Total the spend on a self-hosted commerce stack and it rarely sits in one place: the hosting invoice, annual extension-vendor licenses, a security retainer, and the salaries of two engineers whose real job is keeping a Composer dependency tree from collapsing. No single line looks large enough to escalate. Adobe ended support for Magento 1 in June 2020, and production stores still run it behind a web application firewall, because nobody ever received a bill labeled “consequences.”
That is the defining property of the maintenance tax: it is never invoiced. It surfaces as a delayed campaign, a checkout bug that takes three weeks to isolate, a peak-season incident. Meanwhile the platform other retailers moved to compounds: Shopify reported $115.57 billion in gross merchandise volume for the second quarter of fiscal 2026, up 31.6% year over year, with B2B GMV up 76%. The gap between those trajectories is what a migration budget buys.
Key takeaways
Adobe ended support for Magento 1 in June 2020; stores still running it carry unpatched risk as a standing condition.
The PCI Security Standards Council made the remaining PCI DSS 4.0 requirements mandatory on March 31, 2025, moving patch cadence into audit scope.
Shopify’s Q2 fiscal 2026 disclosures show B2B GMV up 76% year over year: complex wholesale operations, not just simple catalogs, are the ones moving.
Enterprise migrations commonly run six to twelve weeks; Shopify Plus fees start near $2,300 a month, and published agency rate cards for enterprise build work start near £80,000.
Catalog data quality and redirect mapping, not theme design, are where timelines and revenue break.
What does the maintenance tax on a legacy platform actually cost?
It costs the sum of hosting, extension licenses, security patching, and engineering time that produces no customer-facing change. On a mid-market self-hosted store that runs to six figures annually before a single feature ships — and the largest component, opportunity cost, never reaches the ledger.
The mechanics are specific. Adobe Commerce ships security patches quarterly; each one has to be tested against every installed extension, and conflicts between modules touching the same core classes are ordinary rather than exceptional. PHP version end-of-life forces its own upgrade cycle regardless of what the business wants. Since the PCI Security Standards Council’s March 2025 deadline for the full PCI DSS 4.0 set, falling behind on patches is a compliance finding, not a backlog item.
The strategic cost is harder to book. E-commerce reached 17.1% of total US retail sales in US Census Bureau reporting, and Shopify’s international GMV grew 37% in Q2 FY2026 against 28% in North America. Teams spending capacity on server operations are not shipping a second market.
What is Shopify development, and what does it include?
Shopify development is the build, integration, and optimization work that turns a hosted commerce subscription into a retailer’s actual operating system: theme and storefront engineering, private and custom apps, ERP and warehouse integrations, B2B catalogs and price lists, checkout extensibility, and the automation that replaces manual back-office steps.
What matters to a CFO is which costs leave the base: server provisioning, patch testing, storefront PCI scope and uptime engineering move to the vendor. What remains is eCommerce development spend aimed at merchandising, conversion and integration — work with a defensible link to revenue.
How is a migration budget phased, from discovery to launch?
In four fundable stages. Discovery and audit maps catalog, integrations, and URL inventory. Build covers data migration, theme, and app configuration. Integration re-plumbing reconnects ERP, tax, shipping, and marketing systems. Then a launch phase handles redirects, DNS, and post-cutover monitoring. Six to twelve weeks is typical at enterprise scale.
Discovery is the stage finance teams underfund and later regret. It is where you learn that 8,000 of 30,000 SKUs have no canonical product data, that tax logic lives in a bespoke extension nobody documented, and that three integrations run through a nightly file drop on a server the vendor decommissioned. Those discoveries are cheap in week one and expensive in week nine, which is why budgeting only the build phase is the standard error: the build is estimable, and the integration surface is where variance lives.
What preserves SEO equity, and what quietly breaks?
A complete redirect map, preserved metadata and structured data, and identical or improved page-speed metrics. What breaks is URL structure: Shopify enforces /products/ and /collections/ path prefixes, so Magento’s .html suffixes and nested category paths cannot be carried over. Every legacy URL needs a 301 to its new equivalent.
That mapping is routinely underestimated, which is why Shopify migration services are scoped as four parallel workstreams — catalog, customers and orders, content and SEO, operations and analytics — rather than one data transfer. Layered-navigation parameters, paginated category pages and CMS pages all accumulated links. Miss them and organic traffic drops in week two, after recrawl.
Two smaller items break predictably: extension-held product reviews, which must be exported before decommissioning, and configurable products whose options exceed Shopify’s variant ceilings.
Which risks blow migration timelines?
Four, in order of frequency: catalog data quality, redirect map completeness, integration re plumbing, and wholesale pricing tables. Each is a data problem disguised as a technical one, and each is discoverable in advance. Timelines slip when discovery is compressed to fit a pre-chosen launch date.
Wholesale deserves separate treatment. Magento customer-group tier pricing must be rebuilt as Shopify B2B company accounts, catalogs and price lists — a different model, not a different syntax, and one requiring Shopify Plus. It is also the least standardized work in the project.
Which retailers should not migrate?
Several categories. Retailers with order logic embedded in a heavily customized ERP, where the storefront is the thin layer. Manufacturers running configure-price-quote flows with
thousands of option permutations. Anyone mid-way through an ERP or WMS implementation. And stores whose legacy cost sits below the payback threshold.
Shopify’s disclosures put merchant retention at 92% above $1 million in annual GMV and 97% above $10 million, which argues for stickiness — not that every catalog fits. A vendor unwilling to name what will not map cleanly has not finished discovery.
Frequently asked questions
How should Shopify development spend be treated on the P&L? Practice varies by jurisdiction, but migration and build work is commonly capitalized as software development, while subscription and optimization retainers sit in operating expenses. Confirm with your auditors.
Will organic traffic drop after a replatform? A short dip during recrawl is normal. A sustained decline almost always traces to an incomplete redirect map or lost metadata — preventable in discovery, expensive afterward.
Can wholesale and retail run on one Shopify store? Yes, with B2B company accounts and price lists on Shopify Plus. Retailers whose dealer-network rules exceed per-company price lists should test that model against real contracts first.
Figures are drawn from Shopify Inc.’s Q2 fiscal 2026 earnings disclosures, US Census Bureau retail e-commerce reporting, Adobe’s Magento 1 end-of-support notice, and PCI Security Standards Council deadlines.
