How to Block VPNs on Shopify
Visitors on VPNs, Tor and cloud servers are behind a lot of fraud, scraping and country-block workarounds. Here's how to keep them off your Shopify store while real shoppers always get in.
Short answer
Shopify doesn't block VPNs; it flags orders placed through proxies after the fact. Ongoing Defender keeps Tor, known VPNs and datacenter traffic off your storefront with one switch each, while iPhone shoppers using iCloud Private Relay always get in.
Why stores block VPNs
- A VPN is the easiest way around country blocking.
- Fraudsters and card testers use them to hide where they really are.
- Scrapers and bots run from cloud servers rather than home internet.
- Anonymous traffic is behind a large share of abuse, and rarely behind real orders.
What each setting keeps out
| Setting | What it keeps out | Updated |
|---|---|---|
| Tor | Visitors on the Tor network, a common way to hide fraud | Every hour |
| VPNs and proxies | Known commercial VPN and proxy networks | Every day |
| Datacenters | Traffic from cloud and hosting servers, where most bots and scrapers run | Every day |
How to do it with Ongoing Defender
- 1Install Ongoing Defender and switch on its app embed.
- 2Open VPN & Tor blocking and choose what to block: Tor, VPNs and proxies, datacenters, or all three.
- 3If you're browsing through one of those networks yourself, Defender warns you and lets you exclude your IP in one click.
- 4Add any office or agency networks to Exclusions, so your team always gets in.
Blocked visitors see a clear stop page asking them to switch their VPN off and come back, so genuine shoppers know exactly what to do.
Real shoppers always get in
- iPhone and Mac shoppers using iCloud Private Relay, a standard Safari privacy feature, are never treated as VPN traffic.
- Google, Bing and link previews always see your store.
- Your team, excluded customers and anyone in your theme editor are never blocked.
Why Ongoing Defender instead of Shopify's built-in tools
| What you need | Shopify on its own | With Ongoing Defender |
|---|---|---|
| Keep VPN visitors off your store | Not built in; proxy orders are flagged after they're placed | Kept out before they see your store |
| Keep Tor visitors out | Not built in | One switch |
| Stop bots running on cloud servers | Bot protection, for Shopify Plus flash sales only | Datacenter blocking on any paid plan |
| Close the VPN gap in country blocking | Not built in | VPN blocking plus refusal at checkout |
Tips for best results
- Start with Tor and VPNs. Add datacenter blocking if bots or scraping are a problem.
- Pair VPN blocking with country blocking for the tightest protection.
- Turn on checkout rules too, so blocked places are refused at checkout by shipping address.
- Exclude your office network before switching on datacenter blocking.
Related guides