Stop Fake Orders.
Keep Real Customers.
Fraud has an identity. WebDecoy tracks the actor behind every bot, card tester, and fake-order script—even as they rotate IPs—then tags, cancels, or blocks their orders from inside your Shopify admin. No CAPTCHAs, no theme edits, no interrupted customers.
Billed securely through Shopify · No separate account · Install in 2 minutes
14 IPs · 9 sessions · one identity
Linked orders:
1
Identity per Attacker
0
CAPTCHAs
<5ms
Added Latency
Shopify
Billing & Data Standards
Bots Rotate IPs. Actors Can't Hide.
IP-based tools evaluate every visit from scratch, so a card tester on a fresh IP looks like a brand-new customer. WebDecoy builds one persistent identity—an actor—for the attacker behind the traffic, and their history follows them no matter how many IPs they burn.
- Persistent Actor Identity
One durable profile per attacker across IPs, sessions, and visits—with a full timeline of everything they've done
- Orders Linked to Actors
Every flagged order connects to the actor behind it, so rotating-IP repeat offenders are caught on sight
- Block Once, Blocked Everywhere
Opt in to block confirmed rotating actors and enforcement follows the identity—not the IP address
IP-based tools see
41
“new visitors”
Each one evaluated fresh. Each one slips through.
WebDecoy sees
1
actor · 41 attempts
Confirmed threat. Blocked across every IP.
The same card-testing run, seen two ways.
- Bot score: 97%
- Triggered a honeypot before checkout
- Actor placed 3 orders from 14 IPs
Order metafields
webdecoy.bot_score: 97
webdecoy.risk_level: highRisk Where You Already Work: On the Order
WebDecoy is a registered Shopify fraud provider. Its verdicts don't live in a separate dashboard you have to remember to check—they show up on the order itself, in the tools Shopify already gives you.
- Native Fraud Analysis Panel
Low/medium/high risk with plain-language reasons, right alongside Shopify's own fraud signals
- Order-Page Risk Block
Inline bot risk and quick actions on the order details page—no context switching
- Flagged Orders Review Page
Every order WebDecoy correlated with bot activity: risk badge, bot score, status, and the underlying detection
- Order & Customer Metafields
Bot score and risk level written as metafields—queryable and usable in your own automations
Stop Card Testing & Fake Orders
Fraudsters test stolen cards on Shopify checkouts. Every declined attempt costs you fees, chargebacks, and processor trust. WebDecoy identifies the actor behind the run—and your rules take care of the orders before they cost you.
- Card Testing Detection
Spots the pattern: rapid small transactions and different cards from the same actor—even across rotating IPs
- Automatic Order Tagging
High-risk orders are tagged in Shopify so your team can review before fulfilling
- Auto-Cancel & Refund, With Guardrails
Cancel orders that cross your risk threshold—with configurable cancel reason, optional refund, and confirmations before anything irreversible
{
"detection_type": "card_testing",
"shop": "your-store.myshopify.com",
"actor": "7c41f9",
"attempts": 41,
"ips_rotated": 14,
"timeframe": "6 minutes",
"signals": [
"multiple_declined_cards",
"checkout_velocity_exceeded",
"headless_browser_detected"
],
"threat_score": 97,
"action": "order_cancelled_and_refunded",
"order_tagged": "webdecoy-high-risk"
}Every Capability, In One List
Rebuilt from the ground up in 2026. Invisible to shoppers, unmissable to bots—and all of it managed from inside your Shopify admin.
Detection
- Invisible honeypot links only bots follow
- Hidden form fields that catch signup & checkout scripts
- Web Pixel signal coverage through checkout
- Headless-browser & automation signals
- Per-detection threat scores
- 60+ verified good bots whitelisted (Googlebot, social previews)
Actor Intelligence
- Persistent actor identity that survives IP rotation
- One profile per attacker across sessions and visits
- Every order linked to the actor behind it
- Actor timeline: detections, sessions & orders in one place
- Repeat offenders flagged as confirmed threats
Orders & Fraud
- Risk surfaced in Shopify's native Fraud analysis panel
- Bot-risk block with quick actions on the order details page
- Flagged Orders page: risk badge, score, status, linked detection
- webdecoy.bot_score & webdecoy.risk_level order metafields
- Automatic order tagging for team review
Enforcement
- Auto-tag suspicious orders
- Auto-cancel high-risk orders with configurable cancel reason
- Optional automatic refund on cancel
- Block confirmed rotating actors (explicit opt-in)
- Safety guardrails before any irreversible action
Analytics & Dashboard
- Live detection feed inside your Shopify admin
- Geographic threat map — self-hosted, no third-party tiles
- Signal breakdown for every detection
- Accurate usage & plan tracking
- “Protection is active” confirmation from first install
Security & Compliance
- Shopify Protected Customer Data approval
- HMAC-verified App Proxy — every request authenticated
- Access tokens encrypted at rest
- Rate-limited detection endpoints
- GDPR data-request & redact webhooks
- Current Shopify Admin API (2026-07) & Theme App Extension — no legacy ScriptTags
Up and Running in Three Steps
Install from the App Store
Approve the app and WebDecoy provisions protection for your store instantly—the dashboard confirms protection is active from the first screen.
Detection Goes Live Everywhere
A Theme App Extension and Web Pixel deploy honeypots and detection signals across your storefront and checkout—no theme edits, no legacy scripts.
Review Risk on Your Orders
See every actor, check risk in Shopify's fraud panel, and let your rules tag, cancel, or block—automatically.
Simple Pricing, Billed Through Shopify
Every plan—including your free trial—is charged on your Shopify invoice via Shopify Managed Pricing. No off-platform checkout, no separate account.
Free
$0 /month
Free forever
- 500 detections/month
- Honeypot links
- Honeypot form fields
- Dashboard analytics
Starter
$59 /month
14-day free trial
- 5,000 detections/month
- Honeypot links & form fields
- Order tagging
- Dashboard analytics
Pro
$149 /month
14-day free trial
- 100,000 detections/month
- Order tagging
- Auto-cancel high-risk orders
- Priority support
Agency
$449 /month
14-day free trial
- 500,000 detections/month
- Order tagging
- Auto-cancel high-risk orders
- Dedicated support
All plans are approved and billed by Shopify. WebDecoy never processes payment off-platform.
Frequently Asked Questions
How am I charged for the Shopify app?
All charges are handled by Shopify through Shopify Managed Pricing and appear on your regular Shopify invoice. WebDecoy never asks for a card and never processes payment off-platform. There is no separate WebDecoy subscription.
Do I need a separate WebDecoy account?
No. Everything runs inside your Shopify admin. Installing the app from the Shopify App Store is all that's required — there is no external login and no off-platform subscription to manage.
Is there a free trial?
Yes. The Starter, Pro, and Agency plans include a 14-day free trial, and there's a free plan with no time limit. Trials and plans are approved and billed securely through Shopify.
Can I cancel anytime?
Yes. Manage or cancel your plan from the app's Billing page, which opens Shopify's own plan-selection screen. Cancellations take effect at the end of your current billing period.
What is an actor?
An actor is WebDecoy's persistent identity for the person or script behind bot activity. Card testers rotate IPs so each attempt looks like a new visitor; WebDecoy recognizes the same actor across IPs, sessions, and orders, so their history follows them and a confirmed threat can be blocked once — everywhere.
Will WebDecoy's risk show in Shopify's own fraud analysis?
Yes. WebDecoy is a registered fraud provider, so its assessment (low, medium, or high risk, with plain-language reasons like “triggered a honeypot”) appears directly in the Fraud analysis panel on the order — alongside Shopify's own signals. Bot score and risk level are also written to order metafields you can use in your own automations.
Does WebDecoy cover checkout?
Yes — a Web Pixel extends detection through the checkout funnel, and enforcement acts on the resulting order: tagging, cancelling, or refunding it based on your settings. Real customers are never interrupted mid-purchase.
Does WebDecoy block Googlebot or other SEO bots?
No. WebDecoy whitelists 60+ legitimate bots including Googlebot, Bingbot, and all major search and social crawlers, so your SEO and social previews keep working while bad bots are caught.
Is my customers' data safe?
Yes. The app holds Shopify's Protected Customer Data approval, access tokens are encrypted at rest, every App Proxy request is HMAC-verified, and GDPR data-request and redact webhooks are handled.
How long does installation take?
Under two minutes. Approve the app and WebDecoy provisions protection instantly — a Theme App Extension and Web Pixel go live across your storefront with no theme edits, and the dashboard confirms protection is active.
Protect Your Shopify Store in 2 Minutes
Install from the Shopify App Store and start catching the actors behind fake orders today. Billing is handled entirely by Shopify—no separate account, no off-platform checkout.