Shopify Bot Traffic: How to Spot It and What You Can Actually Block

Last updated: 2026-09-28 · Platform features change. Verify with official sources before acting.

Shopify bot traffic is not one problem. Crawlers inflate your session count, spam scripts fill your customer list with names like “xk7Qp2”, and checkout bots test stolen cards against your payment form. Each shows up in a different part of the admin, each does a different kind of damage, and the fix for one does nothing for the others.

This guide sorts them out. It covers what Shopify already blocks without you doing anything, how to tell which kind of bot you are dealing with in about 30 minutes, and which of the commonly suggested fixes are actually available to a store on a standard plan.

If your real question is why a store with visitors has no orders, start with Shopify store not getting sales?. This article is the deeper version of its first step.

Quick answer

• Shopify already filters identified bots out of session reports by default, since its session measurement update rolled out on September 21 to 23, 2026. Classification only covers sessions from October 7, 2025 onward.
• Do not compare conversion rates across that update. Shopify says to use data from after it as your new baseline.
• Bots appear in three places: sessions, customer profiles and checkouts. Check all three before deciding what you have.
• Shopify does not support putting your own firewall in front of the store. Every request already passes through Cloudflare, which Shopify uses. What you control is hCaptcha, robots.txt, and how you clean up and exclude bot data.
• Protect your email list first. Fake addresses in it get sent real recovery and welcome emails.

Who this is for

Good fit: a Shopify store owner who has seen a session spike with no matching orders, a flood of odd customer profiles, or abandoned checkouts that no real person could have started.

Partial fit: Shopify Plus merchants. Everything here applies, but Plus also has a checkout bot protection feature covered briefly below.

Not covered: payment fraud on real orders. That is a separate problem with separate tools.

Contents

• What Shopify already does about bots
• Why your numbers changed in September 2026
• The three places Shopify bot traffic shows up
• A 30-minute bot check
• What you can block, and what you cannot
• Keep bots out of your email list
• Worked example
• What this article does not cover
• Frequently asked questions

What Shopify already does about bots

Three layers run on every store without any setup.

Cloudflare in front of the store. Shopify uses Cloudflare and states that “all requests that come to your online store on Shopify must first pass through Cloudflare”, including a web application firewall and DDoS protection, and that this is always active and needs no action from you.

hCaptcha on forms. Shopify’s online store preferences include a Spam protection section with two options: hCaptcha on contact and comment forms (which also covers the theme’s own newsletter signup form), and hCaptcha on login, create account and password recovery pages. The second option applies to legacy customer account pages; Shopify’s newer customer accounts sign in with a one-time code instead. Shopify says hCaptcha is enabled by default on all stores, and notes that it isn’t compatible with custom code or third-party apps that add their own CAPTCHA. A signup form added by an email or pop-up app is not a Shopify form, so these boxes do not protect it.

Bot filtering in analytics. Shopify classifies each session as human or bot based on the events in it, and describes that classification as deliberately conservative: “it’s better to miss some bots than incorrectly label real customers as bots.” Some bots will still be counted as people. That is a design choice, not a bug.

Why your numbers changed in September 2026

Shopify’s session measurement update rolled out from September 21 to 23, 2026. Three changes matter for bot questions:

One limit predates the update and still applies: bot classification only covers sessions from October 7, 2025 onward, so older data cannot be filtered at all.

Shopify is explicit that “using the same filter setting doesn’t make sessions measured before the update directly comparable with sessions measured after the update,” and tells merchants to use post-update data as the new baseline. Orders, sales and customer counts are not affected.

The three places Shopify bot traffic shows up

Shopify’s page on identifying bot activity lists the signs. Grouped by where you find them:

One detail from the same page catches people out: “suspected card-testing or bot checkout attempts might not appear as abandoned checkouts.” A quiet abandoned checkouts list does not prove checkout bots are absent.

Not every session from a data-center city is a bot; some can be people whose traffic is routed through a Google or cloud service, as the pillar guide explains. The pattern matters more than the city.

A 30-minute bot check

Run this in order. Shopify recommends looking at 30 to 90 days of data and comparing against similar past periods, so set the date range first.

1. Sessions: add the bot dimension. In a sessions report that supports it, remove the default human-only filter, then add Human or bot session as a dimension. You see both counts side by side, which tells you how much the default filter is already removing. Note that the Home page and Live View show filtered data and cannot be adjusted.
2. Sessions: read the locations. Open Sessions by location. Clusters from Ashburn, Los Angeles or Council Bluffs with one-page visits and no cart additions are the pattern to note. Countries you do not ship to, arriving in waves, are another.
3. Sessions: check the landing pages. Hundreds of distinct landing URLs carrying tracking parameters, on a store with modest real traffic, point to automated requests against your marketing links.
4. Customers: sort by date created. Look for bursts of profiles with random-character names, no orders and the same creation minute.
5. Orders and checkouts: look for $0.00 orders and repeated details. Many attempts with the same or nonsensical name, email or address, especially with failed payments, suggest card testing.
6. Compare against real signals. A marketing email, a mention or a sale can cause a genuine spike. If orders, add-to-cart sessions and email signups rose with the sessions, it is probably people.

What you can block, and what you cannot

This is where most advice goes wrong, because it assumes you control the server. On Shopify you do not.

Country blocking comes up in every bot thread. Shopify’s bot pages describe no merchant setting for blocking countries or IP addresses. In a Community thread about a wave of Singapore traffic, merchants discuss apps that claim to do it, with mixed reports; the original poster wrote on September 27, 2026 that Shopify’s new update had fixed the problem for them. That update filters bots out of reports; it does not stop them reaching the store. Treat any blocking app with caution and test whether it changes your numbers before paying for it.

Keep bots out of your email list

Inflated sessions distort a report. Fake subscribers and fake checkout addresses are different: your email tools send real messages to them.

Gmail’s email sender guidelines tell bulk senders to keep reported spam rates below 0.10% and to avoid ever reaching 0.30%. They also tell senders to “make sure recipients opt in” and to “confirm each recipient’s email address before subscribing them.” Automated recovery and welcome emails sent to addresses that a script typed in work against both.

Three practical steps:

1. Confirm new subscribers. If your email tool supports double opt-in, a bot that cannot click the confirmation link does not become an active subscriber. Some email security scanners do follow links, so confirmation cuts fake signups rather than eliminating them. The email capture guide covers where the signup form sits.
2. Clean before you send. When a burst of random-name profiles appears, export and delete them before your next campaign rather than after.
3. Watch the recovery flow during a checkout bot wave. If abandoned checkouts fill with nonsense details, those addresses are receiving your recovery emails. The abandoned cart recovery guide explains what Shopify’s native flow sends and when.

Worked example

This is a composite example, not a case study from one specific store.

A store selling ceramic planters sees weekly sessions jump from about 900 in the last week of September 2026 to 2,600 in the first week of October, with orders flat at 11.

• Step 1 shows the default filter is already hiding a large share of bot sessions, and the remaining jump is real in the report.
• Step 2 shows most of the extra sessions come from Singapore and Los Angeles, one page each, no cart additions. The store does not ship to Singapore.
• Step 4 shows 140 new customer profiles with names like “hTq8vLm2”, all created within two days, none with orders.
• Step 5 shows no $0.00 orders and no failed payment bursts.

Diagnosis: crawler and spam-signup traffic, not card testing. The signups trace to a pop-up app’s form that had replaced the theme’s newsletter form, so Shopify’s hCaptcha was never covering it. Actions: switch back to the theme’s newsletter form (or turn on the app’s own spam protection), export and delete the 140 profiles, turn on confirmation for new subscribers, and judge conversion rate on the post-update baseline rather than against September. No paid blocking app, no robots.txt edit.

What this article does not cover

• Payment fraud on real orders, including chargebacks. See the chargeback and refund SOP.
• Inventory bots during limited drops, which is mainly a Shopify Plus checkout question.
• Writing robots.txt.liquid rules. Shopify warns the edit can remove all search traffic if done wrong.
• Specific bot-blocking apps. None is reviewed or recommended here.

Frequently asked questions

How do I know if my Shopify traffic is bots?

Add the Human or bot session dimension to a sessions report, then check Sessions by location, landing pages, new customer profiles and checkout attempts. Bots show one-page sessions from data-center locations, random-character customer names, and repeated or nonsensical checkout details. Real traffic brings add-to-cart sessions and orders with it.

Can I block bot traffic on Shopify?

Not through any Shopify setting. Every request already passes through Cloudflare, which Shopify uses, and Shopify says it doesn’t recommend or support a proxy in front of the store. Within Shopify you can keep hCaptcha on, edit robots.txt for compliant crawlers, filter bots out of reports, and delete spam customer profiles.

Why did my Shopify conversion rate change in late September 2026?

Shopify’s session measurement update rolled out September 21 to 23, 2026. It filters identified bots by default and counts some sessions without a pageview, which can move conversion rate either way. Shopify says sessions before and after the update are not directly comparable.

Why don’t my Shopify and Google Analytics numbers match?

They count differently. Shopify’s discrepancies page lists reasons including page reloads, JavaScript and cookies, ad blockers, time zones, and whether search bots are counted. Google Analytics 4 automatically excludes known bots using Google research and the IAB bots list, and that exclusion cannot be turned off.

Are bot orders a sign of card testing?

They can be. Shopify lists many $0.00 orders and many payment attempts with repeated or suspicious details as signs of bot activity. It also notes that card-testing attempts might not appear in abandoned checkouts at all, so check orders and payment attempts directly.

Free sheets and calculators

Once the bots are out of the numbers, the free Forvendo calculators and sheets help you read what is left, from fees to margin. None of them needs an account.