Right-click protection is the first instinct most Shopify merchants reach for when they realize how easily their product photography travels. Save image as. Drag to desktop. Open in new tab. Each one is a small leak in what is otherwise a tightly built storefront. The instinct is fair. The standard fix, install an app, is partly fair too. But before you reach for a paid tool, it is worth understanding what disabling right click on Shopify product images actually does, what it cannot stop, and where the line between a theme tweak and an app honestly sits.
This is the unembellished version. We tested right-click protection across the top 10 free Shopify themes, and we ship our own watermark and anti-theft app (Viking Watermark, full disclosure). So we know both ends of the conversation: the merchant picking a tool, and the developer trying to put something useful out. Both sides agree on more than most blog posts suggest.
What "disable right click" actually means on Shopify
Right click is a browser event. When a visitor right-clicks on a product image, the browser shows a context menu with "Save image as", "Copy image", "Open image in new tab", and a few other entries. Disabling right click means intercepting that event before the menu shows and either suppressing it entirely, displaying a copyright message, or doing nothing visible at all. That is the whole feature. It sounds simple because it is.
It is worth being precise about scope. The right-click block only covers the right-click pathway. It does not cover direct image URL access (the file is still served from cdn.shopify.com), browser developer tools (F12 still works), drag-to-desktop save (a different event), mobile long-press (a different event again), or screen capture. A real anti-theft layer covers all of these. Right-click alone covers maybe half. That gap is what most apps in the category quietly market themselves on closing.
The right-click block deters the casual save. It does not stop curl, headless browsers, or anyone with the image URL. Marketing copy that promises "100% protection" is selling a story, not a feature.
The honest three-line answer (no app required)
You can disable right click on every image in your Shopify storefront with three lines of JavaScript. Open your theme code editor, find layout/theme.liquid, and paste this just before the closing </body> tag:
<script>
document.addEventListener('contextmenu', function(e) {
if (e.target.tagName === 'IMG') e.preventDefault();
});
</script>That is the entire trick. No app, no settings panel, no monthly fee. It catches the contextmenu event before the browser default menu appears, checks whether the target is an image, and quietly suppresses the menu if it is. Text right-click and link right-click keep working everywhere else on the page. Should you stop here? For some stores, yes.
If your product photography is generic stock, your catalog is small, and your traffic is mostly bots-and-buyers (not competitors), three lines of JS will deter the small-but-real category of casual theft. The image URL is still public. The page still serves the file. But the right-click pathway closes, and that is enough.
Want to also block drag-save, which right-click suppression does not cover? Add a second listener:
<script>
document.addEventListener('dragstart', function(e) {
if (e.target.tagName === 'IMG') e.preventDefault();
});
</script>Now both pathways close. Test the cart, product page, and product zoom before you publish, because a few themes bind their own contextmenu or dragstart handlers for lightbox and zoom behavior, and your snippet might trip those.
Three things merchants get wrong about anti-theft
Most of the bad assumptions about right-click protection cluster around the same three mistakes. None of them are new, but every "100% protection" sales page reinforces them.
- 01 Belief in total protection. No client-side block stops a determined attacker. The image URL is public, the page is rendered HTML, and any browser can save what it renders. Claims of "uncrackable" should be a red flag, not a selling point.
- 02 Adding alert popups. "Right-click is disabled" popups create more friction than protection. They tell every visitor exactly what they tried to do, often in broken English, and trigger an immediate "what kind of site is this?" reaction. Quiet suppression works better.
- 03 Treating watermarks and right-click as the same problem. A watermark claims attribution if an image walks. A right-click block deters the walk in the first place. They solve different halves of the same question, and neither is a substitute for the other.
Where the three-line trick stops being enough
A few realities are worth knowing before you call the snippet done. Safari respects contextmenu suppression consistently. Some older Firefox builds still leak drag-save through. Mobile browsers handle long-press differently from right-click, and most "disable right click" snippets do not cover the long-press event. Add a third listener if mobile matters to you (and it should):
<script>
document.querySelectorAll('img').forEach(function(img) {
img.addEventListener('touchstart', function(e) {
e.preventDefault();
}, { passive: false });
});
</script>Then there is the bigger issue, the one no client-side script can fix. The image URL is public. Anyone who opens the browser inspector can grab the URL from the Network tab and download the file directly. F12 still works. View source still works. The right-click block hides the URL behind a save menu, but it does not hide the URL from anyone who has glanced at the page source once. Why does Shopify default to serving product images from a fully public CDN with no per-request gating? Because they have to. Storefront performance dies if every image requires an auth check. The trade-off is the price of fast pages.
So the script works for casual theft. The gap between "casual" and "determined" is where apps in this category position themselves, and where the honest answer gets longer.
When an app actually earns its place
We built Viking Watermark for the gap. We will be honest about when it makes sense and when it does not. The script above is enough if you only care about right-click and drag-save, you are comfortable maintaining theme code, and you do not need a settings UI, audit log, or rollback. Keep your money. Paste the script. Move on.
An app earns its place when you want all the protection layers (right-click, drag, DevTools heuristic, keyboard shortcuts, mobile long-press) in one place, when you want watermarks (the only real claim-back if photos do walk), when you want badges (Sale, New, AI-disclosure) without an entirely separate app, and when you want originals safely stored so you can roll back a watermark with one click. Stacking three free apps to cover the same scope is messier than running one paid app, and the maintenance surface grows fast.
Three honest takes that show up in our support inbox a lot. If you only need right-click block, the script does it: do not pay for an app. If you need watermarks plus right-click plus badges, the combo is what Viking Watermark answers. If you need active web monitoring (someone scanning the wider web for stolen images and sending takedown notices), that is a different category entirely. Look at StoreLock for that. We deter theft client-side. They chase it server-side. Both are legitimate; we are not the same product.
A practical defense you can ship today
If you want a layered amateur defense without committing to a paid tool, here is the stack we would actually recommend to a friend. Add the contextmenu and dragstart scripts above to your theme. Test the top five pages. Apply a small, low-opacity logo watermark to your hero product images manually in Canva or Photoshop, just the heroes, five minutes per product. Add an "Image use policy" line to your footer linking to a clear policy page. That last one does not stop theft, but it strengthens any legal claim you might need to make later.
That stack costs nothing, takes an afternoon, and deters every casual save attempt while claiming attribution if a photo walks. It is honest, free, and sufficient for most catalogs.
Three signals suggest it is app time, in case you outgrow the manual stack. You are updating watermarks more than once a quarter. You have 100+ products with photography worth protecting. You want auto-watermark on new uploads, because the manual stack falls behind on every product add. That is when Viking Watermark earns its spot. Until then, the three-line script is the right answer.
(Or just keep the script and never install us. We mean it.)
Frequently asked questions
Can I disable right click on Shopify without an app?
Yes. Three lines of JavaScript pasted into your theme.liquid file before the closing </body> tag will suppress the right-click menu on all product images. The full snippet is in the section above.
Does disabling right click stop Shopify image theft completely?
No. It deters casual save attempts but does not stop browser developer tools, curl, headless browsers, or anyone with the direct image URL. Shopify product images are served from a public CDN with no per-request gating, so the file itself is always reachable.
Will the right-click script break my Shopify theme?
It is a standalone event listener that does not modify your theme files. The only real risk is if your theme already binds its own contextmenu handler for image zoom or a lightbox feature. Test product page zoom and any image gallery after pasting the snippet, before you ship the change live.
Does the right-click script work on mobile?
Partially. Mobile browsers use the long-press event instead of right-click, so the basic snippet covers desktop only. Add the touchstart listener from the section above for full mobile coverage. Most "disable right click" tutorials skip this step, which is why many merchant fixes work on desktop but fail on a phone.
What about drag-and-drop image saving?
Add a second listener for the dragstart event. Together with the contextmenu block, the two snippets close the right-click and drag pathways on desktop. The full code is in the "three-line answer" section above.
When should I use a Shopify watermark app instead of the script?
When you want watermarks, badges, and storefront anti-theft in one dashboard, when you want originals safely stored for one-click rollback, or when you want auto-watermark on every new product upload. Viking Watermark covers all three layers at flat per-image pricing, starting with a free tier of 100 images per month.
Does Shopify itself offer right-click protection or watermarking?
No. Shopify ships no native watermark, no right-click block, and no drag-save protection. Anything in that space is either a theme tweak you add yourself (like the script in this guide) or a third-party app from the Shopify App Store.