Is this SEO agency emailing me about "critical errors" on my store a scam?
Cold-pitch emails claiming to have found critical SEO errors on your store are extremely common and often scams. Here is how to tell the difference and protect your store's access either way.
What's going on
Every week a new email shows up claiming to be an SEO specialist who noticed critical issues with your Shopify store's search rankings, usually with a vague but alarming subject line and an offer to fix it for a fee, or sometimes for free, which is its own red flag. This is one of the most common complaints merchants raise about running a store: the pitches are mass sent, often use contact info scraped from your storefront, and lean on generic sounding audits that could apply to almost any site.
The bigger problem is that some of these pitches escalate into requests for your Shopify admin login, staff access, or even domain and DNS control, which is where an annoying email can turn into an actual security incident. Even when the sender turns out to be a real, if pushy, marketing company rather than an outright scammer, handing over broad account access to someone you have not vetted is a risk regardless of their intent.
Why it happens
Store owner contact info is easy to find. It often sits on the storefront's contact or footer page, in domain registration records when they are not privacy protected, or gets scraped in bulk from public store directories. Sending mass cold email is cheap, so even a tiny response rate makes the campaign worthwhile for whoever is sending it, which is why the volume never really stops.
Shopify does not vet or endorse outside marketing emails sent to store owners, and the platform has no way to intercept messages sent to a merchant's personal or business inbox since that traffic never touches Shopify's systems. That is why there is no admin setting that stops these emails; the fix has to happen on the merchant's side, through email filtering and careful verification of anyone who reaches out unsolicited.
5 ways to fix it
Verify the sender before you do anything else
Check the sender's actual email domain, not just the display name, against the company's real website, and search the company name alongside terms like scam or reviews. Legitimate agencies rarely cold email with urgent claims like critical SEO errors or promises of guaranteed first page rankings; those are pressure tactics meant to get a fast reply. If the email cites specific store details such as traffic numbers or competitor names, treat that as a scare tactic rather than proof of expertise, since much of it can be pulled from public tools.
Never hand over your Shopify login or password
No legitimate agency needs your admin email and password. Shopify has a system for granting outside collaborators access without sharing credentials: in your admin under Settings, look for Users and permissions, where you can generate a collaborator request code or add a staff account with narrowly scoped permissions, for example limited to Online Store or Analytics rather than full admin, Payments, or domain settings. This lets you revoke access instantly and keeps a record of who did what.
Limit access even for vendors you decide to trust
If you do move forward with an SEO provider, grant only the permissions the job actually requires and remove access once the work is done. Avoid giving anyone control over your domain registrar, Shopify Payments, or the ability to add other staff accounts. Periodically review who has access to your store and revoke it for anyone you are no longer actively working with.
Check their track record independently
Ask for references or existing client stores you can verify are real, and look at actual results rather than screenshots they send you. If they claim to be a Shopify Partner, check for a verifiable profile and history rather than taking the claim at face value. A refusal to provide anything you can independently confirm is itself a reason to walk away.
Report repeat offenders instead of just deleting them
Mark unsolicited pitches as spam or phishing in your email client so future messages from that sender or domain get filtered automatically. If an email impersonates Shopify itself, for instance by claiming to be from a Shopify security or SEO team, or links to a fake login page, report it to Shopify Support directly so they can warn other merchants.
Bottom line
There is no store setting that blocks these emails outright, since they arrive outside Shopify entirely, but you are not defenseless: verify any sender independently, never trade your password for free help, and use Shopify's staff and collaborator permission controls to limit access if you ever do hire someone. If you are fielding these pitches because your store's technical SEO genuinely needs work, a one-time audit is usually a safer way to get real answers than an ongoing arrangement with a stranger who emailed you first.
Browse the rest of the problem library, run a free storefront scan to catch issues like this automatically, or email us and we'll work out a custom solution for it.