On Saturday, October 17, 2026, Shopify disabled Boost AI Search & Filter across stores using it. Collection and search pages that relied on Boost went blank. As of October 20, the app is back on existing stores but still unavailable to install from the Shopify App Store.
If you run Boost or are deciding whether to keep it, here's what happened, how to check your store, and your options before Black Friday.
What happened
One of our clients' collection and search pages stopped showing products on the morning of October 17. Every Boost block failed at once. Nothing in the theme had changed.
Shopify Plus Support told us the app had been removed from the App Store and some shoppers had been redirected away from stores. Two days later, Shopify support confirmed it had disabled the app over a security issue to protect merchants and customers. Boost posted a service update that weekend and restored the app on existing stores after fixing the issue.
In the same two weeks, three other Shopify apps confirmed attackers had changed their settings to send shoppers to fake checkout pages: Hulk Product Options (October 10), Selleasy (October 13) and Swym Wishlist Plus (October 14). Researcher Roman Zipp has tracked the incidents and the vendors' statements. Our summary of the October incidents covers each one.
The common thread matters more than any single app. In the confirmed cases, the merchant's theme code was clean. The app loaded the malicious script from the vendor's own servers at runtime. A theme code review would not have caught it.
Why some stores had nothing to fall back to
Boost replaces your theme's product grid and search results. On our client's store, the native collection section had been switched off during installation. When Boost disappeared, there was no grid underneath to show.
Boost has a fallback mode, but it depends on the theme's native sections still being there. Check before you need it.
Restoring Boost isn't one switch, either. During the outage, we swapped in the native grid as a stopgap, which also turned off Boost's two app embeds. When Boost came back, restoring its template blocks wasn't enough. We had to turn the embeds back on separately in the theme editor.
Check your store now (15 minutes)
- Test checkout the way a shopper would. Open a private browser window, add a product to the cart, and click Checkout. You should land on your own store's checkout. Repeat it a few times in fresh private windows: the injected scripts in October fired once per visitor and didn't trigger every time.
- Look at your collection and search pages with Boost off. In a duplicate of your live theme (never the live one), turn off the Boost app embeds and blocks, then preview it. If the pages are empty, you have no fallback today.
- Find the native sections Boost replaced. In the theme editor, open your collection and search templates. If the theme's own product grid or search results section is hidden or disabled, note it. That's what you would need to switch back on.
- Check for code you can't see. In your Boost dashboard and every other app's settings, look for fields that accept custom JavaScript or HTML. Those fields are how the October attacks ran. Remove anything you don't recognize, and limit who can edit them.
- Lock down access. Turn on two-factor authentication for every staff and collaborator account in Shopify and in each app's own login. Remove staff and apps you no longer use.
- Subscribe to Boost's status page, so you hear about the next incident from Boost before you hear it from a customer.
If step 1 takes you anywhere other than your real checkout, stop. Contact Shopify Support right away and turn off suspected app embeds in the theme editor.
Option 1: Shopify's own Search & Discovery
For many stores, the best Boost alternative is Shopify's free Search & Discovery app. It works with any Online Store 2.0 theme, and Shopify maintains it, so it can't be delisted out from under you.
What it covers:
- Filters on availability, price, product type, vendor, tags, variant options and metafields, including Shopify's category metafields
- Search tuning: synonyms and boosted products for specific searches
- Recommendations: related and complementary products
Where it usually falls short of Boost:
- Merchandising rules beyond what Shopify's collection sorting allows
- Layout features like list and grid toggles, product badges or custom card content, which come from your theme rather than the app
- Store-specific rules, such as treating in-store-only products differently on the grid
Those gaps are theme work, not app work. Most of what Boost renders can be rebuilt in your theme on Shopify's native filtering, with no app in the path.
Option 2: Another search and filter app
If you need AI search, deep merchandising controls or search analytics, a dedicated app or platform may still fit. Established names include Algolia, Klevu, Searchspring, Searchanise and Layers.
We haven't audited them for this article. Switching vendors only moves the risk if you don't ask the right questions. Before installing a replacement, ask:
| Question | Why it matters |
|---|---|
| Can anyone add custom JavaScript or HTML through your dashboard? | That's how the October attacks ran. If yes, who can use it, and is it logged? |
| Do you support two-factor authentication on every account, including your staff's? | Vendors that explained a cause pointed to compromised credentials or access. |
| Will installing your app switch off my theme's native grid or search? | If yes, you need a plan to switch them back on fast. |
| What happens to my storefront if your servers go down? | Some apps fail open and the theme still works. Others leave blank pages. |
| Can you share a security questionnaire or audit summary? | It won't make the app safe, but a vendor without one probably isn't monitoring for breaches. |
| Do you have a public status page and incident history? | You want to hear about outages from them, not from customers. |
Whichever you pick, keep the theme's native sections in place as a fallback.
Option 3: Build it into your store
Apps used to win on cost. Custom search and filtering meant a big quote and a long wait. AI-assisted development has changed that.
When Boost went down, we started rebuilding our client's collection and search pages natively as a backup: filters, search, list and grid views, product badges, and rules for in-store-only products. A few years ago, that would have taken hundreds of hours. It took a fraction of that.
A native build runs inside your Shopify theme, on Shopify's filtering, with no third-party script in the path and no monthly fee. For logic Shopify doesn't provide, we use Cloudflare, the same network Shopify's storefronts run on. You own the code, and nobody else has an off switch.
That doesn't mean removing every app. Reviews, fraud tools and email platforms hold data and expertise you can't rebuild in a week. But for features on the path to revenue (search, collection pages, cart, checkout), owning the code is now realistic.
Talk to us about custom Shopify app development
Before you change anything: an App Risk Audit
Black Friday is November 27. Most stores freeze code a couple of weeks before. That's no time to replace a search app, but you need to know what happens if one fails.
Our App Risk Audit covers:
- Every app on your store: what it loads, where, and what access it holds
- Remote code risk: which apps can run code from their own dashboards
- An outage drill: your store tested with each app switched off, so you see exactly what breaks
- A fallback plan for each critical app: what takes over, how to switch it in two minutes, and who does it
You get a written fallback plan for every app that matters, before you need it.
Book an App Risk Audit before Black Friday
FAQ
Is Boost AI Search & Filter safe to use now?
Boost fixed the issue and Shopify restored the app on existing stores. As of October 20, 2026, it's still unavailable to new installs on the Shopify App Store. Run the checkout test above, check your Boost settings for custom code, and turn on two-factor authentication.
Why did my collection pages go blank instead of falling back?
Installing Boost often switches off the theme's native product grid and search sections. With those off, nothing could show when Boost's blocks failed.
Should I uninstall Boost?
Not in a panic. Uninstalling can remove your filter and merchandising setup. Make sure your theme's native sections work first, then decide.
Is Shopify Search & Discovery a good replacement for Boost?
For filtering and basic search tuning, yes. It's free and maintained by Shopify. Layout features like list views and badges come from your theme and can be rebuilt there.
Were shoppers' card details stolen?
Shopify disabled the app to protect merchants and customers, and some shoppers were redirected away from stores. In the related incidents, shoppers who entered a card number on a fake checkout were at risk. Wallet payments like Shop Pay were affected differently. If you saw redirects, contact Shopify and check your notification duties under your payment processor agreement and local law.
Which other Shopify apps were affected in October 2026?
Hulk Product Options, Selleasy and Swym Wishlist Plus confirmed incidents. Several other apps were removed from the App Store without a public explanation. See our October incident summary.
