The fastest way to audit an app is to take it away

Field notes from the app-audit module: building the real list, running the exit interviews, deciding who stays.

The fastest way to find out what an app does for your storefront is to take it away.

Chrome DevTools will do it politely. Right-click the script in the Network panel, choose Block request URL, reload the page. For exactly one page load, the app does not exist. Whatever breaks was its job. Whatever stays intact is the finding.

We already logged the tax itself: the slow accumulation of app weight, one Tuesday at a time. This entry is the sequel, and it is about method. How you decide, app by app, who keeps a badge.

The list that lies

We used to start where everyone starts, on the Apps page in the admin. Count the installs, read the listings, ask the owner what each one does. Every answer describes the day it was installed (we ran audits off that list longer than we'd like to admit).

It turned out to be the wrong list. The admin page tells you who is on payroll. It does not tell you who shows up, and it has no memory of who left without returning their keys.

A storefront carries three lists, and they never match. The installs in the admin. The scripts loading in the network waterfall. And the code inside the theme itself, because a whole generation of apps asked merchants to paste snippets into theme.liquid, and uninstalling the app removes the app while the pasted code stays.

That third list is ghost payroll. Scripts still fire for services the store cancelled years ago; stylesheets still load for widgets that no longer exist. We rarely find these by looking for them. They surface while we are looking for something else.

Modern app embeds clean up after themselves on uninstall, and the theme editor shows them honestly, each with its own toggle in the sidebar. The paste-in generation answers to nobody. So the inventory step is part reading, part archaeology: waterfall, embeds panel, then a search through the theme code for names nobody remembers hiring.

The exit interview

With the real list built, the measurement is almost boring. Lighthouse ships a third-party usage audit that names every outside vendor on the page. A second audit flags the page when third-party code blocks the main thread for 250 milliseconds or longer.

That produces the interview list. It does not produce verdicts.

Verdicts come from the trick in the opening line, run with discipline: block one vendor, reload, measure, unblock, move on. Third-party scripts refuse to load the same way twice, so Google's guidance is three or more runs per test, reading the median. An interview per app, a page load per question.

The budget that makes it awkward

The scale for judging the answers comes from Shopify itself. Its performance guidance for theme developers says a theme's entire minified JavaScript bundle should be 16 KB or less.

Its suggested script budget for a single theme app extension: 10 KB compressed.

Read those together. Two apps behaving exactly as recommended outweigh the whole theme they live in, and recommended is the optimistic case. The ScriptTag generation was never handed a budget at all; it loads on every page of the storefront, unscoped, forever.

Three piles

Every interviewed app lands in one of three piles.

Fired: the job never needed a browser. Badges, banners, countdown timers; Liquid renders these on Shopify's servers and ships plain HTML, so the browser cost is zero. DebugBear's guidance on third-party code is blunt about this pile: "eliminating a third-party entirely is the most impactful optimization you can make."

Rescoped: the work is real but the deployment is wrong. An app that loads everywhere gets restricted to the pages it serves, and when the vendor offers a theme app extension build, the kind that loads assets only where its block sits, that version wins the job back.

Kept: the app earns its milliseconds. Inventory sync, reviews carrying real data, anything no template can do. An audit that fires everything is as lazy as one that fires nothing.

No app gets tenure.

The finished audit fits on a page: every script named, a cost next to it, a verdict next to the cost. Most stores have never run a performance review on the staff operating their storefront, which is why the first one tends to read like a payroll scandal.

What survives the audit

• The admin Apps page is a billing record, not an inventory. The real list is the waterfall, the app embeds panel, and the theme code.
• Interview by subtraction. Block one vendor at a time, run three passes, trust the median.
• Sort with one question: does this job need a browser? Server-rendered work costs the visitor nothing.
• After every firing, search the theme for the app's name. Uninstall does not clean up pasted code.

None of this needs our tooling. DevTools is free, the audits ship inside Lighthouse, and the method fits in a sentence.

Take one away. Watch.

If you'd rather have the interviews run for you, the app-audit module of OKART's Infrastructure Stress-Test covers every script on your storefront, read-only, verdicts included, delivered in 48-72 hours.

Sources

1. Identify slow third-party JavaScript - web.dev: Chrome DevTools request blocking technique, Lighthouse third-party usage audit, and the three-or-more-runs median methodology.
2. Reduce the impact of third-party code - Chrome for Developers: Lighthouse flags pages where third-party code blocks the main thread for 250 ms or longer.
3. Configure theme app extensions - shopify.dev: page-scoped asset loading vs ScriptTag, and the suggested 10 KB compressed JavaScript budget per extension.
4. Extend your theme with apps - Shopify Help Center: app embed toggles in the theme editor sidebar and apps that inject code directly into theme code.
5. Theme performance best practices - shopify.dev: the 16 KB or less minified JavaScript bundle guidance and recommended measurement tooling.
6. How To Reduce The Impact Of Third-Party Code - DebugBear: remediation strategies, including eliminating a third party as the most impactful optimization.
7. Remove Leftover App Code from Shopify - Fudge: uninstalling an app leaves pasted theme code behind, while app embeds clean up automatically.