Does the agency make proactive recommendations? What happens when something doesn't go to plan? And perhaps the most valuable question of all: Would you choose to work with this agency again? Not every client will be available to speak, and confidentiality should always be respected. However, an agency's willingness to facilitate genuine conversations with its clients can be an excellent indication of confidence in its relationships. Ask for Case Studies That Explain the Challenge, Strategy and Outcome Case studies should offer more than screenshots of advertising dashboards or impressive percentage increases. A Google Ads campaign showing a 200% increase in traffic might look fantastic. But what happened to revenue, conversion rates, customer acquisition costs and profitability? Did the business achieve the outcome it originally wanted? A useful ecommerce marketing case study should explain four things: The challenge: What problem was the client experiencing? The cause: What was preventing the business from achieving its objectives? The solution: What did the agency change, and why? The outcome: What measurable difference did those changes make? For example, our work with All About Party Bags focuses on helping an ecommerce retailer improve organic visibility and paid advertising performance in a competitive market. By combining SEO with Google Ads, the strategy focused on attracting customers searching for relevant products and improving overall ecommerce performance. Case studies don't always need to be from your exact industry. What matters is whether the agency can demonstrate a repeatable approach to diagnosing challenges and delivering meaningful improvements. Be cautious of agencies that showcase impressive results without explaining what created them or how those results were measured. Does the Agency Understand the Entire Shopify Customer Journey? Many ecommerce businesses invest heavily in customer acquisition. They spend thousands on Google Shopping, Performance Max, Meta Ads and SEO to drive more visitors to their Shopify store. But what happens when those visitors arrive? If product pages are confusing, delivery information is unclear, the mobile experience is frustrating or customers struggle to find what they're looking for, increasing traffic may simply increase wasted marketing spend. This is why a joined-up Shopify marketing strategy matters. An effective agency should understand the relationship between: Discovery: How customers find your business through Google, AI-powered search, paid advertising, social platforms and other acquisition channels. Consideration: How customers explore products, compare alternatives, evaluate reviews and decide whether your brand meets their needs. Conversion: How your website experience, product information, delivery options, pricing and checkout influence purchasing decisions. Retention: How email marketing, CRM, loyalty and customer experience encourage repeat purchases. This doesn't necessarily mean one agency needs to deliver every service. However, the agency should understand how its work affects the wider customer journey and collaborate effectively with other specialists. For brands that need ongoing website improvements, our Shopify Priority Support combines design, development and conversion-focused improvements with a structured growth roadmap. The goal isn't simply to increase the number of visitors arriving at your website. It's to improve the commercial value generated from those visitors. Make Sure the Commercials Are Transparent and Realistic Once an agency has reviewed your current performance and established what you want to achieve, the next conversation should be about investment. And this is where transparency really matters. A good Shopify marketing agency should clearly explain: What services are included within the proposed monthly fee. What activity will be delivered and how priorities are determined. Who will be responsible for managing your account. Whether work is completed in-house or outsourced. What additional advertising, software or development costs may apply. How performance will be measured and reported. What contract terms, notice periods and review points apply. What assumptions the proposed outcomes depend on. You should also understand what you are being asked to invest in and why. For example, if an agency recommends spending £5,000 a month on Google Ads alongside a management retainer, it should be able to explain the commercial rationale. Does your business have the margin to support that investment? Is there enough relevant search demand? Will your Shopify website convert the additional traffic effectively? What needs to happen for the investment to become sustainable? These are more valuable conversations than simply comparing which agency offers the lowest monthly retainer. The cheapest agency isn't necessarily the best value, and the most expensive agency isn't automatically the most capable. The right investment is one that fits your business, addresses your challenges and provides a credible route towards your commercial objectives. Red Flags to Watch for When Choosing a Shopify Digital Marketing Agency Not every warning sign automatically means an agency is unsuitable, but certain behaviours should encourage you to ask more questions before signing a contract. Potential red flag Why it matters Offering a detailed strategy and fixed fee before reviewing your current setup Recommendations may be based on assumptions rather than evidence Guaranteeing specific Google rankings or revenue growth Search performance and customer behaviour cannot be guaranteed Pushing every available marketing service You may end up paying for channels that aren't your current priority Focusing only on clicks, traffic or impressions These metrics don't necessarily reflect commercial success Being unwilling to explain recommendations You should understand where your investment is going Avoiding client references or meaningful case studies It becomes harder to validate delivery experience Not discussing margins, budgets or commercial objectives The agency may be focused on marketing activity rather than profitable growth Providing vague reports without clear actions You may struggle to understand progress or identify next steps Unclear account access and ownership You risk losing control over valuable advertising accounts, analytics and business data Promising rapid results without explaining risks Expectations may not reflect the time required to achieve meaningful improvements   One of the biggest red flags, in our opinion, is an agency that appears more interested in getting a contract signed than establishing whether it can genuinely help the business. How We Approach New Shopify Marketing Partnerships at Lionheart Marketing At Lionheart Marketing, we take a slightly different approach to new client relationships. We don't believe every enquiry should automatically become a client. And we certainly don't believe every ecommerce business needs the same combination of SEO, PPC, paid social, CRM or conversion optimisation. Our starting point is a discovery conversation. We want to understand your business, the challenges you're experiencing, why those challenges exist and, most importantly, what you're trying to achieve. If we believe there is a potential fit following that conversation, we'll invest some of our own time reviewing the relevant platforms and existing setup. Depending on your requirements, that might involve looking at Shopify, Google Ads, GA4, Google Search Console, your SEO performance or your current customer journey. This isn't intended to replace a full technical audit or a comprehensive paid consultancy project. It's about doing enough meaningful due diligence to establish whether we understand the challenges, can identify a credible approach and believe we're the right people to help. Why Do We Invest Our Own Time Before a Partnership? Because we believe it's the right thing to do. We want to feel confident in the recommendations we're making before asking another business to invest its marketing budget with us. And we want you to feel equally confident in our understanding, our proposed approach and the commercials. Sometimes that initial review highlights opportunities we believe we can help with. Sometimes it identifies issues that should be addressed before investing in additional marketing. And occasionally, it becomes clear that we're simply not the right agency for the business. If that happens, we'd rather be upfront and, where possible, recommend someone better suited to the requirements. That might mean another specialist agency, a different service provider or an alternative approach. We're interested in building the right partnerships, not simply increasing the number of clients on our books. For us, a successful agency relationship starts with mutual confidence, transparency and a shared understanding of what success should look like. Questions to Ask a Shopify Marketing Agency Before Signing Before committing to a Shopify marketing retainer, we'd recommend having an open conversation around the following questions. What do you believe are the biggest challenges currently holding our ecommerce business back? What have you reviewed to reach those conclusions? Why are you recommending these particular marketing channels? What would you prioritise during the first 90 days? What commercial outcomes do you believe are realistic, and what assumptions support them? How will you measure success beyond traffic and advertising metrics? Can we speak with existing clients about their experience? What happens if the proposed strategy isn't delivering the expected results? Who will actually be working on our account, and how will we communicate? If you felt your agency wasn't the right fit for our business, would you tell us? The quality of the answers should tell you far more than a polished sales presentation. An agency doesn't need to have every answer immediately. In fact, it's often reassuring when someone is prepared to say they need to investigate something further before making a recommendation. What matters is that their approach gives you confidence. Choosing the Right Shopify Marketing Agency Is About More Than Marketing Services Finding a Shopify digital marketing agency shouldn't simply be a process of comparing SEO retainers, PPC management fees or the number of services included in a proposal. It's about finding a partner that understands your business and can explain how its recommendations will help overcome the challenges preventing you from achieving your objectives. Look for an agency that asks thoughtful questions, reviews your existing performance, challenges assumptions and demonstrates genuine interest in your commercial outcomes. Check its reviews, ask to speak with clients and understand how it approaches different industries and business models. Most importantly, make sure you're comfortable with both the strategy and the investment. Because the right agency relationship should give you more than marketing activity. It should give you clarity on your challenges, confidence in the direction you're taking and a realistic plan for improving ecommerce performance. Looking for a Shopify Marketing Agency That Takes the Time to Understand Your Business? At Lionheart Marketing, we work with ecommerce brands looking to improve their search visibility, reduce wasted advertising spend, increase conversions and build stronger customer retention. Our Shopify marketing services bring together SEO, Google Ads, paid media, CRO, CRM and ecommerce growth strategy. But before recommending any of those services, we want to understand your business and what you're trying to achieve. If there's a good fit, we'll explain where we believe the opportunities are and how we can help. If there isn't, we'll be honest about that too. Let's have a conversation about your challenges, your growth ambitions and what a realistic route forward could look like. Speak to Lionheart Marketing about your Shopify growth strategy.

For UK eCommerce brands, getting customers to checkout is only part of the challenge. Getting them to complete their purchase is where the real opportunity lies. Customers increasingly expect flexibility when it comes to delivery. Whether they're working during the day, regularly away from home or simply prefer collecting parcels at a convenient location, delivery options can influence whether someone completes their order. Shopify has introduced an update that could help UK merchants improve this part of the customer journey. As of 15 October 2026, Shopify merchants can offer Royal Mail pickup points directly at checkout, allowing customers to choose a convenient collection location rather than relying solely on home delivery. For businesses already using Royal Mail, this creates another opportunity to improve the shopping experience and remove potential friction at one of the most important stages of the customer journey. Let's explore what's changed, how it works and what it could mean for your Shopify store. What Are Shopify Royal Mail Pickup Points? Shopify has added Royal Mail as a supported pickup point provider across the UK, giving eligible customers the option to collect their orders from a convenient location. Rather than relying exclusively on home delivery, customers can select a Royal Mail collection point during checkout. Customers can: View available Royal Mail pickup points using an interactive map or list. Select a convenient collection location. See the pickup point's name and address. Check opening hours before choosing a location. View the delivery price before completing their purchase. The functionality is integrated directly into Shopify checkout, making delivery selection part of the existing purchasing journey. For merchants, this means customers have greater control over where they receive their orders without needing to organise collection separately after purchasing. You can read the full announcement in the Shopify Changelog. How Royal Mail Pickup Points Could Improve Shopify Checkout Conversion Rates Delivery is an important part of the customer experience, yet it is often overlooked when merchants investigate poor conversion rates. A store might have strong product photography, competitive pricing and an effective marketing strategy, but customers can still abandon their purchase when the available delivery options don't suit their needs. Here are five ways Royal Mail pickup points could help improve the customer journey. 1. Give Customers More Flexibility at Checkout Not every customer wants their order delivered to their home address. Some may work long hours, live in shared accommodation or be unavailable during standard delivery times. Others may prefer collecting their order while shopping or travelling. Offering Royal Mail pickup points introduces another delivery option that accommodates different lifestyles. For Shopify merchants, this means customers who may previously have hesitated because of delivery restrictions now have an additional way to receive their purchases. The potential benefit: Fewer customers reaching checkout and leaving because the available delivery options don't suit them. 2. Reduce Friction During the Shopify Checkout Journey A complicated checkout can introduce unnecessary barriers between customers and completing their purchases. If shoppers cannot find a convenient delivery option, they may postpone their order, search for alternatives or abandon checkout entirely. Shopify's Royal Mail integration allows customers to explore available collection points without leaving the checkout journey. The ability to view collection locations, opening hours and delivery costs in one place makes it easier to understand the available options. This is particularly valuable for customers purchasing on mobile devices, where keeping the checkout journey simple is important. At Lionheart Marketing, we regularly emphasise the importance of reviewing the entire customer journey through our Shopify website design and development services. Small improvements across product pages, navigation, delivery information and checkout can collectively contribute to a better shopping experience. 3. Help Customers Make More Confident Delivery Decisions Uncertainty can be a barrier to purchasing online. Customers want to know where their order is going, how much delivery costs and whether the collection arrangements will work for them. With the new Royal Mail pickup point functionality, customers can review the location's address, opening hours and associated price before committing to a delivery option. Providing this information at the point of purchase may help customers make a more informed decision. For merchants, clearer delivery information also presents an opportunity to manage customer expectations and reduce avoidable delivery-related enquiries. 4. Offer an Alternative to Missed Home Deliveries Missed deliveries can create inconvenience for customers and additional administration for eCommerce teams. A customer might be unavailable when a parcel arrives, requiring further delivery arrangements or collection. Offering Royal Mail pickup points gives customers the opportunity to choose a collection location from the beginning. For customers who already know they won't be home, this could be a more convenient solution. However, merchants should remember that collection point delivery doesn't eliminate all delivery issues. Parcels still need to be collected within the permitted timeframe. 5. Create Opportunities to Reduce Checkout Abandonment One of the biggest opportunities for eCommerce brands is improving conversion rates from the traffic they already generate. Businesses often invest significantly in SEO, Google Ads and paid social to attract potential customers. However, if customers abandon their purchase because of limited delivery options, that investment may not deliver its full potential. Royal Mail pickup points provide another opportunity to address customer hesitation. While the feature does not guarantee improved conversion rates, it introduces a practical option worth testing for merchants whose customers value flexible delivery. The key is understanding whether the change improves actual customer behaviour rather than assuming that adding more delivery methods automatically increases sales. Our Shopify growth support services focus on identifying these types of opportunities and making ongoing improvements to the customer journey. How Do Royal Mail Pickup Points Work on Shopify? The new functionality uses Royal Mail's Local Collect service, which supports deliveries to participating Post Office branches and Royal Mail Customer Service Points. Shopify supports two relevant delivery services: Royal Mail Tracked 24 with Local Collect: Next business day delivery. Royal Mail Tracked 48 with Local Collect: Delivery within 1–2 business days. These are Shopify's published service timeframes rather than guaranteed delivery dates. Once a customer selects a pickup point, their order can be delivered to that location for collection. Royal Mail holds uncollected parcels for 18 days before returning them to the sender. This provides UK Shopify merchants with an additional delivery option that can sit alongside their existing home delivery services. Merchants can find more information in the official Shopify Royal Mail shipping documentation. How to Set Up Royal Mail Pickup Points on Shopify For eligible UK Shopify merchants, enabling Royal Mail pickup points can be managed directly through Shopify's shipping settings. Follow these steps: Log in to your Shopify admin. Navigate to Settings > Shipping and delivery. Under Additional delivery methods, select Pickup points. Choose the UK fulfilment location you want to enable. Activate Ship to pickup points from this location. Edit the pickup point shipping rate and select Royal Mail as a provider. Set your preferred delivery charges and save the changes. Shopify allows merchants to configure flat-rate, weight-based or price-based charges for pickup point delivery. You can also offer free pickup point delivery by setting the relevant rate to £0. Once configured, we recommend testing the customer checkout experience to ensure the correct delivery options and charges appear. For full instructions, visit the Shopify Help Centre guide to setting up pickup points. Important Considerations Before Enabling Royal Mail Pickup Points Although the feature creates an opportunity to improve the checkout experience, merchants should review a few important considerations before activating it. Checkout Eligibility Not every order will qualify for pickup point delivery. According to Shopify's documentation: All physical products in the basket must be eligible for fulfilment from one location. That location must have sufficient inventory to fulfil the entire order. Pickup points aren't available when customers use certain accelerated checkout methods, including Apple Pay, Google Pay, Amazon Pay and PayPal. Pickup points aren't available for B2B checkout customers. Orders placed using supported carrier pickup points cannot be edited after purchase. Shipping Restrictions Royal Mail's supported domestic parcel services have package size, weight and product restrictions, so merchants should confirm that their products are suitable. Existing Fulfilment Integrations Businesses already using third-party shipping applications or warehouse management systems should check how pickup point orders will be processed. This is particularly important if your business uses automated shipping rules, external fulfilment partners or app-managed shipping profiles. Shopify notes that pickup point zones do not automatically synchronise with app-managed shipping profiles. Which Shopify Merchants Could Benefit Most? Royal Mail pickup points could be particularly relevant for UK businesses selling products that are convenient for customers to collect locally. Fashion and Accessories Customers purchasing clothing, footwear or accessories may appreciate the option to collect orders around their work schedules. Beauty and Skincare Smaller, lightweight products can be particularly suitable for collection point delivery, provided they meet Royal Mail's shipping requirements. Gifts and Lifestyle Products Customers purchasing gifts may prefer collection from a convenient location rather than delivery to their home. Home and Garden Accessories Merchants selling smaller homeware products could introduce collection as an alternative to standard delivery. The suitability of the service ultimately depends on product dimensions, customer preferences, shipping costs and fulfilment arrangements. How Should Shopify Merchants Measure the Impact on Conversion Rates? Enabling Royal Mail pickup points is a useful starting point, but understanding their impact is where the commercial value lies. At Lionheart Marketing, we'd encourage merchants to monitor several key metrics after implementation. Checkout conversion rate: Are more customers completing purchases after the new delivery option is introduced? Checkout abandonment: Are fewer customers leaving during the checkout process? Delivery method selection: What percentage of customers are choosing Royal Mail pickup points rather than home delivery? Average order value: Are customers selecting collection points spending more or less than those choosing standard delivery? Customer service enquiries: Are delivery-related questions or complaints decreasing? Fulfilment performance: Are collection orders being processed and delivered efficiently? Merchants should also compare performance against an appropriate period before implementation and account for changes in marketing activity, seasonality and product availability. For brands investing in customer acquisition through Shopify marketing, improving checkout performance can help generate more value from existing traffic. After all, attracting more visitors is only useful if your store gives them a positive experience and a reason to complete their purchase. Why This Shopify Update Matters for UK eCommerce Brands At Lionheart Marketing, we see this as another positive development in Shopify's continued focus on improving the merchant and customer experience. It's easy for eCommerce businesses to focus heavily on attracting new customers through SEO, Google Ads and paid social. However, increasing website traffic isn't always the answer to improving revenue. Sometimes, the opportunity is already sitting within the existing customer journey. Customers could be visiting your website, adding products to their basket and reaching checkout, only to abandon their purchase because something doesn't meet their expectations. Delivery flexibility is one potential cause. By introducing Royal Mail pickup points directly into checkout, Shopify is giving UK merchants another way to meet customer expectations. For merchants already using Royal Mail, it's an opportunity worth investigating, particularly if delivery convenience is a recurring concern among customers. The important thing is to approach the update strategically. Understand your customers, review your existing shipping setup, test the functionality and measure whether it delivers meaningful improvements. A better checkout experience isn't just about making purchasing easier. It's about removing the barriers that could be preventing customers from buying. Looking to Improve Your Shopify Checkout Experience? Your Shopify website should do more than attract visitors. It should help turn them into customers. At Lionheart Marketing, we help eCommerce brands improve their Shopify stores through conversion-focused design, development, customer experience improvements and ongoing optimisation. Whether you're reviewing delivery options, experiencing checkout abandonment or looking for ways to generate more revenue from your existing traffic, our team can help identify opportunities for improvement. Explore our Shopify growth support services or get in touch to discuss your store.