Overview
This guide gives ecommerce leaders a decision-ready playbook to shortlist, select, and manage a Shopify development company in 2026. It focuses on practical choices that affect cost, speed, risk, and scalability so you can move from research to contract with confidence.
What’s new this year is meaningful: Shopify Functions has matured for production-grade discounting and checkout logic, Shopify Markets stabilizes global selling, B2B on Plus is now enterprise-viable, and headless with Hydrogen/Remix/Oxygen is more prescriptive.
Use this as a reference during procurement, SOW drafting, and steering committee check-ins to keep scope, KPIs, and compliance tight.
What a Shopify development company does and the roles you actually need
A strong Shopify development company aligns business goals to platform capabilities, then delivers themes, apps, integrations, and migrations with low operational risk. The team you staff—and the decision rights you grant—determine your launch quality, Core Web Vitals, and how maintainable your stack becomes.
On mid-market to enterprise scopes, expect a delivery spine of product/project leadership, a solution architect, theme and app engineers, QA, and DevOps/enablement. For Shopify Plus, add a Functions engineer and integration specialists.
Ask for named leads and artifact examples (solution blueprint, test plan, runbook) before signing to validate maturity.
Project team and ownership map
Each role should own clear artifacts and decisions so scope doesn’t drift and accountability sticks.
- Product/Project Manager: roadmap, RAID log, change control, stakeholder cadence, acceptance sign-offs.
- Solution Architect: architecture decision record, data models, integration contracts, performance budgets.
- Theme Developer: Online Store 2.0 section schema, Liquid/JSON templates, accessibility conformance, CWV fixes.
- App Developer: custom app design, Shopify APIs/webhooks, OAuth/security, observability.
- Functions Engineer (Plus): discounts/shipping/validation logic, migration from Scripts, guardrails and tests.
- QA Lead: test strategy, device matrix, visual regression baseline, UAT coordination, release sign-offs.
- DevOps/Enablement: environments, CI/CD, backups/rollback plans, incident runbooks, monitoring.
- Data/Analytics Specialist: GA4/Shopify Pixels/server-side tagging, attribution QA, KPI dashboards.
Agree on RACI and artifact checklists up front to reduce rework and change orders.
Pricing and 3-year total cost of ownership (TCO) for Shopify and Shopify Plus
Your 3-year TCO blends one-time build costs with ongoing apps, payment fees, fraud tooling, and support retainers. For a typical Shopify Plus brand doing $10–50M GMV, expect 3-year TCO of roughly $650k–$2.1M depending on architecture, app mix, and integration depth.
As a benchmark for 2026: assume a blended card fee of ~2.7% plus per-transaction fixed fees, app subscriptions of $1.5k–$6k/month, and a support retainer of $6k–$25k/month based on SLA and scope. Heavier integrations (ERP/OMS/PIM/3PL) and headless front ends drive the top of the range. Ask vendors to provide base-build vs. operating-cost splits so finance can model ROI and breakeven.
Line items most teams miss
Hidden costs often surface post-launch and can upset ROI if not modeled early.
- Integration resiliency: message queues, retries, and monitoring add $15k–$60k one-time and $300–$1k/month.
- Chargebacks and fraud: fraud tools and manual review can run 0.1%–0.3% of GMV.
- Duties/taxes: cross-border duties, landed cost APIs, and compliance ops add $300–$2k/month plus per-order fees.
- QA automation: visual regression and device farms add $200–$1k/month and reduce bug rollbacks.
- Replatform risk: dual-running costs for 1–3 months (apps, staff time) and SEO rollback capacity.
- Data warehousing: server-side events, ETL, and storage for analytics/attribution $300–$2k/month.
Validate each with the vendor’s runbook and include “turn-off” plans for underperforming tools.
Sample budgets by scope: theme, migration, Plus, headless
Use these 2026 ranges as negotiation anchors; variance comes from design rounds, integration count, and compliance scope.
- New OS 2.0 theme build: $80k–$200k (10–16 weeks).
- Migration to Shopify (from Woo/Magento/Custom): $120k–$300k (16–24 weeks).
- Shopify Plus replatform with Functions and B2B: $200k–$500k (20–28 weeks).
- Headless Hydrogen/Remix front end + Plus: $400k–$1.2M (28–44 weeks).
Hold vendors to artifact-based milestones (architecture, designs, integration contracts, UAT) with go/no-go gates tied to acceptance criteria.
Architecture decisions: Online Store 2.0 vs Plus with Functions vs Headless (Hydrogen/Remix/Oxygen)
Choose the simplest architecture that meets your roadmap for 24–36 months to minimize TCO and operational drag. OS 2.0 satisfies most DTC brands; Plus with Functions unlocks checkout and B2B; headless fits complex design systems, content models, and speed at scale.
Anchor your decision to measurable needs: target CWV scores, merchandising complexity, B2B requirements, and integration volume. When a need is met natively (e.g., advanced discounts with Functions), prefer platform primitives over custom code for resilience and supportability.
When each option wins
- Online Store 2.0: fast build, lower TCO, strong sections/blocks; limited bespoke checkout logic.
- Plus with Functions: advanced discounts, shipping/validation logic, B2B (companies, price lists, net terms), checkout extensibility.
- Headless (Hydrogen/Remix/Oxygen): design system reuse, complex content orchestration, sub-1s LCP at scale, multi-front-end governance.
If you cannot list 3+ headless-only benefits you’ll use within 12 months, stay on Plus with OS 2.0 and Functions.
Migration and performance considerations
Migrations fail when performance and SEO are afterthoughts. Set performance budgets early (e.g., LCP < 2.2s on 4G, JS < 170KB main thread) and require design/dev to prove budgets with prototypes before full build.
Plan phased rollouts—start with a limited market or traffic segment—and keep rollback paths one command away.
Use a change freeze for 1–2 weeks around cutover and pre-build redirect maps and canonical tags to preserve rankings. Measure deltas daily for 30 days post-launch and correct regressions quickly to protect revenue.
Shopify Functions, Scripts, and Flow: what changes for discounts and checkout
Shopify Functions replaces Legacy Scripts for most discounting and shipping/validation logic on Plus, bringing native scale, versioning, and better observability. Flow remains your no-code orchestration layer for back-office automation, not a checkout customization tool.
Functions-based checkout logic reduces technical debt and aligns to Shopify’s support model. Review the roadmap and capabilities in the official Shopify Functions documentation and plan deprecation of Scripts to avoid forced migrations during peak.
Capabilities map and upgrade path
- Inventory your Scripts and map each to available Functions (discounts, shipping rates, validations).
- Rebuild priority logic as Functions with tests and guardrails; keep business rules in config, not code.
- Use Flow for automation triggers (e.g., tagging, fulfillment rules) and keep checkout logic in Functions.
- Stage on a Plus sandbox, run A/B validation, and enable feature flags for safe rollback.
- Decommission Scripts, document ownership, and monitor with error budgets and alerts.
Enterprise integrations: ERP/OMS/PIM/3PL/ESP/CRM playbook
Enterprise-grade Shopify ERP/OMS/PIM/3PL/ESP/CRM integrations rely on explicit contracts, idempotency, and operational visibility. Design for rate limits, retries, and reconciliations on day one, not as a post-launch patch.
Map canonical flows with clear system-of-record decisions: ERP for inventory and pricing, OMS for order orchestration, PIM for product content, 3PL for fulfillment status, ESP/CRM for customer/marketing events. Review Shopify’s webhook and API patterns and plan throughput using Shopify’s rate limit guidance to avoid throttling surprises.
Reliability patterns that prevent data loss
- Idempotency keys on create/update to prevent duplicates on retry.
- Exponential backoff with jitter for API calls and webhook processing.
- Durable queues and dead-letter channels for poison messages.
- Reconciliation reports (orders, inventory, fulfillments) on daily cadence.
- Webhook signature verification and alerting for delivery failures.
- “Catch-up” jobs to backfill missed events after incidents or deployments.
Document SLIs/SLOs for each integration (e.g., 99% of orders acknowledged by OMS within 2 minutes) and monitor them.
Security, privacy, and accessibility compliance on Shopify projects
Compliance is faster and cheaper when embedded into delivery artifacts, not left to legal at the end. On Shopify, PCI DSS scope is reduced but not eliminated; GDPR/CCPA requires documented processing, and WCAG 2.2 AA is now the baseline for accessible themes and apps.
Clarify responsibilities with your Shopify Plus agency and provide proof: DPA/DPIA records, access controls, audit logs, and accessibility test results. Use primary sources for accuracy—see PCI SSC’s guidance, the EU’s GDPR overview, and W3C’s WCAG 2.2.
What’s in-scope for PCI on Shopify
- Using Shopify Checkout and Shopify Payments often reduces you to SAQ A; third‑party gateways or custom payment fields expand scope.
- Required artifacts: current AOC/SAQ, network/access controls, vendor AOCs, incident response runbook, quarterly vulnerability scans for custom apps.
- Do not store card data; tokenize and rely on platform vaulting.
- Limit privileged access and enforce MFA on admin and Git.
- Log and review critical events; document evidence for audits.
Confirm your exact SAQ with your acquirer; platform choices (e.g., hosted vs embedded) change scope materially.
Accessibility audit and remediation workflow
Accessibility compliance is a product requirement, not a post-launch patch. Bake it into design systems, components, and acceptance criteria.
- Baseline audit against WCAG 2.2 AA with automated and manual checks across devices and screen readers.
- Remediate templates/components with semantic HTML, focus states, color contrast, and ARIA only when needed.
- Regress with visual and keyboard-only tests; block release when critical issues exist.
- Provide an accessibility statement and feedback channel; track and fix reports under SLA.
- Re-audit quarterly or after major feature releases.
Technical quality: coding standards, testing, CI/CD, and Core Web Vitals
Technical quality is your safety net and growth lever—clean code, staging parity, and performance budgets protect revenue during campaigns. Mandate standards in the SOW: code reviews, linting, unit/integration coverage, visual regression, and one-click rollbacks.
Set Core Web Vitals budgets and hold creative to them: image/CDN strategy, minimal blocking JS, section schema discipline, and third-party script governance. Require trunk-based development, ephemeral preview builds, and tested migrations so releases are boring, not brave.
QA blueprint for Shopify
- Tests: unit (helpers/components), integration (cart/checkout paths), contract (APIs/webhooks), visual regression on key templates, and smoke tests.
- Environments: dev sandboxes, staging with production parity data, and a protected production branch.
- CI/CD: linting, tests, build, deploy to preview, approvals, production deploy with health checks, and auto-rollback.
- Device/browser matrix: top traffic devices plus assistive tech; update quarterly.
- Ownership: QA leads sign release gates; product accepts against written criteria and KPIs.
Project timelines and benchmarks by scope
Set realistic schedules with artifact-driven milestones to avoid late crunches. Most slippage comes from unclear requirements, third-party delays, and late-stage integration surprises—solve these with discovery and signed contracts between systems.
Expect discovery/design to consume 25%–35% of time on new builds, with integration/UAT forming the rest. Lock change control after design sign-off, and maintain a visible burndown and risk register to steer blockers early.
Typical hour and week ranges you can hold vendors to
- OS 2.0 theme (10–16 weeks): 800–1,600 hours.
- Migration to Shopify (16–24 weeks): 1,200–2,400 hours including data mapping and redirects.
- Plus replatform with B2B/Functions (20–28 weeks): 1,800–3,200 hours.
- Headless Hydrogen/Remix (28–44 weeks): 3,000–6,000 hours plus SRE/observability.
Tie payments to milestones: discovery complete, designs approved, integrations contracted, UAT pass, go-live, and 30‑day stabilization.
Support models and SLAs you should require
Your post-launch retainer should define severity, response/resolution targets, change windows, and escalation paths. Separate “keep the lights on” from roadmap work to avoid starving either and insist on monthly ops reviews with incident summaries and trend metrics.
Include on-call expectations during peak and a documented runbook for incidents, rollbacks, and third-party escalations. For observability, require uptime and error-rate dashboards, alert thresholds, and a post-incident review template with owner and due date.
Example severity definitions and response targets
- Sev 1 (checkout down, data loss): response 15–30 min, workaround 1 hour, resolution 4 hours, 24/7 paging.
- Sev 2 (major degradation, partial outage): response 1 hour, resolution 1 business day.
- Sev 3 (functional bug, minor degradation): response 1 business day, resolution 5 business days.
- Sev 4 (cosmetic, backlog items): response 2 business days, resolution by release cadence.
- Availability SLO (custom code): 99.9% monthly; report breaches and apply service credits.
RFP and vendor scoring rubric (with downloadable template)
A tight RFP enables apples-to-apples comparisons among the best Shopify development companies. Limit your scope to problems, KPIs, and constraints; let agencies propose solutions so you can judge thinking, not just rates.
Score across weighted criteria and ask for a discovery workshop sample, code snippets, and a QA/CI plan. Require references from similar GMV and integration stacks. Share your scoring rubric upfront to focus proposals and speed consensus.
Acceptance criteria, warranties, IP and exit language
Protect your brand with clear contract terms and a clean exit path before you start.
- Acceptance criteria tied to KPIs (e.g., LCP, CVR delta tolerance), accessibility, and test pass rates.
- Warranties on defects (e.g., 60–90 days) and remediation SLAs without consuming retainer hours.
- IP ownership: work-for-hire, rights to custom apps/themes, license terms for reusable components.
- Data protection: DPA, subprocessor review, breach notification timelines.
- Exit and handover: code repositories, documentation, credentials, runbooks, and knowledge transfer sessions.
Risk trade-offs: in-house vs agency, onshore vs nearshore/offshore, and partner tiers
Decide your sourcing model by weighing speed, cost, and operational coverage across time zones. In-house teams carry more fixed cost but offer product memory; agencies bring pattern experience and surge capacity; hybrids often win for brands with steady roadmaps and occasional spikes.
For geography, onshore boosts collaboration and compliance; nearshore/offshore expands coverage hours and lowers costs but demands stronger process and senior oversight. Partner tiers can signal Shopify tenure but prioritize recent, relevant work over badges.
- Red flags: no staging parity, weak CI/CD, vague ownership, no code samples, or a “trust us” discovery.
Global expansion and multi-store strategy
Global growth hinges on the right structure for price, tax/duty, content, and SEO. Shopify Markets centralizes currency, duties, and domains; expansion stores add isolation for complex catalogs, teams, and regulations.
Decide early who owns localization, how translations ship, and how inventory and prices vary by country. For technical SEO, enforce hreflang, canonicalization, and regional content governance to prevent cannibalization. Review Shopify’s Markets features at Shopify Markets documentation as you scope.
Markets vs expansion stores: decision criteria
- Use Markets when catalogs, merchandising, and ops are similar; you need centralized governance with localized pricing/duties.
- Use expansion stores when catalogs, content, tax/VAT rules, or ops diverge materially, or when teams require separation.
- For enterprise: mix both—Markets for “easy” regions, expansion stores for complex geographies.
Document SEO rules, translation workflows, and tax/duty configuration in your runbook before launch.
Post-launch growth: analytics, CRO cadence, and KPI ownership
Post-launch momentum depends on a clear operating model: who owns KPIs, how fast you ship, and how you learn. Establish a monthly growth council, a two-week release cadence, and a rolling 90-day test roadmap prioritized by impact and effort.
Ensure analytics integrity first—server-side tagging, Shopify Pixels, and clean GA4 event schemas—so decisions are trustworthy. Align engineering, merchandising, and marketing on a shared scorecard and budget carve-outs for ongoing UX and performance improvements. For analytics configuration references, see Google Analytics 4 documentation.
Your first 90 days after launch
- Weeks 1–2: stabilize, fix Sev 1–2 issues, validate tracking, and benchmark CWV and conversion rate.
- Weeks 3–4: quick wins—image optimization, third‑party script governance, nav/search tweaks (target +2–4% CVR uplift).
- Weeks 5–8: A/B tests on PDP and cart incentives, bundle/cross-sell, and address top friction from session replays.
- Weeks 9–10: B2B or loyalty enhancements if on Plus; refine discounts via Functions.
- Weeks 11–12: Publish learnings, reprioritize, and lock next 90‑day backlog with owners and KPIs.
FAQ
How many third-party apps are too many, and when is it smarter to commission a custom app instead?
Aim for fewer than 12–15 installed apps on a performance-critical store; beyond that, conflicts and script weight often degrade CWV. Commission a custom app when you rely on 2–3 apps to do one job or you need clean data contracts, reliability, or lower long‑term cost.
What roles should a Shopify development company staff on a typical project and what does each role own?
At minimum: PM, solution architect, theme dev, app dev, QA, and DevOps. On Plus, add a Functions engineer and integration specialists. Each must own specific artifacts (blueprint, tests, runbooks) and sign-offs to control scope, quality, and risk.
What is the 3-year total cost of ownership for a Shopify Plus build when you include apps, payment fees, and an agency retainer?
For mid-market brands, plan $650k–$2.1M over three years. That includes a $200k–$500k build, $1.5k–$6k/month in apps, a $6k–$25k/month retainer, and payment/fraud costs tied to GMV. Complexity (headless, integrations) pushes the high end.
How do I write a Shopify RFP and scoring rubric to fairly compare agencies?
State business goals, constraints, and KPIs; request a solution approach, artifacts, team CVs, and timeline. Score by weighted criteria (fit, architecture, QA/CI, refs, price, SLA). Provide sample data and require a discovery workshop demo for parity.
Which KPIs and acceptance criteria should I put in a Shopify redesign SOW to hold the agency accountable?
Include Core Web Vitals thresholds (e.g., LCP < 2.2s), accessibility WCAG 2.2 AA pass, defect escape rate, and analytics parity. Commercially, set CVR/AOV “no regression” bounds and tie final payment to meeting budgets and successful UAT.
Should my brand choose headless (Hydrogen/Remix) or Online Store 2.0, and under what conditions does each win?
Choose OS 2.0 unless you need a design system across properties, complex content orchestration, or sub‑1s LCP at scale. Headless wins when those benefits are in-year and resourced.
How do Shopify Functions change discounting and checkout customization compared to Scripts and Flow?
Functions bring native, scalable checkout logic with versioning and observability, replacing most Scripts. Flow remains for automation outside checkout. Review the Functions capabilities and plan a phased migration with tests.
How can I evaluate a Shopify agency’s code quality before I sign a contract?
Request anonymized repos or excerpts, lint/test configs, and CI pipelines; ask for a visual regression baseline and rollback plan. Run a paid discovery sprint to see artifacts and velocity. Poor staging parity or “manual deploys” are red flags.
What SLA terms (response, resolution, uptime) are reasonable for a Shopify support retainer?
For Sev 1, expect 15–30 min response and 4‑hour resolution, with 24/7 coverage during peak. For Sev 2, 1‑hour/1‑day. Availability SLO of 99.9% for custom code is common, with service credits for breaches and monthly ops reviews.
How do I integrate Shopify with my ERP/OMS/PIM while avoiding data sync conflicts and rate-limit issues?
Use idempotency keys, queues, and exponential backoff; verify webhook signatures and monitor delivery failures. Define system-of-record per entity, set SLIs/SLOs, and run daily reconciliation. Consult Shopify’s rate limit guidance when sizing throughput.
What compliance requirements (PCI, GDPR/CCPA, ADA/WCAG) should my Shopify build meet and how do we document them?
On Shopify Checkout with Shopify Payments you often qualify for SAQ A; collect AOC/SAQ, enforce MFA/access controls, and log reviews. Document GDPR with a DPA/DPIA and retention rules, and meet WCAG 2.2 via audits and remediation.
Who owns the IP and code after a Shopify project and how should the contract language be written?
Make custom work “work-for-hire” with full assignment to you; define licenses for reusable agency components. Require delivery of source, docs, and credentials at handover, and include exit obligations and warranty windows in the MSA/SOW.
What’s the best way to handle B2B on Shopify Plus?
Use native B2B features—company profiles, price lists, and net terms—before custom builds. Sync ERP price lists and credit terms, and model approvals in your CRM/ESP. Review Shopify’s evolving B2B feature set in the Shopify Plus B2B docs and plan Functions for edge cases.
How do I structure global selling with Shopify Markets versus multiple stores?
Leverage Shopify Markets when catalogs and ops are similar; choose expansion stores for materially different catalogs, teams, or regulations. Enforce hreflang/canonical rules and centralize translation governance to protect SEO.