How to Stop Bots on Your Shopify Store
Bots scrape your products, test stolen cards and fill your checkouts with junk. Here's how to tell which bots you have and keep them out of your store, while Google and real shoppers always get in.
Short answer
Shopify's built-in bot protection is for Shopify Plus flash sales. For everyday bots, Ongoing Defender keeps traffic from cloud servers, Tor and VPNs off your storefront, and blocks card-testing and junk checkouts automatically, while Google and real shoppers always get in.
Which bots are you dealing with?
| Bot | What you'll see | What stops it |
|---|---|---|
| Scrapers | Your products, photos and descriptions turning up on other stores | Datacenter blocking and content protection |
| Card-testing bots | Bursts of failed payments | Automatic blocking of repeated checkouts |
| Checkout bots | Abandoned checkouts full of junk names and throwaway emails | Disposable email blocking and checkout rules |
| Anonymous traffic | Visitors hiding their location behind Tor or a VPN | Tor and VPN blocking |
Why most bots come from cloud servers
Bots run on rented servers in data centers, not on home internet connections. Real shoppers almost never browse from a data center, so blocking that traffic removes a large share of bots in one switch while leaving your customers alone.
How to do it with Ongoing Defender
- 1Install Ongoing Defender and switch on its app embed.
- 2Open VPN & Tor blocking and turn on Datacenters and Tor. Add VPNs and proxies if bots hide behind them.
- 3Turn on Checkout rules, then switch on Stop repeated checkout attempts and Block disposable email addresses.
- 4Add any office or agency networks to Exclusions, so your team always gets in.
- 5Check your store loads normally from your phone.
Checkout rules run on Shopify's own servers, so bots that skip your storefront and go straight to checkout are blocked too.
Good bots always get in
- Google, including Google Shopping, plus Bing, DuckDuckGo, Apple, Yandex and Baidu, so your search rankings are safe.
- Link previews on Facebook, LinkedIn, Pinterest, X, Slack, Discord and WhatsApp, so shared products look right.
- SEO tools like Ahrefs and Semrush.
- Lighthouse is checked like any visitor, so your speed score reflects what shoppers see.
Why Ongoing Defender instead of Shopify's built-in tools
| What you need | Shopify on its own | With Ongoing Defender |
|---|---|---|
| Stop bots on any plan | Bot protection, for Shopify Plus flash sales only | Any paid plan |
| Keep cloud-server traffic off your store | Not built in | One switch |
| Stop card-testing bots automatically | Temporary IP blocks that usually lift within a day | Repeated details blocked until you remove them |
| Keep search engines and link previews working | Not built in | Always let in |
Tips for best results
- Start with datacenter and Tor blocking. They catch the most bots for the least effort.
- Turn on content protection too, so any scraper that gets through finds your photos and text harder to take.
- Exclude your team's office network before switching on datacenter blocking.
- Look over the rules marked Added automatically now and then.
Related guides