Question 1

How do I install Bloodhound?

Accepted Answer

Install Bloodhound from the Shopify App Store in one click. Two things auto-install: the Web Pixel (for checkout monitoring) and a theme app embed (for storefront monitoring). You just need to toggle the theme embed on in your theme editor. Data starts flowing immediately, no code changes, no SDK configuration.

Question 2

Do I need a developer to set it up?

Accepted Answer

No. Installation is entirely point-and-click inside the Shopify admin. The Web Pixel installs automatically. The theme embed is a toggle in your theme editor. No SDK, no npm, no code.

Question 3

How long until I see data?

Accepted Answer

The moment real visitors start hitting your store. There is no warm-up period. If you have traffic, you have data within seconds of install.

Question 4

Does Bloodhound slow down my store?

Accepted Answer

No. The monitoring script is under 5KB gzipped, loads deferred, and is non-blocking. It has zero impact on your Time to First Byte and does not affect Largest Contentful Paint. We eat our own dog food. We'd notice.

Question 5

Which Shopify plans does Bloodhound support?

Accepted Answer

Bloodhound works on all Shopify plans including Basic, Shopify, Advanced, and Shopify Plus. The Web Pixel and theme app embed APIs are available on all plans.

Question 6

What JavaScript errors does Bloodhound capture?

Accepted Answer

Bloodhound captures uncaught exceptions via window.onerror, unhandled promise rejections via the unhandledrejection event, failed fetch requests (4xx/5xx), failed XMLHttpRequest calls, and console.error calls. On Pro and above, it also captures console.warn, useful for catching React hydration mismatches and deprecated API usage before they become real errors.

Question 7

Does it capture errors inside Shopify checkout?

Accepted Answer

Partially. Shopify's checkout runs in a sandboxed environment that prevents any app from hooking window.onerror there. What Bloodhound does instead is use the Web Pixel to capture the full checkout funnel: cart add, checkout started, address submitted, payment submitted, purchase completed. You get event-level telemetry for every step, but not raw JavaScript errors from inside the checkout iframe.

Question 8

How does error deduplication work?

Accepted Answer

Bloodhound normalises the error message and source filename, hashes them together, and groups all matching events into a single Issue. An Issue has a lifecycle: New → Active → Resolved → Regressed. If you mark an issue resolved and the same error pattern appears again, it automatically reopens as Regressed and fires an alert.

Question 9

What information does Bloodhound store with each error?

Accepted Answer

For each error: message (truncated at 500 chars), stack trace (up to 2KB), source file, line number, column number, page URL, page template, browser, device type, screen width, connection speed, and an anonymous session ID. Bloodhound never stores IP addresses, cookies, form data, or any personally identifiable information.

Question 10

Can I see which errors are affecting the most revenue?

Accepted Answer

Yes. On Pro and above, you set your store's average order value (AOV) and conversion rate in Settings. Bloodhound multiplies affected session count × your CR × your AOV to produce a revenue-at-risk estimate per issue. Every issue card shows the number. Sort by it to fix the most expensive bugs first.

Question 11

What is auto-regression detection?

Accepted Answer

When you mark an issue as Resolved, Bloodhound keeps watching for the same error signature. If the same pattern reappears in new sessions, the issue automatically reopens as Regressed and triggers a fresh alert. You find out within minutes, not when a customer complains.

Question 12

Which Web Vitals does Bloodhound measure?

Accepted Answer

All five: Largest Contentful Paint (LCP), Cumulative Layout Shift (CLS), Interaction to Next Paint (INP), First Contentful Paint (FCP), and Time to First Byte (TTFB). LCP, CLS, INP, and FCP use the PerformanceObserver API. TTFB uses the Navigation Timing API.

Question 13

How are CWV scores calculated?

Accepted Answer

Bloodhound aggregates real user measurements daily at the 75th percentile (p75) per store per page template. Scores are green, amber, or red based on Google's published thresholds, the same ones Google uses in Search Console and PageSpeed Insights. You also get 30-day trend charts per metric per template.

Question 14

Why p75 and not average?

Accepted Answer

Averages are pulled down by your fastest users and mask problems for slower ones. Google recommends p75 because it represents the experience of a real user near the slower end of your audience, the people most likely to bounce. It's the same methodology Google uses for the Core Web Vitals ranking signal.

Question 15

Does Bloodhound measure CWV on a per-page-type basis?

Accepted Answer

Yes. Bloodhound detects the Shopify page template from each session (home, product, collection, cart, checkout, search, blog, account, etc.) and segments CWV data by template. So you can see that your product pages have a bad LCP while your home page is fine.

Question 16

What does script analytics measure?

Accepted Answer

For every JavaScript file that loads on your storefront, Bloodhound records: the origin domain, filename, transfer size, load duration, main-thread blocking time, and whether it's first-party or third-party. Data is aggregated across a 7-day rolling window and grouped by origin.

Question 17

Which third-party apps does Bloodhound recognise by name?

Accepted Answer

Bloodhound recognises 40+ named Shopify apps including Klaviyo, Hotjar, Yotpo, Judge.me, Tidio, Intercom, Privy, Smile.io, FullStory, Segment, Facebook Pixel, TikTok Pixel, Pinterest Tag, and more. For the heaviest offenders, Bloodhound shows specific uninstall guidance. Apps it can't identify by name still appear by origin domain.

Question 18

What is the Apps audit?

Accepted Answer

Part of the Business plan. The Apps audit ranks every third-party script origin on your storefront by main-thread blocking time, the metric that directly damages your INP and LCP scores. It names the app where possible, shows its blocking time, and gives you a clear signal on which ones are worth removing.

Question 19

Which plan includes script analytics?

Accepted Answer

Script analytics (including the Apps audit) is available on Pro and above.

Question 20

How does checkout monitoring work?

Accepted Answer

Bloodhound installs a Web Pixel extension that subscribes to Shopify's Customer Events API inside checkout. This gives access to: page_viewed, product_viewed, product_added_to_cart, search_submitted, checkout_started, checkout_address_info_submitted, checkout_contact_info_submitted, checkout_shipping_info_submitted, payment_info_submitted, and checkout_completed. Each event includes timestamp, URL path, order ID (on completion), order value, currency, and line item count.

Question 21

Why can't Bloodhound capture JavaScript errors in checkout?

Accepted Answer

Shopify's checkout is a sandboxed environment. No third-party app can hook window.onerror, access the DOM, or intercept network requests inside checkout. This is a platform constraint, not a Bloodhound limitation. It applies to every monitoring tool. What we can do is give you the complete funnel picture via Customer Events.

Question 22

Does checkout monitoring store customer PII?

Accepted Answer

No. Bloodhound captures order value, currency, and line item count, never customer names, email addresses, shipping addresses, or payment details. Those live in Shopify and we never touch them.

Question 23

What does the secret leakage scanner do?

Accepted Answer

There are two scanners. The client-side scanner runs on every page load and inspects outbound fetch URLs, XHR URLs, error stack traces, and inline script tags for exposed API keys. The server-side scanner runs weekly and fetches the body of your first-party script files. Both look for the same patterns: Shopify Admin tokens (shpat_*), Shopify Storefront tokens (shpss_*), AWS access keys (AKIA*), Google API keys (AIza*), GitHub tokens (ghp_*, gho_*), Slack webhooks, Klaviyo private keys (pk_*), SendGrid keys (SG.*.*), Mailchimp keys, and PEM private keys.

Question 24

Does Bloodhound store the actual secret value if it finds one?

Accepted Answer

Never. If a match is found, Bloodhound stores only: the pattern type (e.g. shopify_admin), a redacted sample showing the first 4 and last 4 characters (e.g. shpa***a7b3), the source surface (fetch URL, inline script, etc.), and the page URL. The full secret value is never transmitted, never stored.

Question 25

What is the security header audit?

Accepted Answer

On Business, Bloodhound fetches your storefront root weekly and scores your HTTP security headers 0-100. It checks: Content-Security-Policy (30 pts), Strict-Transport-Security (20 pts), X-Content-Type-Options (10 pts), Referrer-Policy (10 pts), Permissions-Policy (10 pts), X-Frame-Options (10 pts), and Cross-Origin-Opener-Policy (10 pts). Each missing header gets specific remediation guidance.

Question 26

What is supply-chain provenance?

Accepted Answer

You define an allowlist of script origins you trust in Settings. Any third-party script that loads on your storefront from an origin outside your allowlist is flagged as an untrusted_origin finding. This gives you early warning of Magecart-style supply-chain attacks, where malicious JavaScript is injected via a compromised third-party vendor.

Question 27

What is vulnerable library detection?

Accepted Answer

Bloodhound checks the URLs of scripts loading on your storefront against a curated list of known-CVE library versions: jQuery < 1.6 (CVE-2011-4969), jQuery 1.x/2.0-2.1 (XSS CVEs), Handlebars < 4.0 (CVE-2019-19919), Lodash < 4.17.12 (CVE-2019-10744), AngularJS < 1.6 (DOM XSS), and Bootstrap < 4.0 (CVE-2018-14041). It runs as part of the weekly server-side cron.

Question 28

What is CSP and mixed-content monitoring?

Accepted Answer

Bloodhound listens for the browser's securitypolicyviolation event and captures every Content Security Policy violation in real time: blocked directive, violated URI, source file, line number, and disposition. It also sweeps for mixed content: any http:// resource loaded on an https:// page is flagged. Both run passively from real visitor sessions at no extra cost.

Question 29

Which plan includes the security features?

Accepted Answer

Client-side secret scanning runs on Pro and above. Security header scan and CSP/mixed-content monitoring are available on Growth and above. The full security suite, including server-side secret scanning, vulnerable library detection, supply-chain provenance allowlist, and Apps audit, requires Business.

Question 30

Does Bloodhound track individual users?

Accepted Answer

No. Session IDs are generated per-tab-load and are completely anonymous. There are no cookies, no cross-site tracking, no user accounts linked to monitoring data. The session ID exists only to group events from the same browser tab visit together.

Question 31

Does Bloodhound store IP addresses?

Accepted Answer

Never. Bloodhound uses the CF-IPCountry header from Cloudflare to record a country code only. Raw IP addresses are never logged at any point.

Question 32

What session data does Bloodhound collect?

Accepted Answer

For each session: an anonymous per-tab session ID, ISO country code, browser user agent string, device type, screen width, connection speed, page URL and template. That's it. No cookies, no fingerprints, no tracking IDs, no form values, no localStorage content, no PII.

Question 33

Does Bloodhound scan request or response bodies?

Accepted Answer

No. Bloodhound deliberately does not scan request bodies. That's where customer PII, payment data, and Shopify session tokens live. Response bodies are also not scanned by default. The privacy cost versus the leak-detection value is a bad trade. Merchants who need response-body scanning should use a dedicated DAST tool.

Question 34

How long is data retained?

Accepted Answer

Pro: 30 days. Growth: 90 days. Business: unlimited. Enterprise: unlimited with custom SLA.

Question 35

Is Bloodhound GDPR compliant?

Accepted Answer

Bloodhound is designed with privacy-first principles: no PII, no cookies, no IP addresses, no cross-session tracking. The data it collects is technical telemetry only. You should review the Privacy Policy page for the full breakdown and assess against your own GDPR obligations as the data controller.

Question 36

What alert channels does Bloodhound support?

Accepted Answer

Slack, Microsoft Teams, Discord, and any webhook endpoint. Webhooks must be HTTPS and cannot point at loopback addresses, private network ranges, or cloud metadata endpoints. Bloodhound validates these server-side to prevent SSRF attacks.

Question 37

What triggers an alert?

Accepted Answer

You can configure alerts to fire on: new issues (first occurrence of a new error pattern), regressions (a resolved issue reappears), LCP p75 exceeding a threshold, and error rate exceeding a threshold. Each trigger has a configurable cooldown to prevent alert spam.

Question 38

How many alert destinations do I get?

Accepted Answer

All paid plans (Pro, Growth, Business) support unlimited alert destinations.

Question 39

What's included in Pro?

Accepted Answer

JS error capture and grouping, Core Web Vitals (all 5 metrics), checkout funnel monitoring via Web Pixel, revenue impact attribution, third-party script analytics, console.warn capture, client-side secret scanning, Slack/Teams/Discord/email alerts, CSV/JSON export, 30-day data retention, and 100,000 events per month. $49/month with a 14-day free trial, no credit card required.

Question 40

What does Growth add over Pro?

Accepted Answer

Everything in Pro, plus: weekly security header scan (CSP, HSTS, X-Frame-Options), live CSP violation and mixed-content capture from real sessions, 90-day data retention, and 250,000 events per month. $99/month with a 14-day free trial.

Question 41

What does Business add?

Accepted Answer

Everything in Growth, plus the full security suite: server-side secret leakage scanner, vulnerable library detection, supply-chain provenance allowlist, WCAG 2.2 AA accessibility scanner, Apps weight audit with uninstall guidance, and weekly email reports. Unlimited data retention, 500,000 events per month, geographic breakdown, custom alert conditions, dedicated Slack support, and priority support. $249/month with a 14-day free trial.

Question 42

What is Enterprise?

Accepted Answer

Enterprise adds: unlimited events, per-store REST API access with rotate-able bearer tokens, multi-store dashboard, auto-reporting to Linear or Jira, a dedicated Slack channel, SLA guarantee, and single sign-on. Pricing is custom. Email support@getbloodhound.app.

Question 43

How does billing work?

Accepted Answer

Billing goes through Shopify's standard in-app billing. Your charge appears on your Shopify invoice alongside your other apps. No separate card required. You can cancel any time from the Shopify app admin. Downgrades are prorated.

Question 44

Is there a free trial?

Accepted Answer

Yes. All plans (Pro, Growth, Business) include a 14-day free trial. You get full access to all features on the plan during the trial, no feature gating, no credit card required to start.

Question 45

Can I export my data?

Accepted Answer

On Pro and above, you can download errors, CWV metrics, and script metrics as CSV or JSON for any time range. The format is auto-detected from the file extension you choose.

Question 46

Is there a REST API?

Accepted Answer

Yes, on Enterprise. Bearer-token-authenticated REST API with endpoints for /api/v1/issues, /api/v1/cwv, /api/v1/scripts, and /api/v1/errors. Tokens are generated, rotated, and revoked from inside the dashboard. Documentation is at /app/api-docs inside your Bloodhound admin.

Question 47

Can Bloodhound push issues to Linear or Jira?

Accepted Answer

Auto-reporting to Linear and Jira is an Enterprise feature. It pushes new issues and regressions directly into your project management tool so your engineers never have to manually copy them over.

Everything you need to know

Start your 14-day free trial.