Explainer · 7 min read

Can you see a password-protected store's theme?

Usually yes — a locked Shopify store still renders on its live theme. Here's what's visible, what isn't, and why.

You find a promising store, go to scan it, and hit a password wall: "Opening soon." Frustrating — but not a dead end. In most cases you can still tell which theme the store runs, even while the storefront itself is closed. Understanding why comes down to how Shopify's password protection actually works.

How Shopify password protection works

When a store owner switches on password protection, Shopify doesn't swap in some generic holding page. It renders a password page using the store's current, active theme. If the store runs Shrine PRO, the password page inherits Shrine PRO's layout, fonts and colours. And crucially, most themes record their name and version in a small piece of data in the page's public source — and that data is present on the password page just as it is on the full storefront.

That's the whole trick: the theme is doing the rendering, so the theme leaves its fingerprint, password wall or not.

What you can see on a locked store

• Theme name and version — almost always, because the theme is what's rendering the password page.
• Fonts — yes. They're loaded by the theme's public CSS, which the password page uses.
• Colours — yes, for the same reason. You'll see the brand palette even on a "coming soon" screen.
• Platform — yes. The store is still identifiably Shopify from its page structure and server headers.

What you can't see

• Apps. The password page doesn't load the real storefront — no product pages, no cart, no checkout — so the app fingerprints that live on those pages simply aren't present. A detector that claimed to see apps on a locked store would be guessing, so a good one won't.
• Products and pricing. None of the catalogue is exposed.
• Checkout customisations. Anything app-driven in the buying flow is invisible.

A locked store hides its shop, not its skin. You can read the theme, the fonts and the colours — but not the machinery behind the counter.

Why this is genuinely useful

The best use is tracking a launch before it happens. A brand puts up a password page weeks before opening. Scan it now and you already know the theme they've committed to — which hints at how seriously they're investing in design. A store that's chosen an expensive premium theme for a store that isn't even open yet is telling you something about its ambitions.

Then, when the password comes off, scan again. Now you get the full picture — apps, catalogue, the works — and you can compare it against that first read to see what they built during the quiet phase. That before-and-after is a genuinely useful way to study how a brand launches.

Is this intrusive or against the rules?

No — and it's worth being clear about why. Reading a theme name from a password page uses only what the page already sends to every visitor's browser. It's the same information you'd see by right-clicking and choosing "View page source." Nothing here bypasses the password, logs into anything, or accesses private data. The store owner chose to serve that page publicly; a detector just reads what's there. It's research, not a break-in.

When even the theme is hidden

Occasionally you'll scan a locked store and get nothing — not even a theme. Two reasons this happens: the owner has heavily customised the password page template and stripped out the theme data, or the store is running a headless or custom setup where the usual fingerprints don't exist. In those cases an honest detector tells you plainly that the theme isn't exposed, rather than inventing a guess. An empty result is information too — it usually means the store is more custom than average.

Keep reading: every reason a store shows no theme, or what "custom theme" really means.