Online store preferences

Open Settings → Preferences for the store-wide controls that sit outside a theme: storefront access, home-page SEO, a default social image, spam protection, crawler credentials, language behavior, and links to pixel settings. These values follow the store when you change or publish a theme.

Store access

Turn on Enable password protection when a storefront must remain private before launch or during a controlled review.

Field	Contract
Password	Required when protection is first enabled; 8–72 characters
Existing password	Never returned to the browser; leave the field blank to keep it
Password message	Optional text shown on the password page; maximum 5,000 characters

1. Enable password protection.

2. Enter a new password when enabling it for the first time (or when intentionally replacing the current password).

3. Add an optional visitor message.

4. Select Save.

Passwords are stored as a one-way bcrypt hash. The Preferences page receives only the passwordProtected state, never the current password or its hash. If protection is already on, saving a blank password retains the existing value. Turning protection off removes the stored gate; enabling it again requires a new password.

The password page uses the theme’s password.json template and the storefront_password Liquid form. Attempts are CSRF protected and rate limited. A successful entry creates the scoped storefront-access session and redirects only to a validated same-store path.

What password protection does to SEO

A protected store is not a partially public catalog:

• robots.txt becomes Disallow: / with no-store caching;
• sitemap.xml and child sitemaps return 404;
• public catalog/review feeds are unavailable; and
• normal HTML pages redirect to the localized password page unless the request has an authorized preview or valid storefront-password session.

Preview authorization does not reveal the storefront to unrelated visitors or crawlers.

Social sharing image and home-page SEO

These fields are the store-wide defaults used by the home page and by sharing metadata when a more specific resource image is not available:

Setting	Limit or recommendation	Runtime behavior
Social sharing image	Image from the store’s media library; 1200×630 recommended	Supplies the home-page/default Open Graph image
Home page title	Maximum 70 characters	Falls back to the store name when blank
Meta description	Maximum 320 characters	Omitted when blank rather than filled with preview placeholder text

The Search engine listing preview uses the active custom/permanent domain, the configured title (or store name), and the description. It is an editorial preview, not a promise that every search engine will use the same truncation or snippet.

Product, collection, page, blog, and article SEO fields remain resource specific and can override their own title, description, and image. See SEO on Sellerlane.

Spam protection

Sellerlane can require hCaptcha on two independently controlled surfaces:

Toggle	Covered buyer actions
Contact and comment forms	Contact enquiries, blog comments, and other documented public enquiry surfaces
Customer account actions	Passwordless OTP login, enrollment, and verification flows

The theme must preserve the hCaptcha response field for native and Ajax submissions. The default theme’s hcaptcha-field snippet renders the widget when the matching shop flag is enabled. The buyer route rechecks the token on the server; hiding the widget or changing the form field does not disable the policy.

Sellerlane customer accounts are passwordless. This account-protection toggle does not enable password activation, recovery, or reset forms.

Crawler access tokens

The Crawler access card creates store-scoped credentials for an explicitly named crawler or AI agent. The current Sellerlane v1 contract is a scoped opaque access token, not a full RFC 9421/Web Bot Auth HTTP-message-signature keypair. Do not describe it as cryptographic request signing parity.

To create one:

1. Select Create signature.

2. Enter an internal label and the required Signature-Agent identifier, such as https://openai.com.

3. Create the credential.

4. Copy the Access token immediately; its plaintext is shown only once.

5. Configure the crawler to send the token and the exact Signature-Agent value.

The buyer accepts the token through one of these carriers, in order:

X-Crawler-Token: TOKEN
Signature-Agent: "https://openai.com"

or:

Authorization: Signature TOKEN
Signature-Agent: "https://openai.com"

The legacy raw Signature: TOKEN carrier is also recognized for this token contract. Sellerlane stores only SHA-256(TOKEN), compares the presented token against active rows, checks the agent case-insensitively, rechecks expiry, and marks the request as an authorized crawler only after all checks pass. A missing, revoked, expired, foreign-store, or agent-mismatched token fails closed.

Use the All, Active, and Expired views to audit credentials. Select Revoke to disable an active credential immediately. Revocation is store-scoped and idempotent. Create a replacement rather than trying to recover a lost plaintext token.

Treat the token like a password

Send it only over HTTPS, keep it in the crawler’s secret store, never place it in a URL, theme, browser script, analytics property, or support screenshot, and revoke it when the integration is retired or suspected to be exposed.

The public agents.md, llms.txt, and llms-full.txt discovery files are separate from crawler authentication. Discovery describes the storefront; possession of an allowed discovery URL does not authorize a protected request.

Automatic redirection and languages

The two Automatic redirection switches are deliberately disabled:

• Country/region redirection is unavailable because Sellerlane does not expose Shopify Markets country/catalog/currency selection.
• Language redirection is not inferred from a visitor’s IP or browser headers. Buyers select a published language explicitly.

Manage primary and published languages in Settings → Languages. The primary language uses the bare URL and each published non-primary language uses its lowercase prefix. When more than one language is published, Sellerlane emits canonical hreflang links automatically. See Locales and translation.

Analytics and pixels

The Preferences page links to Settings → Pixels; it does not inject provider scripts itself. Pixel configuration, channel credentials, server/browser event delivery, consent categories, and diagnostics live on the Pixels page.

Necessary storefront tokens remain separate from analytics and marketing identifiers. Analytics/marketing pixels activate only when the configured provider, event allowlist, CSP, and buyer consent permit them; Global Privacy Control is treated as a marketing opt-out. See Pixels and conversion tracking.

Saving and troubleshooting

The Save button activates after a local change. Preferences are validated again by the seller API, including password length, title/description length, media ownership/type, and the current store boundary.

• Save asks for a password. Protection is being enabled for the first time; enter an 8–72 character value.
• A blank password did not replace the old one. Expected—blank means keep the existing write-only password while protection remains enabled.
• The social image is rejected. Choose an image owned by this store from the media library; another media type/store ID is invalid.
• A crawler credential cannot be created. Both label and Signature-Agent are required. If the entire card reports unavailable, the crawler-access API has not been deployed in that environment.
• A crawler still cannot fetch a gated route. Confirm the exact active custom domain/store, token carrier, Signature-Agent, status, and expiry. Crawler authorization does not bypass unrelated route permissions.
• Changing Preferences did not alter a product’s SEO. Store fields are home-page/default metadata. Edit that product’s Search Engine Listing for a product-specific override.

Next steps

SEO on Sellerlane

Sitemaps, robots, resource metadata, structured data, and feeds — SEO guide.

Pixels and tracking

Provider setup and consent-aware delivery — Pixels and conversion tracking.

Locales and translation

Published locale URLs, fallback files, and language forms — Locales and translation.

Theme compatibility

Exact runtime, storage, consent, preview, and SEO policy — Shopify theme compatibility.