Shopify Bot Traffic: What to Check Before Blocking

Start with the action causing the problem. A spike in sessions, fake abandoned checkouts, repeated payment attempts and suspicious orders need different evidence. A country name or a low conversion rate alone is too weak a reason to refuse shoppers.

This checklist helps you collect enough context to choose a response and check whether it helped. Download the incident worksheet, or copy the template below. We build WebDecoy; the product walkthrough shows where our Shopify app fits.

1. Identify what changed in your store

Choose the row that matches the symptom you can actually observe.

A report about one row does not establish what happened in another. Shopify’s bot-identification guidance notes that suspected card-testing attempts might not appear as abandoned checkouts. Look at the relevant payment records as well as the checkout list.

2. Record the report filter before comparing counts

In a supported Shopify Analytics report, inspect the Human or bot session dimension or filter. Save its current setting with the date range and timezone. Compare the same report configuration across periods with similar campaigns.

Shopify filters identified bot sessions out of session-related reports by default, following its September 2026 measurement update. Including those sessions can change the counts you see. A lower count after a filter change is a reporting change; it does not demonstrate that requests stopped reaching your store.

Keep completed orders, payment attempts and bot classifications as separate observations. If a campaign, consent setting or theme changed at the same time, include that change in your investigation.

3. Build one incident record

Use a small, representative sample from a defined window. Save identifiers in your own restricted support system rather than sharing customer details publicly.

Window and timezone:
Store symptom:
Affected product, form or route:
Report name and Human or bot filter:
Observed session / checkout / order references:
Payment-provider outcome, if relevant:
Detection evidence and collection source:
Recent campaign, theme, app or consent changes:
Response, owner and time applied:
Normal shopper flow to retest:
Result and remaining uncertainty:

Include enough information for the next person to find the same event. Keep raw card numbers, security codes, access tokens and customer addresses out of this worksheet.

For example, a burst of abandoned checkouts alongside an empty storefront detection feed leaves an open question: did those attempts traverse the storefront sensor? It does not establish that the feed missed an event it was designed to collect. Verify collection before interpreting the empty log.

4. Verify WebDecoy collection in your own Shopify store

Install WebDecoy from the Shopify App Store. Then:

1. Open your theme editor and go to App embeds.
2. Enable WebDecoy Bot Detection and save the theme.
3. Open Setup & health in the app and create a labeled test.
4. Visit the test link, return to the app and confirm delivery.

If your store has a storefront password, unlock it in your own browser and reopen the test link. A script running on the storefront cannot collect from a page it never loads on.

Development-store walkthrough with a labeled setup test and seeded example orders. The app and embed were already installed. Synthetic narration. This demonstrates the workflow, not production detection accuracy or fraud prevented.

A received test verifies that tested storefront collection path. Check checkout-pixel delivery separately: its sandbox, consent state and browser conditions affect what it can send. See the full setup documentation for the installation steps.

5. Review the evidence and choose a response

WebDecoy brings observed browser signals, decoy interactions and IP context into Shopify admin. When a matching session and detection are available, your team can inspect related order evidence and record a review decision. An unfamiliar network or a VPN is context, not proof of fraud.

For correlated suspicious orders, review the signal details and available session history before deciding what to fulfill. Order tagging, risk assessments and Shopify Flow capabilities depend on plan and configuration. The order-created handler does not independently stop checkout or cancel an order. Cancellation requires a separate Flow workflow you configure and enable. Review the Shopify capabilities and plans.

For payment-attempt abuse, take your incident record to the payment provider and Shopify Support. Ask which controls apply to the affected payment path. A storefront monitoring result is not a payment-stage enforcement guarantee.

Shopify also provides built-in Cloudflare and hCaptcha protections. Its additional checkout bot protection during sales is a Shopify Plus feature. Confirm the controls available to your store before designing a response around them.

Check the result without losing real shoppers

Record one change, its owner and its application time. Retest the affected flow as a normal shopper, then compare the relevant outcome using the same report settings: unwanted records, repeated attempts, review workload or completed legitimate orders.

Keep AI catalog crawling separate from visits referred by AI assistants. Crawling does not prove a citation or a customer visit; missing referrer information remains unattributed. Our AI shopping-agent guide explains the different activities.

Put the evidence in your Shopify admin: install WebDecoy, enable the embed and confirm a setup test. Start with what your store actually reports, then choose the response that fits the affected action.