Shopify and Storyblok configurations

These are starting points, not defaults. They come from audits of 18 Shopify and 12 Storyblok projects on squirrelscan v0.0.108, contributed by @deniskern (#695). We have not re-checked each exclusion against a live site, so treat every line as something to confirm on yours with squirrel audit --no-ignore and by reading what the rule says before you silence it.

Both templates are kept in the repository as test fixtures (apps/cli/tests/fixtures/stack-configs/), so a rule renamed or an option dropped breaks a test instead of your config. A rule you disable is not run, and its findings are not in the score: say why next to each one, as below.

Shopify

Shopify controls the response headers, the cookies it sets and part of the delivery stack, so findings about those cannot be fixed in the theme.

Setting	Why
crawler.exclude: /cart/**, /checkout/**, /account/**, /orders/**, /policies/**	Transactional and account pages are not content you audit.
crawler.allow_query_params: page, sort_by, filter.v.price, filter.v.option, filter.p.tag, q, variant	The query strings that change a collection page. Others are dropped so one collection is not crawled once per tracking parameter.
rules.disable: security/csp, security/hsts, security/http-to-https, security/form-captcha	Shopify controls these response security headers and the captcha transport.
rules.disable: eeat/author-byline, eeat/author-expertise, eeat/affiliate-disclosure, eeat/citations, eeat/disclaimers, eeat/editorial-policy, eeat/ymyl-detection, eeat/content-dates	Publisher authorship and editorial claims do not fit a product storefront. The content and legal checks stay on.
[[ignore]] security/cookie-flags, items localization and cart_currency, checks cookie-httponly and cookie-secure	Shopify creates these two cookies without HttpOnly or Secure. Only those checks are waived, and a merchant’s own cookies are still reported.
rule_options for eeat/about-page and eeat/privacy-policy	Shopify serves them under /pages/... and /policies/..., in several languages. List your own paths.

The contributor’s file also disables perf/cache-headers, perf/preconnect, perf/source-maps, perf/compression, perf/http2, perf/ttfb, perf/unminified-js, perf/legacy-js and perf/duplicate-js, and marks them provisional: they reflect what that store’s apps and theme produced against rules that have since changed, and are not established platform limits. They are not recommended here. Start with those rules on.

Shopify also throttles an eager crawler: see Crawling rate-limited hosts for the per-host delay and concurrency settings.

Storyblok

Storyblok is a headless CMS: the site is a frontend (Next.js, Nuxt, Astro or SvelteKit) that renders its content, with an editor that frames it.

Setting	Why
crawler.exclude: /_storyblok/**, *?_storyblok=*, *?version=draft*, *?token=*, and the framework and API paths (/api/**, /_next/**, /_nuxt/**, /_astro/**, /_app/**, /_ipx/**, *.json)	The editor transport, preview and draft URLs and framework assets are not public rendered pages.
crawler.drop_query_prefixes: _storyblok	The editor adds its own parameters.
rules.disable: security/x-frame-options	The editor frames the site. Use CSP frame-ancestors as the control instead.
rules.disable: eeat/affiliate-disclosure, eeat/ymyl-detection, eeat/disclaimers, eeat/editorial-policy, eeat/citations, eeat/author-expertise, eeat/trust-signals	Publisher and editorial trust claims are not requirements for a generic CMS site.
rules.disable: schema/product, schema/review, schema/local-business	A general-purpose content site has no product, review or local-business catalogue. Keep them on if yours does.

Using a template

Copy the settings you agree with into your squirrel.toml and run squirrel config validate: it checks every [rule_options] table and [[ignore]] entry against the rules that exist. See configuration for the full reference and [[ignore]] for waiving one finding without disabling a rule.