Check your Shopware shop The free Shopware audit

Enter your shop URL and we automatically check 25+ data points across performance, security, SEO and Shopware setup.

Detection
Performance
Security
SEO
Schema
Shopware

What the Shopware audit checks

The audit sees your shop from the outside – like Google, a customer or an AI crawler.

Shopware version & end of life
Shopware 5 has been end-of-life since July 2024. Without security updates every new plugin and PHP release becomes a risk. Our audit detects the major version from the HTML and warns on critical setups.
Storefront speed & caching
Slow server responses, missing cache headers and oversized HTML payloads slow down every shop – especially at peak times. We measure TTFB, caching and HTML size directly on your storefront.
Security headers & admin exposure
Default setups forget HSTS, CSP and X-Frame-Options. Some shops expose /admin or /backend publicly. Our audit shows you which headers are missing and whether admin paths are publicly reachable.
Schema.org & product markup
Without clean Product, Offer and BreadcrumbList schema you give up rich snippets in Google and citations in AI answers. We check which @types are actually present in the HTML.

Shopware agency Check security headers and TLS for free

Score instantly, report by email

Results show instantly. For the full report with all detailed findings and quick wins by email we just need your email address.

Audit my shop

Audit score72 /100

Sample resultexample-shop.com

Your 3 most important levers

1No Strict-Transport-Security headerWarning
2Checkout abandonmentBeyond the quick check
3Plugin state and updatesBeyond the quick check

Example with a made-up domain, not a real result.

All checks at a glance

The audit knows 38 checks in six areas. Which of them show up in your report depends on the shop: Shopware-specific checks are skipped, for example, when no Shopware is detected.

Shopware detection

Shopware detection
Check	Why it matters	Threshold
Shopware signature	The Shopware-specific checks only apply once Shopware is detected.	At least one Shopware marker in HTML, headers or cookies
Other shop system	Shows which system the shop runs on – the basis for the migration question.	Note only. Detected: Magento, WooCommerce, Shopify, OXID eShop, JTL-Shop, PrestaShop.
WAF or CDN block	If a firewall blocks our request, the result is only partly meaningful.	Warning on HTTP 403, 429, 503 or a challenge page
Major version	Shopware 5 no longer receives updates, Shopware 6 is actively developed.	Shopware 6 passes · Shopware 5 fails
Version publicly readable	The exact version under /api/_info/version makes targeted attacks easier.	Note only

Performance

Performance
Check	Why it matters	Threshold
Homepage response time	Slow server responses cost conversion and crawl budget.	TTFB plus download under 800 ms passes · from 2000 ms fails
HTML size	Large HTML documents delay the first render, especially on mobile.	Under 244 KB passes · from 684 KB fails
Number of scripts	Every script costs load time; many plugins add up.	Up to 30 script tags pass, more is a warning
Cache-Control header	Without cacheable responses the server renders every page anew.	Warning when the header is missing or says no-store, no-cache, private
CDN or reverse proxy	A cache in front of the shop relieves the server and shortens load times.	Warning when neither Cloudflare, Fastly nor a cache proxy is detectable

Security

Security
Check	Why it matters	Threshold
HTTPS	Without encryption browsers warn visitors about the shop.	Fails when the checked address does not run on HTTPS
HSTS	Forces browsers onto HTTPS permanently and prevents downgrade attacks.	Warning when the Strict-Transport-Security header is missing
Content-Security-Policy	Limits which scripts may run – protection against injected code in the checkout.	Warning when the header is missing
X-Frame-Options	Prevents the shop from being embedded in foreign pages (clickjacking).	Warning when the header is missing
X-Content-Type-Options	Stops browsers from guessing file types and running uploads as scripts.	Warning when nosniff is missing
Server banner	Version details in headers tell attackers which vulnerabilities might fit.	Warning on a version number in Server or X-Powered-By
Admin login public	An openly reachable backend is a target for password attacks.	Warning when /admin serves the Shopware login

SEO basics

SEO basics
Check	Why it matters	Threshold
Title tag	The title is the headline of your search result.	Fails when it is missing or shorter than 6 characters
Meta description	It provides the description text in the search result.	Fails when it is missing or empty
H1 heading	One clear main heading tells search engines what the page is about.	Exactly one H1 passes · several is a warning · none fails
Open Graph	Controls title and image when the shop is shared on social media or in messengers.	Warning when og:title is missing
robots.txt	It governs what search engines and AI crawlers may fetch.	Fails when /robots.txt does not answer with status 200
sitemap.xml	The sitemap shows search engines all product and category pages.	Fails when /sitemap.xml does not answer with status 200
hreflang	Maps language and country versions so Google serves the right one.	Warning when no hreflang is set

Schema & structured data

Schema & structured data
Check	Why it matters	Threshold
JSON-LD on the homepage	Structured data tells Google and AI systems who you are and what you sell.	Fails when there is no JSON-LD block
Valid JSON-LD	Search engines cannot evaluate a broken block.	Warning when a block cannot be read
Organization	Links the shop to your company: name, logo, profiles.	Warning when the type is missing on the homepage
WebSite	Basis for the site name in the search result.	Warning when the type is missing on the homepage
Product on the product page	Basis for product snippets on Google and in AI answers.	Warning when the type is present neither as JSON-LD nor as microdata
Offer on the product page	Puts price and availability into the search result.	Warning when the type is present neither as JSON-LD nor as microdata
BreadcrumbList on the product page	Shows the category path instead of the URL in the search result.	Warning when the type is present neither as JSON-LD nor as microdata
BreadcrumbList on the category page	Makes the shop hierarchy readable for search engines.	Warning when the type is present neither as JSON-LD nor as microdata

Shopware specifics

Shopware specifics
Check	Why it matters	Threshold
Cookie banner	The Shopware storefront ships a consent banner. If it is missing, it was removed or replaced.	Warning when no Shopware cookie banner is in the HTML
Tracking scripts	Shows whether Google Tag Manager, Google Analytics or Hotjar are embedded.	Note only
Shopware 5 support	Shopware 5 has not received security updates since July 2024.	Fails on Shopware 5
Store API reachable	The Store API is the interface for headless frontends and apps.	Note only
Storefront bundle	Confirms that the default Shopware 6 storefront is served.	Passes when /bundles/storefront/ is in the HTML
Staging hints	References to test or staging systems in the live shop point to unclean deployments.	Warning on staging, .test or .local addresses in the HTML

Is your shop still running on Shopware 5?

Source: Shopware – Migration: Shopware 5 to Shopware 6

Shopware 5 has not received updates since July 2024. Every new PHP version, every plugin and every vulnerability thus becomes a risk for your shop. The audit detects Shopware 5 setups automatically. If that applies to you, we show you in a free call what a migration to Shopware 6 looks like for your shop and roughly what it costs.

Open the Shopware price calculator See Shopware migration

Limits of the audit

The audit sees your shop from the outside – like Google, a customer or an AI crawler. We do not see checkout, admin, plugins or server configuration. That is what our deep audit with access to the code is for.

From audit to implementation

What the quick check cannot see – checkout abandonment, plugin state and performance under load – is covered by the deep audit. As a Shopware Silver Partner we turn the results into a concrete action plan and implement it on request.

Request deep audit

FAQ – free Shopware audit

Your question isn't here? Ask us directly

What exactly does the free Shopware audit check?

We request your shop as an anonymous browser and check 25+ data points: Shopware version, TTFB, HTML size, caching, HTTPS, HSTS, CSP, X-Frame-Options, /admin reachability, robots.txt, sitemap.xml, hreflang, Open Graph, JSON-LD schema of the homepage (Organization, WebSite), cookie banner setup, storefront bundle hints and more. In addition, we read one product page and one category page from your sitemap and check them for Product, Offer and BreadcrumbList markup.

Do I need an account or credentials for the audit?

No. The audit works fully anonymously and from outside your shop – we only access public URLs (homepage, robots.txt, sitemap.xml and one product and one category page from the sitemap). No order data and no backend content is touched.

Why do you need my email address?

You see the audit highlights instantly, without signup. For the full report with all detailed findings, recommendations and a short take from our team we need your email – so we can follow up with concrete suggestions.

Does the audit work for Shopware 5 too?

Yes. We detect Shopware 5 setups via typical paths like /themes/Frontend/Responsive/ and /web/cache/. If your shop still runs on Shopware 5, migration is urgent (support ended July 2024) – we're happy to build you a concrete migration plan.

What happens to my data?

We only use the shop URL you enter for the one-off check. Only when you unlock the full report do we store your email and audit results in our CRM so we can reach out specifically. See privacy policy for details.

How is the audit different from the AI Visibility Check?

The AI Visibility Check focuses on LLM crawlers (GPTBot, ClaudeBot, PerplexityBot) and llms.txt. The Shopware audit specifically checks Shopware setup, performance, security headers, schema and shop-relevant topics. Both checks complement each other – if you want to be found in Google and ChatGPT, run both.

Can I act on the audit report without consulting?

Yes. Every finding includes a short explanation of what was checked and why it matters. You can forward the recommendations directly to your internal IT or existing agency. If you want, we'll implement it ourselves – as Shopware Silver Partner with a senior-heavy team.

What does a migration from Shopware 5 to 6 cost?

That depends mainly on catalogue, plugins, interfaces and design. Our Shopware price calculator shows a first range for your case within a few minutes. We prepare a binding offer after a short call.

How fast should a Shopware shop load?

The audit measures the response time of your homepage and passes it when first byte (TTFB) and download together stay under 800 milliseconds. From 2 seconds it counts as critical. Slower responses usually point to missing caching, too many plugins or undersized hosting.