Shopify Black Friday 2026: The 82-Day Readiness Checklist

Black Friday 2026 falls on Friday, November 27. From today, Sunday, September 6, that’s 82 days, and 85 days to Cyber Monday on November 30. Your Shopify Black Friday countdown starts tomorrow, Monday, September 7, which is Labor Day, and it runs exactly twelve Monday-to-Sunday weeks into Black Friday week.

Two Shopify deadlines that define this season have already passed. Script tags stopped running on non-Plus Thank you and Order status pages on August 26, eleven days before this post published. Shopify Scripts stopped executing on June 30. Neither is something to prepare for, and both are something to audit.

That’s the shape of ecommerce Black Friday planning in September: the expensive failures are already sitting in stores, they’re currently silent, and they cost almost nothing to fix right now. In week eleven they cost a weekend.

One note on sourcing before the checklist. Every number below links to the source it came from. Shopify’s own Black Friday figures are the company’s investor and marketing communications and are labeled that way in the sentence, because a vendor reporting on its own record quarter is not a neutral referee. We won’t re-caveat that in every paragraph.

US Thanksgiving is fixed by statute as the fourth Thursday in November, and the US Office of Personnel Management’s 2026 federal holiday schedule confirms it as Thursday, November 26. Everything else in the weekend follows from that date. Christmas Day 2026 is Friday, December 25.

Cyber Monday 2026 is November 30, which puts it inside November. In 2025 it was December 1 and in 2024 it was December 2, so every piece of calendar copy you recycle from a prior year that says “Cyber Monday in early December” is wrong this season. That includes automated email subject lines, scheduled social copy, banner text with a hardcoded month, and any landing page you plan to reuse.

Thanksgiving 2026 also falls one day earlier than 2025 and two days earlier than 2024. That leaves 28 days between Black Friday and Christmas, against 27 in 2025 and 26 in 2024, the longest such window of the last three years. Thanksgiving can range from November 22 to November 28, so 2026 sits mid-range rather than at an extreme.

Two days of extra selling window is arithmetic, not a forecast. No source we found supports a claim that a longer window produces more revenue, flatter demand, or a later peak, and we’re not going to invent one. What it does support is a fulfillment cutoff calendar with two more days of room in it than the one you built in 2024.

Every row below begins on a Monday. Week 1 begins tomorrow, Monday, September 7, and week 12 begins Monday, November 23, the week that contains Thanksgiving, Black Friday, Small Business Saturday, and Cyber Monday. The “days to Black Friday” column counts from each Monday to Friday, November 27.

Labor Day, Columbus Day and Veterans Day are federal holidays on the OPM schedule linked above, which matters if your warehouse, your 3PL, your freight carrier, or your developer observes them. Three of your twelve weeks are short weeks.

Shopify’s own BFCM checklist, updated August 28, 2026, gives merchants exactly one piece of timeline guidance: “Start preparing for BFCM by early fall, or the beginning of November at the latest.” The page carries 25 steps across seven categories and lists no 2026 BFCM dates at all. Early fall is where you are.

Sequencing is the whole argument of this post, so here’s the position up front: nothing gets built in September until these three are audited. Two of them are consequences of deadlines that already passed, which means they’re not warnings, they’re conditions. The third is a set of hard platform limits that promotions run into on the day.

Shopify’s checkout.liquid documentation states, with no plan qualifier attached, that checkout.liquid and additional scripts “were sunset for the Thank you and Order status pages on August 28, 2025.” It then splits by plan for script tags, which “were sunset on those pages on August 28, 2025 for Plus stores, and are sunset for non-Plus stores on August 26, 2026.” Both of those dates have passed. Stores still on checkout.liquid for those pages must upgrade to Shopify Extensions in Checkout.

The upgrade is not gentle about what it removes. Shopify’s checkout upgrade guide states that “your existing Thank you and Order status pages and any existing customizations on those pages are replaced with the new versions of those pages.” Shopify’s additional scripts documentation is direct about the one-way nature of it: “You can only reactivate an additional script when your Thank you and Order status pages haven’t completed their upgrade. If your Thank you and Order status pages are upgraded, then you can’t reactivate your additional script.”

The failure is silent. Nothing errors, no admin notice appears, and the store keeps taking orders. What changes is that a purchase event stops arriving at one or more destinations, and the first place you notice is a conversion report that looks a little soft in a month where a lot of things look soft.

Shopify’s documented replacement path is app pixels, described on that same additional scripts page as “the recommended solution,” with custom pixels as the fallback “if there isn’t an app that meets your needs.” To see what you had before the upgrade, the Upgrade guide page in your Shopify admin has an Additional scripts section. We wrote the full audit procedure in our post on the August 26 conversion tracking sunset, so run that rather than re-deriving it here.

One constraint on the replacement to plan around: Shopify’s pixels overview documents that “pixels sandboxes can’t render user interface elements, such as buttons, forms, banners, or modals,” and that they can’t automatically detect email or phone through form scraping, outbound link clicks, page scrolling, or heatmap interactions. If your old additional script did any of those things, a pixel is not a like-for-like replacement and you need a different mechanism.

Shopify’s Scripts deprecation announcement, dated April 9, 2026, gives two key dates: editing and publishing new Scripts became impossible on April 15, 2026, and on June 30, 2026 “All Shopify Scripts will cease to execute entirely.” Both dates are behind us. Editing has been frozen since mid-April and execution stopped at the end of June.

For a Plus merchant, that has a specific and expensive implication. Any tiered discount, gift-with-purchase rule, spend threshold, shipping-rate customization, or payment-method gating that ran your BFCM 2025 promotion on Scripts stopped working on July 1, 2026. It has to be a Shopify Function or a public app now, and there’s no Scripts path back.

That’s a build, not a settings change, and it’s the single largest piece of work most Plus stores have left this season. We’ve covered the migration mechanics in our guide to checkout extensibility and Shopify Functions, so scope it from there rather than discovering it in week ten.

One documented side effect to note if you use Launchpad. Shopify’s Launchpad considerations page warns that customers can stack discount codes on top of Launchpad sale prices, and offers two mitigations: use a script to prevent code application at checkout, or manually deactivate the codes. The first mitigation no longer exists. Deactivating codes is what you have.

Shopify’s discount combinations documentation publishes three hard numeric limits: a maximum of 5 product or order discount codes per order, a maximum of 1 shipping discount code per order, and a maximum of 25 active automatic discounts. The 25 figure lines up with Shopify’s November 21, 2024 changelog, which raised the limit on automatic app-based discounts “from 5 to 25” so developers could run “a larger number of concurrent discount campaigns,” each with its own start and end dates.

Twenty-five sounds generous until you count what a real BFCM promotion calendar contains: a sitewide tier, three or four category doorbusters, a free-shipping threshold, a VIP-segment offer, a bundle, an early-access window, and a Cyber Monday replacement for all of it. Automatic discounts with start and end dates are how you schedule that without a human clicking at midnight, and they consume the same 25 slots.

The combination matrix from the same Shopify page decides whether your stack works at all.

Read the eligibility gate on that page carefully, because it connects back to the first problem. Shopify states that to use the eligible-merchant combinations, your store “must not use checkout.liquid customizations or features,” and cannot use the Licensify app. A store that never completed its checkout upgrade is locked out of product-plus-order and order-plus-order stacking, which is the exact mechanic most sitewide-plus-doorbuster promotions depend on.

Two more documented behaviors change what your promotion actually charges. Shopify’s application order is fixed: “Product discounts apply first to individual items. Order discounts apply to the revised subtotal after product discounts. Shipping discounts apply last.”

For stacked percentage order discounts, “both percentages are calculated on the original subtotal,” so 10% plus 20% is 30% off rather than 28%. Discounts also don’t combine automatically; combination eligibility has to be configured explicitly on each one.

Shopify announced in its December 2, 2025 press release, also filed with the SEC as an exhibit to a Form 8-K, that its merchants did a record $14.6 billion over Black Friday-Cyber Monday weekend, up 27% year over year and 24% on a constant currency basis. That’s the company’s own reporting on its own platform.

The footnote is where the number becomes usable, and Shopify publishes it plainly.

So $14.6 billion is global, not US. It’s gross merchandise volume, not revenue. It includes shipping and handling, duty, and VAT, net of refunds. Anyone quoting it as “Shopify made $14.6 billion” or “US shoppers spent $14.6 billion on Shopify” is quoting something Shopify did not say.

Shopify’s other figures from that release are similarly specific. Shopping “peaked at 12:01pm EST on Black Friday when sales reached a record $5.1 million per minute.” Average cart price was $114.70, or $112.29 on a constant currency basis, and Shopify’s phrase is “average cart price,” not average order value. More than 94,900 merchants had their highest-selling day ever, and 15,800 or more entrepreneurs made their first sale. Cross-border orders were 16% of all global orders, and 32% of orders used Shop Pay, with Shop Pay sales up 39% year over year.

Here’s our own arithmetic off two of those Shopify figures, and the assumption is stated so you can reject it: $5,100,000 divided by an average cart price of $114.70 implies roughly 44,500 orders in that peak minute, if the weekend average held during the peak. Set that against what Shopify says it provisions for. In its BFCM 2025 engineering readiness post, Shopify describes five major scale tests run April through October, with a final test reaching 200 million requests per minute and an earlier one hitting 146 million requests per minute and 80,000-plus checkouts per minute.

Those are Shopify’s own load-test numbers, and a checkout is not an order, so the two figures don’t map one to one. What they do suggest is that the platform’s tested checkout ceiling sits meaningfully above the busiest real minute it has published. That engineering post contains no directives to merchants, by the way. It’s a description of what Shopify does to Shopify, and it should not be read as a readiness checklist for your store.

Two things Shopify did not publish for BFCM 2025: a mobile versus desktop split, and a conversion rate. If you’ve seen a Shopify mobile-share statistic circulating, it did not come from this release.

Salesforce reported on December 5, 2025 that global Cyber Week spend hit $336.6 billion, up 7% year over year, with US spend at $79.6 billion, up 5%. Its methodology covers “more than 1.5 billion global shoppers across more than 89 countries, with a focus on 18 key markets.” Inside that release is the most operationally useful number of the 2025 peak.

Average selling price rose 6% year over year. Global order volumes rose 2%, and US order volumes rose 1%. Almost all of the spend growth was price.

Our arithmetic, and Salesforce doesn’t publish the reconciliation: a 6% price increase applied to a 2% volume increase multiplies out to about 8%, and Salesforce reports 7% spend growth, so the components don’t tie exactly. That’s normal for separately computed aggregates over different mixes of markets and categories. The direction survives the discrepancy regardless, because the price component is three times the volume component.

Draw the operator’s conclusion. A plan built on “we’ll move a lot more units this year” was planning for something the market did not deliver in 2025. The capacity you needed was not order throughput. What moved was the value per order, which means merchandising, bundling, threshold design, and attach rate did more work than throughput did.

That reframes the discount question too. Adobe reported peak Cyber Monday discounts of 31% off for electronics, 28% for toys, and 25% for apparel in its Cyber Monday 2025 release. A merchant cutting deeper than that to buy units, in a market where units grew 2%, is funding a price reduction rather than growth. Note that Adobe measures US online transactions only and Salesforce measures its own customer base across 89 countries, so those two figures sit side by side rather than combining into anything.

The rest of Adobe’s US online picture: Cyber Monday 2025 came in at $14.25 billion, up 7.1%, with consumers spending $16 million every minute between 8pm and 10pm. Black Friday was $11.8 billion, up 9.1%, Thanksgiving was $6.4 billion, up 5.3%, and the five-day Cyber Week totaled $44.2 billion, up 7.7%. Adobe’s full-season release in January 2026 put November 1 through December 31 at a record $257.8 billion, up 6.8%, with 25 days exceeding $4 billion against 18 such days in 2024.

Mastercard SpendingPulse measures a third universe: in-store and online US retail across all payment types, excluding automotive. Its Black Friday 2025 release put US Black Friday retail up 4.1% year over year, with ecommerce up 10.4% and in-store up 1.7%. And the NRF’s shopper survey, released December 2, 2025, counted a record 202.9 million shoppers across the five days, with average spend on holiday items of $337.86 per person, up from $315.56. That last one is a consumer survey of 3,099 adults conducted November 26 to 30, with a margin of error of plus or minus 1.8 percentage points, not transaction data.

When we checked in the first week of September 2026, two 2026-season forecasts existed. Bain published on September 3, 2026 that US November-December holiday retail sales will exceed $1 trillion for the first time, growing 4.5% year over year in nominal terms against the 3.5% recorded in 2025, with nonstore retail up 9% and generating about 60% of overall sales growth. Bain also says “more than half of the nominal sales growth will come from higher inflation.”

That qualifier is not optional. If more than half of 4.5 points is inflation, real growth is under 2.25%, and Bain does not publish the real figure. Anyone quoting 4.5% growth without the inflation note is quoting a bigger number than Bain forecast. Bain’s methodology is a Consumer Lab survey of more than 1,100 consumers.

The second is eMarketer’s February 2026 forecast of roughly 2.6% US retail growth and 6.6% ecommerce growth for the 2026 holiday season, published seven months before this post and subject to revision. That article also carries one hard 2025 data point: TikTok Shop did $500 million in US GMV over the four-day BFCM period, with a 50% increase in buyers.

NRF, Adobe, Deloitte and Salesforce had not published 2026 holiday forecasts when we checked. NRF has published a full-year 2026 forecast of 4.4% US retail growth, which is not a holiday number. Historically those four land between late September and early November, which is weeks four through nine of your runway.

You have to commit your inventory buy, your promotional depth, and your media budget before most of the season’s forecasts are published. That’s an argument for building your plan around your own 2025 store data rather than around a market number you’re still waiting on.

September is for auditing and deciding, not building. Our position on sequencing: every hour spent in September on something you’ll ship in October is an hour you don’t get back in November, and the audit findings determine what October’s build actually is. Run these four weeks in order.

Week 1, beginning Monday, September 7, 81 days out. Audit the tracking. Place a real test order and confirm the purchase event arrives at every destination you spend money against: GA4, Meta, Google Ads, Klaviyo, and any attribution tool. Shopify’s Web Pixels standard events reference names the event to look for, checkout_completed, and Shopify’s help documentation confirms that “Pixels automatically load on the Storefront, Checkout, Thank you page, and Order status page.” Manage them under Customer events in the admin.

Check consent gating in the same pass, because it produces the same symptom with a different cause. Shopify’s pixel privacy documentation states that “Shopify’s pixel manager will only load your pixel if there is visitor permission for all of the settings that your pixels declares as required.” A pixel declaring a marketing requirement simply doesn’t load for a shopper who declined marketing consent, and it doesn’t throw an error while not loading.

There’s one more documented quirk that produces wrong data rather than missing data. Shopify notes that in the Lax sandbox used by custom pixels, “automatic detection of page URLs include a sandbox version and not exactly reflect the main window’s URL.” If your GA4 page paths look strange, that’s a candidate explanation.

Week 1, second task. Check your Meta data-sharing level. Shopify’s Meta data sharing documentation describes three levels. Standard uses the browser pixel only, and Shopify states plainly that “a browser-based ad blocker can prevent the Meta pixel from sharing data.” Enhanced and Maximum both add the Conversions API, which “sends the purchase event between Shopify and Facebook servers” and isn’t blocked by browser ad blockers.

A store sitting on Standard is feeding browser-only signal into the four highest-CPM days of its year. Checking the setting takes a minute in the admin. Shopify’s requirements are a connected Meta pixel and an updated store privacy policy disclosing the data practices, so loop whoever owns your policy language in now rather than in November.

Week 2, beginning September 14, 74 days out. Inventory your promo mechanics. Write down every discount and shipping rule that ran during BFCM 2025 and mark which ones were Shopify Scripts. Everything in that column is a build. Then count your planned 2026 automatic discounts against the 25 active limit and check each intended stack against the combination matrix above, including the checkout.liquid eligibility gate.

Week 3, beginning September 21, 67 days out. Audit oversell risk, variant by variant. Shopify’s selling-when-out-of-stock documentation describes a single toggle, “Continue selling when out of stock,” set per product or variant in the Inventory section, which requires inventory tracking to be on. That toggle is the difference between a stockout and an oversell, and on a large catalog it’s usually been flipped by three different people over two years.

The same page documents a multi-location behavior that catches merchants the other direction. If the fulfilling location has zero stock but another location holds stock without fulfillment enabled, “that item is still displayed as out of stock to customers on your online store.” So a variant can read as sold out on Black Friday while inventory sits in a location you never enabled.

Shopify’s documentation does not describe when inventory is reserved during checkout, and we’re not going to fill that gap with a guess. Plan buffers on the toggle you can actually see and control.

Week 4, beginning September 28, 60 days out. Establish your speed baseline and back up your theme. Google’s Core Web Vitals thresholds are 2.5 seconds for LCP, 200 milliseconds for INP, and 0.1 for CLS, measured at “the 75th percentile of page loads, segmented across mobile and desktop devices.” Record where you sit today so you can tell in November whether an app or a theme change moved it. The remediation work belongs in our Shopify speed optimization guide rather than here.

Back up the theme before anything else touches it. Shopify’s theme duplication documentation recommends making a backup copy before customizing, and sets a hard maximum of 20 themes per store. At the cap you have to delete one before duplicating, and deletion is permanent, so clear out last year’s abandoned experiments in September rather than at 11pm on November 26.

October is the build, and it’s the only month where a build is safe. Ship in October, test in early November, freeze after that.

Week 5, beginning October 5, 53 days out. Rebuild what Scripts used to do. Anything on your week 2 Scripts list becomes a Shopify Function or a public app, and Shopify’s Discount Function API reference is the starting point. Budget for real testing rather than just deployment, because a discount Function that computes the wrong subtotal is a pricing bug that ships at full traffic.

Week 6, beginning October 12, 46 days out. Wire the automations, and get the plan availability right. Shopify Flow is “a free app available on the Basic, Grow, Advanced, and Plus plans,” per Shopify’s Flow documentation. Flow is not Plus-only, despite how often it’s described that way.

Two plan deltas do exist: the Send HTTP Request action is available on Grow, Advanced and Plus but not Basic, and custom partner app tasks are Plus-only. Flow’s usage limits track each plan’s API rate limits.

Launchpad is a different story. Shopify states that “the Launchpad app is available only to stores on the Shopify Plus plan,” and its considerations page lists constraints that break real BFCM schedules.

You can’t run or schedule overlapping events. Events must begin at least five minutes after the previous one ends. No collection added to an event may contain more than 1,000 products.

Three more Launchpad behaviors to design around, all from the same page. Prices you edit during an event revert to their pre-event value when the event ends, which applies to price and compare-at price. A discount set on a gift card reduces the value of the gift card itself. And activating a password page through Launchpad removes existing store password pages and does not restore them when the event ends.

Shopify’s Launchpad event documentation covers what it can automate, including pricing, channel availability, inventory levels, and theme customizations.

Week 6, second task, Plus only. Request bot protection now if you’re planning a drop. Shopify’s bot protection documentation describes a Plus-only feature that isn’t self-serve: merchants must contact Shopify Plus Support to have it enabled. Shopify publishes no lead time for that request, so treat “how long does this take” as an open question you should resolve in October rather than in week eleven.

Understand what the feature is before you build a plan around it. The maximum duration of a single event is 60 minutes, only one event can be scheduled at a time, and an event cannot be edited once active, only deactivated. That makes it a product-drop tool, not a four-day shield. Shopify also scopes it explicitly: the feature “isn’t meant to combat forms of fraud that are related to bot activity.”

Separately, a default setting called “Don’t allow bots to auto-complete checkouts” is on for all stores and can be deactivated. That’s a different control from the scheduled Plus feature, and confirming it’s still on costs nothing.

Week 7, beginning October 19, 39 days out. Do the deliverability and segmentation work. This gets its own section below, because the rules are external to Shopify and the consequences outlast the weekend.

Week 8, beginning October 26, 32 days out. Rehearse the whole promotion end to end. Run your actual discounts against a real cart on a duplicated theme, with a real test order, and confirm the stack computes what your margin model assumed. Confirm the purchase event still fires with the discount applied, because a discount app is one of the more common things to break a pixel.

Week 8 is also where conversion work still pays, because there’s time to interpret a result. Checkout friction and product page friction are the two places to spend it, and both have their own treatments: what actually fixes checkout abandonment and five product detail page tests worth running. Halloween falls on Saturday, October 31, at the end of this week, which matters if your team or your 3PL is thin that weekend.

We could not find any Shopify-published code freeze, theme freeze, or app-install freeze recommendation for BFCM. It isn’t in Shopify’s BFCM checklist and it isn’t in Shopify’s engineering readiness post. So what follows is BLKDG’s own operating advice, and you should treat it as ours, not as platform policy.

Week 9, beginning November 2, 25 days out. Last structural changes. Anything that touches theme architecture, checkout configuration, or a discount Function ships this week or it doesn’t ship. A change that lands in week 9 gets two full weeks of real traffic before the freeze, which is enough to surface a problem that only appears under load and only on mobile Safari.

Week 10, beginning November 9, 18 days out. Freeze app installs and app removals. New apps inject scripts, add weight, and occasionally claim the same checkout surface as an existing one. Veterans Day falls on Wednesday, November 11, which shortens the week for anyone whose developer or 3PL observes it. If a Black Friday mechanic depends on a new app clearing Shopify’s review process, know that Shopify publishes no review timeline you can plan against, which makes it an unbounded dependency.

Week 11, beginning November 16, 11 days out. Freeze the theme and the code. From this Monday, the only permitted changes are content: copy, banner text, imagery, product availability, and discount activation. Anything requiring a code deploy waits until December unless it’s fixing something that’s actively broken. Use the week for the full dress rehearsal instead: the promotion, the email, the SMS, the checkout, the receipt, and the tracking, run start to finish with a real card.

Week 12, beginning November 23, 4 days out. Run the book you already wrote. Thanksgiving is Thursday, November 26, Black Friday is Friday, November 27, Small Business Saturday is Saturday, November 28, and Cyber Monday is Monday, November 30.

Every discount that goes live and every email that sends should already exist, already be scheduled, and already have been tested by the Friday before.

The one thing to staff live is monitoring, not building. Someone should be watching order flow, inventory on the doorbusters, and the conversion event in your analytics, with a documented decision about who can deactivate a discount code and how fast.

Klaviyo publishes a day-by-day BFCM cadence in its Academy sending guide. It’s the vendor’s own recommendation, and the vendor sells sending volume, so read it as a starting point rather than a rule.

That’s eleven emails and eight messages across five days, against 30, 60 and 90-day engagement segments plus persona segments. The cadence is only survivable if the segmentation underneath it is real, which is week 7 work, not week 12 work. Our view on which flows deserve the volume is in our guide to the Klaviyo flows that pay rent.

The rules that actually constrain you come from the mailbox providers, and one of them is permanent. Google’s sender guidelines FAQ defines a bulk sender as “any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period,” notes that “Messages sent from the same primary domain count toward the 5,000 limit,” and states that “Senders who meet the above criteria at least once are permanently considered bulk senders.” Bulk sender status has no expiration date, and subdomains roll up to the primary domain, so splitting the send across subdomains doesn’t avoid it.

A single Black Friday blast over 5,000 to Gmail addresses makes your brand a permanent bulk sender. That’s not a penalty. It’s a threshold that switches on a stricter requirement set: SPF and DKIM both, DMARC on the sending domain with alignment between the From header domain and the SPF or DKIM domain, and one-click unsubscribe via the List-Unsubscribe and List-Unsubscribe-Post headers alongside a visible unsubscribe link.

DMARC at p=none satisfies the requirement. If you’re going to cross that line on November 27, cross it having already met the requirements in October.

The spam rate is where a bad weekend becomes a bad quarter. Google’s sender guidelines require keeping spam rates in Postmaster Tools below 0.3%, and its own monitoring advice is stricter: keep it below 0.10% and avoid ever reaching 0.30%. The FAQ goes further, stating that “Even today, user-reported spam rates greater than 0.1% have a negative impact on email inbox delivery for bulk senders.” Since June 2024, bulk senders above 0.3% are ineligible for mitigation and become eligible again only when spam rates “remain below 0.3% for 7 consecutive days.”

Seven consecutive clean days is longer than BFCM weekend. Trip the threshold on Black Friday and the earliest recovery window runs past Cyber Monday and into December, which is the part of the season where your remaining margin lives.

Yahoo applies its own rules and they’re not Google’s. Per Yahoo’s sender best practices, the 0.3% spam rate sits under the requirements for all senders rather than the bulk-sender list, and Yahoo honors unsubscribes on a two-day clock, the same window Google recommends. In its sender FAQs, Yahoo explicitly declines to publish a volume threshold: “We will not specify a volume threshold.” Yahoo also assesses compliance by authenticated domain or by the domain in the From header. Anyone telling you Yahoo’s bulk threshold is 5,000 a day is repeating Google’s number.

Shopify’s API usage limits documentation contains one behavior that deserves specific attention from anyone running a headless storefront or a custom cart. Verbatim: “Shopify limits the amount of checkouts that can be created on the Storefront API per minute. If an API client exceeds this throttle, then a 200 Throttled error response is returned.”

That’s an HTTP 200. A client that checks the status code and nothing else reads a throttled checkout as a successful one. The shopper gets no error, no retry prompt, and frequently no visible response at all, on the busiest minute of your year, and your logs record a 200. Confirm your checkout client inspects the response body rather than the status code, and confirm it surfaces something to the shopper when it sees Throttled.

Shopify does not publish the numeric checkout-per-minute throttle. Any capacity model built on an assumed value for it is built on a number nobody published.

The neighboring response codes matter for the same reason. Throttled Admin API requests return 429 Too Many Requests, and malicious traffic returns 430 Shopify Security Rejection. Shopify’s own guidance is direct: “Your code should stop making additional API requests until enough time has passed to retry. The recommended backoff time is one second.” Admin GraphQL runs at 100 points per second on standard plans and 1,000 points per second on Shopify Plus, with a single query capped at 1,000 points regardless of plan.

Shopify also documents that Storefront API “requests from real buyers aren’t subject to a fixed request-per-minute limit,” while it “rate-limits automated traffic such as bots and crawlers.” If your storefront calls the Storefront API from a server rather than from the buyer’s browser, understand which side of that distinction your traffic looks like it’s on before Black Friday, not during it.

On uptime, be clear-eyed about what’s actually promised. Shopify markets “99.99% uptime” on its Plus enterprise page. The contractual terms behind that figure are not published, and merchants on non-Plus plans have no published uptime commitment at all. That’s the whole of what can be said with a source behind it.

On fraud, Shopify’s Spring ’26 Editions page lists enhanced fraud prevention for card testing, using machine learning scoring to block card-testing attacks through Shopify Payments, alongside chargeback health monitoring. Card testing tends to arrive alongside promotional traffic. Its Winter ’26 Editions page lists bot filtering in analytics with the description “Exclude bot traffic for more accurate conversion rates and cleaner data,” which is a reporting feature and not a checkout defense. Don’t confuse the two when someone asks whether you’re protected.

The app decisions that matter this season are mostly replacements, not additions. If the August 26 sunset took out an analytics script, Shopify names app pixels as “the recommended solution,” with a custom pixel as the fallback. That’s the one install worth making in September, and it’s worth making this week.

Everything else gets held to a higher bar than usual, because every app you add between now and November 27 is a variable in a system you’re about to stress. Our rule: if an app doesn’t have a named owner, a defined job in the BFCM plan, and a test order behind it by the end of October, it doesn’t go on before December.

Two Shopify-side facts should shape what you leave alone. Adding a discount app changes what’s competing for those 25 automatic-discount slots and for the combination rules. And Shopify publishes no app-review timeline you can plan against, so a mechanic that depends on a brand-new app clearing review is a dependency with no schedule attached to it.

Removing apps carries risk in the same direction as installing them. An uninstall can leave orphaned theme code or take a snippet another app was relying on, and week 10 is not when you want to find out which. Do the cleanup in September if you’re doing it at all.

Waiting for the season’s forecasts. As covered above, NRF, Adobe, Deloitte and Salesforce hadn’t published 2026 holiday numbers when we checked in early September, and historically those land between late September and early November. Your inventory and promotional decisions have to be made against your own 2025 store data.

Building capacity infrastructure around numbers Shopify hasn’t published. Shopify documents that a Storefront API checkout throttle exists and does not publish its value. Engineering time spent modeling around a guessed limit is time not spent on the 200 Throttled handling, which is the documented failure you can actually fix.

Treating bot protection as a peak-weekend defense. The 60-minute cap, the one-event-at-a-time rule, and the no-editing-while-active rule make it a tool for a scheduled drop. A four-day promotion is not what it does, and Shopify says so.

Chasing a lab performance score. Google defines Core Web Vitals at the 75th percentile of real page loads, so the number that counts is the field measurement, not a synthetic run on a fast connection. Shopify’s own checklist points merchants at PageSpeed Insights or Pingdom for load speed testing, which is a starting diagnostic rather than a target.

Redesigning anything. A homepage redesign, a navigation rebuild, or a theme swap begun in September lands in October, gets debugged in November, and puts an untested layout in front of your highest-intent traffic of the year. If it isn’t already in flight, it’s a January project.

Eighty-two days. Twelve working weeks. Two Shopify deadlines already behind you and a set of discount limits that don’t move.

The stores that hold up on November 27 aren’t the ones that did the most in September. They’re the ones that audited first, built in October, and stopped changing things in time to find out whether the changes worked.

If you want an outside read on what’s already broken in your store, we do that as a free Growth Audit. Not a sales call. A clear look at where your traffic is going, where your conversion events are landing, and what’s standing between the two, with a roadmap you can run yourself if you’d rather.

If checkout is where you already know the problem lives, start with our ecommerce checkout optimization work. You built something worth finding. Eighty-two days from now, make sure it converts when it does.