How to Block IP Addresses on Shopify
IP addresses change every time someone switches network. Here's how to find the IP behind an order, and how to block the person behind it so they can't simply come back.
Short answer
You can find the IP behind any order in Shopify's Order risk section. IPs change whenever someone switches Wi-Fi, mobile data or VPN, so the reliable way to keep someone out is to block the person: their email, phone, address and account. Ongoing Defender does that at checkout on any payment provider, and keeps whole risky networks like VPNs, Tor and datacenters off your store.
Why blocking the person works better
An IP address is the easiest detail for anyone to change. The details behind an order are much harder to swap, which makes them far better to block.
| Detail | How easy is it to change? | Block it? |
|---|---|---|
| IP address | Very easy: new Wi-Fi, mobile data or a VPN. Mobile IPs are often shared by many people | Block whole risky networks instead |
| Email address | Easy, but most people reuse a few | Yes |
| Phone number | Harder, and usually kept | Yes |
| Shipping address | Hardest: they need somewhere to receive the goods | Yes |
| Customer account | Linked to all of the above | Yes |
How to find the IP behind an order
- 1Open the order in Shopify admin.
- 2Find the Order risk section and open the risk evaluation.
- 3The IP address is listed there, along with the fraud indicators.
- 4A proxy or hosting company address on a first-time order is a warning sign.
- 5While you're there, note the email, phone and shipping address. Those are what you'll block.
How to block them with Ongoing Defender
- 1Install Ongoing Defender and turn on Checkout rules.
- 2Search for the customer and block their account, email and phone in one click, or use Block at checkout on their page in Shopify admin.
- 3Add their shipping address. Defender matches it however it's typed, so 12 Main Street also catches 12 Main St.
- 4If they used an email domain they own, block the whole domain.
- 5Test a checkout with their details to confirm it's blocked.
Blocked buyers see no payment or shipping options, just your message, on every checkout including Shop Pay and Apple Pay.
Keep risky networks off your store
To keep bots and anonymous visitors away from your storefront, block the networks they use rather than chasing single addresses. One switch each covers Tor, known VPNs and proxies, and datacenter traffic, while iPhone shoppers on iCloud Private Relay always get in.
Make sure your team is never blocked
Add your office, warehouse or agency in one entry, using a range like 203.0.113.0/24, and add your own IP in one click. Excluded addresses skip every block and all content protection.
Why Ongoing Defender instead of Shopify's built-in tools
| What you need | Shopify on its own | With Ongoing Defender |
|---|---|---|
| Block someone at checkout | Fraud Control, for Shopify Payments stores only | Any payment provider, on any paid plan |
| Keep them blocked after they change network | Temporary IP blocks that usually lift within a day | Blocks follow their email, phone and address |
| Keep VPN, Tor and datacenter traffic off your store | Not built in | One switch each |
| Make sure your team is never blocked | Not built in | Exclude IPs and whole ranges |
Tips for best results
- Block the email, phone and address together. It takes seconds and covers far more than an IP.
- Turn on datacenter blocking if bots are your main problem.
- Turn on Stop repeated checkout attempts, so repeat offenders are blocked automatically.
- Exclude your team's networks before switching on network blocking.
Related guides