Hello, My google ads got taken down by google, they were dissaproved, because of Malicious content in my site since 19 May. They say it’s loading external spam websites. After some investigations, I found out that this script is injected through “{{ content_for_header }}” in my theme.liquid file. …

It’s impossible to tell from the code what injects it exactly. An easy and robust way would be to just disable/uninstall apps and then check the storefront.

Well, there is another way – identify all other Javascript files and compare with the list of your apps. Then you can find which one is left. It’s probably not: Printful, Judge.me , Upsell & Cross Sell — Selleasy, Awin, Searchanize, PushOwl?.. Look at what this leaves and you should be able to ge…

Hi Betterave-Nina and Tim, Thank you both so much for your quick and friendly replies — I really appreciated your input and suggestions while I was in the middle of this frustrating situation. I wanted to give you a quick update: with the help of an external developer, I was finally able to trace …

Help identifying were malicious script is loaded from in my source - "some-app"

Technical Q&A

Betterave-Nina June 1, 2025, 1:19pm 5

Hi Jack.

This is very generous of you to not complain about this to support or not mentioning the app here. Makes sense if this wasn’t intentional.

I’m glad that it’s resolved.

Good luck with sales!
Nina

Topic		Replies	Views
What app could be injecting this unknown script? Shopify Apps third-party-apps	2	52	March 19, 2024
How can I identify the source of an external javascript code? Technical Q&A	3	165	November 13, 2024
Urgent: Need help removing malicious code injections (jsdeliver.cloud & brandAgents_js) from Shrine Theme Technical Q&A liquid , third-party-apps , troubleshooting , shopify-theme , cyber-security	7	308	April 1, 2026
Website redirection issue on mobile devices Shopify Discussion troubleshooting	10	179	April 25, 2025
External apps script not getting inserted or loaded Shopify Apps	3	69	June 10, 2021

Help identifying were malicious script is loaded from in my source - "some-app"

Related topics