Now listed · Shopify App Store
WebDecoy is now on Shopify. Detect suspicious storefront activity, connect it to orders, and give your team the evidence to act. Track AI crawlers and referrals from the same Shopify admin.
Free plan available · Shopify billing · No separate WebDecoy login
From storefront to staff review
Browser signals, request context and decoy interactions.
Correlate sessions and related actor activity with orders.
Tags, risk assessments and the response workflow you choose.
Order intelligence
An unfamiliar IP is not a verdict. A shopper using a VPN is not automatically a fraudster. WebDecoy brings multiple signals together so you can investigate what actually happened.
For correlated suspicious orders, your team can inspect the detection, the session and available actor history. Risk assessments appear in Shopify’s native Fraud analysis panel, with bot-score and risk-level metafields for your own workflows.
Use the Flagged Orders queue to record a review, mark activity legitimate or suspicious, and leave notes. Start with evidence and staff review before automating a response.
The complete Shopify integration
Storefront signals, order investigation, AI traffic reports and a setup check you can verify. Here’s what’s available and how each piece fits.
Make automated browsing visible without adding a CAPTCHA to your storefront.
Give scrapers something to reveal themselves on, away from your real catalog.
Investigate related detections together rather than reviewing each IP in isolation.
Bring detection evidence into the order workflow your team already uses.
Choose how your team responds to a high-risk order.
Separate observed catalog crawling from visitors arriving through AI assistants.
Check that collection works before treating a quiet dashboard as a quiet store.
Manage the integration inside Shopify with clear operational boundaries.
Approve the app in Shopify, open it from your admin, and choose the plan that fits your store. A Free plan is available.
Open the theme editor, go to App embeds, enable WebDecoy Bot Detection and save. No manual theme-file edits. Checkout uses a separate Web Pixel.
Create a labeled storefront test, visit its link, and return to confirm delivery. Check storefront and checkout delivery status separately. Test events stay out of traffic metrics and order review.
Your store. Your decisions.
The order-created handler flags correlated suspicious orders; it does not independently cancel them or stop checkout. Pro and Agency include Shopify Flow triggers. Import the review or staff-notification template, check its settings, then enable it. Cancellation is available through a separate Flow action only when you build and activate that workflow.
The app embed runs on the storefront. Checkout events come through Shopify’s pixel sandbox and may depend on consent and browser conditions. An order needs a matching session and detection for correlation. A browser script cannot observe every non-JavaScript scraper that retrieves public pages without touching a decoy.
AI crawler reports show observed activity; AI referrals show identifiable visits. Robots.txt guidance helps express your policy to cooperating crawlers. A separately hosted storefront or edge protection has its own platform setup; this app does not install an edge validator in front of Shopify-hosted checkout.
Billed through Shopify
Choose a plan inside Shopify. Monthly prices below are in USD; Shopify shows current annual options and trial availability before you approve.
$0/month
Free plan
$59/month
14-day free trial
$149/month
14-day free trial
$449/month
See trial availability in Shopify
Before you install
Yes. WebDecoy was approved and publicly listed on October 2, 2026. Install it from apps.shopify.com/webdecoy-bot-protection.
Install WebDecoy, open your theme editor, enable the WebDecoy Bot Detection app embed, and save. Then use Setup & health to create and confirm a labeled storefront test detection. Theme files do not need manual editing.
A separate Web Pixel reports checkout started, payment information submitted and checkout completed. Pixel delivery can depend on customer consent and browser conditions. The storefront app embed does not run inside Shopify-hosted checkout.
The order-created handler flags correlated suspicious orders for review; it does not independently cancel orders or block Shopify checkout. If you want automated cancellation, configure and enable your own Shopify Flow workflow using the cancellation action. Review and notification templates leave fulfillment decisions with your staff.
An actor groups related detections using available fingerprint and session evidence. It helps investigate repeat activity across IPs. Correlation depends on the signals available; a profile is not proof of a unique person, and coarse shared identities are treated separately when calculating order risk.
No. The app reports activity that reaches its collection surfaces, including bots that follow a decoy. Non-JavaScript clients that only retrieve public pages may be invisible to a storefront script. Robots.txt guidance is a policy for cooperating crawlers, not an access-control barrier.
Plans are selected and billed through Shopify. The Free plan includes 500 detections per month. Monthly plans are Starter at $59, Pro at $149 and Agency at $449, in USD. Starter and Pro list 14-day trials. Shopify’s plan-selection screen shows current prices, annual options and trial availability before approval.
No. The app is managed inside Shopify admin. A separately hosted frontend or edge integration has its own setup and coverage; installing this app does not deploy a WAF or clearance validator in front of Shopify checkout.
Open Setup & health, verify the app embed and pixel status, and create a storefront test. A received test confirms the installed script, Shopify proxy and detection storage path. The page also shows separate last-delivery and error times for storefront and checkout events.
Available now on the Shopify App Store
Install WebDecoy, enable the app embed, and verify your first test detection.
