Limit frame-ancestors to sites you trust on Shopify
Why it matters
frame-ancestors with * or a bare scheme lets any website frame your pages, which is exactly what clickjacking needs. List only your own origin and the partners that really embed you.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify sets the storefront's framing headers and stores cannot change them.
Related
Scan your domain to see whether this applies to you.