If your Shopify analytics show a spike of sessions from a country you don't ship to, add-to-carts that never convert, or a burst of failed payments at 2 a.m., you're not imagining it. A share of every store's traffic comes from scrapers, price bots, card testers and people hiding behind proxies.
Shopify handles a lot of this for you. Some of it, it doesn't. Here's what you can see, and what you can actually do about it, mostly with tools you already have.
1. What Shopify already does
Before installing anything, know what's on by default:
- Platform-level bot protection. Shopify sits behind Cloudflare and filters a lot of abusive traffic before it reaches your store.
- hCaptcha on forms. It's on by default for contact, comment, login and account-creation forms. Check it's still on under Online Store > Preferences > Spam protection.
- Checkout protection. Shopify runs its own checks on checkout. Extra bot protection during high-traffic sales is a Shopify Plus feature.
- Fraud analysis on orders. Eligible orders get a low, medium or high risk recommendation with indicators, and stores on Shopify Payments also get proxy detection. Shopify's own advice is to go by the recommendation, not by any single indicator such as the IP address.
That covers a lot of card fraud. What it doesn't give you is a clear picture of your traffic: how much of it is people, and how much is automated or anonymized.
2. Why the traffic picture matters
Bot and proxy traffic on a store costs you in quieter ways than fraud:
- Wrong numbers. Conversion rate, bounce rate and "sessions by country" all include traffic that was never going to buy.
- Wasted ad spend. Paid clicks from datacenter networks are rarely shoppers.
- Card testing. Waves of small payment attempts, often from rotating proxies, show up as failed payments before they show up as chargebacks.
- Scraping. Competitors and resellers pulling your catalog and prices.
The tell is usually the network the traffic comes from. Shoppers browse from home broadband and mobile carriers. Bots and scrapers run on cloud servers (AWS, DigitalOcean, OVH, Hetzner) and route through proxies.
3. What to look at
Whatever tool you use, these are the questions that matter:
- What share of page views come from hosting or datacenter networks?
- What share of checkouts started come from VPNs, proxies or Tor, and is that share higher than for page views?
- Do payment attempts from risky networks cluster in bursts? That's what card testing looks like.
- Do spikes in "sessions from country X" line up with a single hosting provider?
You'll usually find a few clear patterns (a scraper on one cloud provider, a burst of proxy checkouts on one night) rather than a general problem. Shoppers on VPNs are mostly real people, so a VPN on its own tells you little.
4. What you can do about it
On Shopify, the store front is yours but checkout is Shopify's, so the levers are:
| Problem | What works on Shopify |
|---|---|
| Spam on contact and account forms | Keep hCaptcha on in spam protection settings |
| Risky orders | Read the order's fraud analysis, and use Shopify Flow to tag, hold or flag high-risk orders for review |
| Card-testing waves | Watch failed payments by network and time; Shopify's own checks and your payment provider's rules do the blocking |
| Scrapers and junk traffic in analytics | Identify the networks, then exclude or segment them in your analytics and ad reports |
| Blocking whole countries or VPN users on the storefront | Blocker apps can do it with a storefront script; test carefully, since real customers use VPNs and checkout itself stays Shopify's |
The general rule holds here too: look before you block. A storefront that blocks every VPN user turns away real customers and still can't touch what happens inside Shopify's checkout.
Where FindIP Shield fits
Disclosure: we make FindIP Shield, which does the "what to look at" part for free.
- It uses Shopify's Web Pixels API and reports page views, checkouts started and payment info submitted, each scored for VPN, proxy, Tor, hosting or datacenter network and known malicious IPs, with the reasons, in a dashboard.
- It runs only when the shopper has given analytics consent, under Shopify's Customer Privacy controls.
- It's deliberately minimal: no names, emails, addresses, customer or order IDs, cart contents, search queries or payment details are sent, and page URLs are stripped of query strings.
- It reports; it doesn't block shoppers. Because it never sees order IDs, use Shopify's fraud analysis for individual orders and Shield for the traffic picture around them.
- Free up to 10,000 events per site per day.
It's on the Shopify App Store as FindIP Shield, and there's an example dashboard with sample data and a Shopify overview if you want to see what it shows first.
The short version
- Use what Shopify already gives you: hCaptcha on forms, fraud analysis on orders.
- Find out which networks your traffic comes from: residential, hosting, VPN, Tor.
- Look for patterns (one cloud provider, one burst of failed payments) before blocking anything.
- Act with Shopify Flow on risky orders and segment junk traffic out of your numbers.
- Don't block VPN shoppers outright. Most of them are customers.
