Why are sudden spikes in global site visitors occurring?

[Leigh6]

15 minutes ago my Google Analytics started showing about 100 users on my sites in random parts of the world. Bots? What has caused this and what can I do to stop it?

Thanks

[Shay]

Hi @Leigh6 

Thank you for reaching out to the community forums with your concerns about a traffic spike on your store and where that traffic is coming from. I understand that you are concerned about bots crawling your site, this is a normal concern for many merchants and I can provide a bit more information on this for you.

If you are concerned that the traffic you are seeing in your store analytics is created by bots, you can usually confirm this based on the referrer URL or source that the traffic came from. Specifically, these sections (bottom left) of your analytics dashboard in your store admin. 

If the traffic you are seeing is created by bots, it is not possible to completely block them. You can restrict access to your store based on IP address, which means customers from certain countries might not be able to see your store but this can be circumvented by using a VPN. Because your website is public facing it is open to traffic by both customers and bots alike. There is no specific harm in this and seeing small spikes created by bot traffic is totally normal. I know that this isn't always ideal as it can bloat your analytics. 

I know that Google Analytics has options to block bot traffic from your analytic reports. I am not familiar enough with GA to say for sure if this is supported in conjunction with Shopify, but it is definitely worth looking into. If you don't have GA setup on your store yet, you can see the steps for that here: Google Analytics. 

If you have any additional questions about your store analytics, please let me know.

-Shay

[latburn]

I am also plagued with bots on my site and this is something I've complained about before but to no avail. The bots are visiting my site upwards of 450 times a a day and it's not just inflating Shopify Analytics, it's completely destroying them. Countless fake active carts are the norm. I get hit about 4 times a day and the source is always from the same locations:

Frankfurt AM Main

Ashburn US

Dublin

London

These bots don't register on GA (thankfully) and any app I've tried for Shopify simply doesn't work. The only advice I get from Shopify support is that they are harmless. I get that, but the simple fact is that they are trashing Shopify Analytics which is part of the service I am paying for. If they don't show in GA, then why can't Shopify stop them?

[latburn]

I also forgot to mention that the presence of the bots also inhibit the use of some apps. I wanted to use a paid version of a trust badge, however the subscription charge depended on traffic to my site. The massively exaggerated numbers have made this impossible.

Would anyone from Shopify like to comment on this? It's hardly fair that such a big issue for so many seems to be continually ignored. We are all paying customers after all!

[Shay]

Hi @latburn 

I appreciate the feedback you shared here about your experience with an app that charges based on traffic. I can definitely see how having inflated bot traffic could be detrimental to an app that charges on that type of structure. Have you contacted the app developer about this and let them know that you are not able to use their app because of this pricing structure and the type of traffic your store is receiving? You can contact them directly through the app listing page in our app store to let them know and hopefully the developer will be able to assist you in a pricing plan that works for your business and site. 

I know that it would be great if we had a way to stop bot traffic on your store, but regardless of the platform or website host, there is no easy way to do so. The most accurate solutions are for businesses to look into advanced software for their website that uses machine learning to recognize and stop bot traffic. This is not something we are able to provide as each store is unique and requires it's own setup. I have a great article from Cloudflare (a widely used website infrastructure platform) on this topic:

• Cloudflare - What is Bot Traffic 

And here is a quote on the topic of managing bot traffic from that article:

How can websites manage bot traffic?

The first step to stopping or managing bot traffic to a website is to include a robots.txt file. This is a file that provides instructions for bots crawling the page, and it can be configured to prevent bots from visiting or interacting with a webpage altogether. But it should be noted that only good bots will abide by the rules in robots.txt; it will not prevent malicious bots from crawling a website.

A number of tools can help mitigate abusive bot traffic. A rate limiting solution can detect and prevent bot traffic originating from a single IP address, although this will still overlook a lot of malicious bot traffic. On top of rate limiting, a network engineer can look at a site’s traffic and identify suspicious network requests, providing a list of IP addresses to be blocked by a filtering tool such as aWAF. This is a very labor-intensive process and still only stops a portion of the malicious bot traffic.

Separate from rate limiting and direct engineer intervention, the easiest and most effective way to stop bad bot traffic is with a bot management solution. A bot management solution can leverage intelligence and use behavioral analysis to stop malicious bots before they ever reach a website. For example, Cloudflare Bot Management uses intelligence from over 25,000,000 Internet properties and applies machine learning to proactively identify and stop bot abuse.

At this time there is no guaranteed solution for stopping or restricting bot traffic, regardless of the platform you are using. This doesn't mean that your feedback on this topic goes unnoticed though. I have passed this feedback onto our developers to ensure they understand the importance of this to our merchants. If you have additional feedback about this topic please don't hesitate to share it with me here. 

Thank you!

-Shay

[latburn]

Shay,

Thank-you for your reply and I do appreciate it. I'm far from an expert on this so the following points may easily be undermined, but...

I don't much care if an army of bots visit my site as long as they're harmless, so in my mind at least it's not about stopping them. It's simply about not seeing them in Shopify analytics. Without any adjustment to Google analytics (as far as I'm aware) these bots aren't registered. I think I remember reading somewhere that maybe it's because they're not around long enough for the page to fully load, but I'm not sure if there's any truth in that. Regardless of the reason, they just don't show up.

Now other threads on this topic have said the solution is to simply use Google Analytics, and whilst that's a fair point, it isn't a solution because Shopify Analytics is still rendered useless. Equally, contacting an app developer and getting them to workaround the problem is not a solution but a way of deflecting away from the real issue.

I don't mean to sound harsh on this, but when you see something so relentlessly wrong, it really does irritate, and as far as I'm concerned part of the service I'm paying for is rendered useless. This is made seem worse by the fact that something I'm not paying for ie Google Analytics seems to be unaffected. 

So how is it that Google Analytics aren't affected but Shopify is? 

Pete

[Shay]

That's a great question Pete and while I am also not an expert in Google Analytics, I'm happy to share the insight into this I do have. 

To the best of my understanding the reason Google Analytics is able to filter out bot traffic in their analytics reports is because Google has the tools and infrastructure to recognize potential bot creating websites. The source of where the bot comes from can tell Google a lot and they have the database and information about so many websites that they can apply to their review. Google has very in-depth trust factors they use to rank the trust and safety of a website, so if it's a site that creates bots for scraping store data, they are probably going to be able to recognize that and filter it out of their analytics. They have all this because Google's main job is information! We don't have access to that database to be able to apply it to our own analytics.

This is great feedback though and I have submitted all the points you have brought up here to our developers to be aware of. 

-Shay

[NickL0327]

@latburn were you able to resolve this? fast forward to almost 2023... and I am having the same issue... my Shopify Analytics Session Report is totally screwed up....

[Chris_amflt]

Can we use Cloudflare in conjunction with Shopify?

[upset]

Shay,

I am also getting a huge influx of bot traffic. I use cloudflare to monitor but I was told by cloudflare that shopify was using cloudflare to stop this. Can you confirm? How else can we stop the bots?

Best,

Dana

[insomniac1234]

We're using the Blocky app right now and it's blocking them. They don't seem to be creating customers on the store. We've blocked around 350 to 400 within the last 2 days when it started.  LA, San Fransisco, Chicago, & Buffalo NY is where most of the VPN traffic is coming. 

[quay-books]

My Quay Books website is based in Ireland
For some reason which I do not understand, for the last 3 days, I am getting a lot of visitors to my Quay Books website from Chile. The great majority of visitors to the website are normally from Ireland. But the number of visitors from Chile is this week exceeding the number of visitors from Ireland. This baffles me! Thanks, Pat at Quay Books.

[AJ84]

I am also facing the same problem. In my case the traffic is from Ireland from a single source and theyre using Linux system. I could see their sessions using Lucky Orange. They just open the website and exit in 8-10 secs and they keep repeating it. And the worst part is they're coming through Facebook so that's costing me unnecessary ad costs.

Any solution to this please? 

[PaddyH]

Been having the same issues over the last month!

Support has been useless! They always point to apps! But the apps dont help here!

They claim is harmless! Well it is not, between intalectual knowlege theft and as was righly pointed out we are paying for a service and the analitics is as good as useless now!

We have two problem areas: Singapore using bytespider or other, they hit every single product and was not showing on google analitics or the firewall app.. 1st they said was nothing, then after hammering back they admited they had opened in internal issue.. But it took so long it had gone through everything! They also pointed out it was a quick connection so was not arround long enough to trigger the firewall log. Between talking to firewall support and them it turns out the firewall app is only handed over to after the page has loaded! So complained that in that time if had image loading disabled could have got the entire HTML downloaded! Always get the typical downplaying and no damage! They have no idea of the long term damage!

The other is Rushian Yandex Browser, over the last month has been constantly knocking at the same page likly 100 times then moves onto another.

They say they have enhanced there internal filters but it has done nothing! and the apps all after the fact do nothing!

While fully expect all creative input has been copied out! This has also completly and utterly destryed and continues destyinging the analitics! its claiming loads of connections! while minimal conversioin, sales. Not only are we not getting what we pay for in the case of good analitics but If we came to trying to sell our store this would trash its value! As it stands we will be looking for another platform once our cycle gets to the end as this is not aceptable and is impacting our business!

[jkenler]

Same sort of issues here. Hundreds to thousands of fake customers being created and "abandoning their carts". We get a couple batches every day. I've tried support multiple times and they admit this is a known issue that shopify developers are working on. Then they suggested anti-fraud 3rd party apps, but when i've tried those and talked to those app developers, the common issue is that they only work with Shopify Plus stores because they need access to the checkouts.liquid file in order to inject protection. Without access to this liquid file, it also appears that manually implementing a honeypot is not an option.

After a couple rounds with this, it was suggested that I try IP or country blocking apps, however, when I asked how I could determine the offending IPs  or even countries, shopify support told me that data was not available to us for customers, but only if they successfully completed an order. Strike two.

These fake customers and cart abandons are causing havoc in our analytics and because we integrate with hubspot I am having to manually purge batches of contacts and deals from there to avoid those analytics being ruined.

Looking around in this community hub, there are related conversations going back at least 2 years. Seems like this issue needs some additional prioritization attention!