Thank you for reaching out to the community forums with your concerns about a traffic spike on your store and where that traffic is coming from. I understand that you are concerned about bots crawling your site, this is a normal concern for many merchants and I can provide a bit more information on this for you.
If you are concerned that the traffic you are seeing in your store analytics is created by bots, you can usually confirm this based on the referrer URL or source that the traffic came from. Specifically, these sections (bottom left) of your analytics dashboard in your store admin.
If the traffic you are seeing is created by bots, it is not possible to completely block them. You can restrict access to your store based on IP address, which means customers from certain countries might not be able to see your store but this can be circumvented by using a VPN. Because your website is public facing it is open to traffic by both customers and bots alike. There is no specific harm in this and seeing small spikes created by bot traffic is totally normal. I know that this isn't always ideal as it can bloat your analytics.
I know that Google Analytics has options to block bot traffic from your analytic reports. I am not familiar enough with GA to say for sure if this is supported in conjunction with Shopify, but it is definitely worth looking into. If you don't have GA setup on your store yet, you can see the steps for that here: Google Analytics.
If you have any additional questions about your store analytics, please let me know.
I am also plagued with bots on my site and this is something I've complained about before but to no avail. The bots are visiting my site upwards of 450 times a a day and it's not just inflating Shopify Analytics, it's completely destroying them. Countless fake active carts are the norm. I get hit about 4 times a day and the source is always from the same locations:
Frankfurt AM Main
These bots don't register on GA (thankfully) and any app I've tried for Shopify simply doesn't work. The only advice I get from Shopify support is that they are harmless. I get that, but the simple fact is that they are trashing Shopify Analytics which is part of the service I am paying for. If they don't show in GA, then why can't Shopify stop them?
I also forgot to mention that the presence of the bots also inhibit the use of some apps. I wanted to use a paid version of a trust badge, however the subscription charge depended on traffic to my site. The massively exaggerated numbers have made this impossible.
Would anyone from Shopify like to comment on this? It's hardly fair that such a big issue for so many seems to be continually ignored. We are all paying customers after all!
I appreciate the feedback you shared here about your experience with an app that charges based on traffic. I can definitely see how having inflated bot traffic could be detrimental to an app that charges on that type of structure. Have you contacted the app developer about this and let them know that you are not able to use their app because of this pricing structure and the type of traffic your store is receiving? You can contact them directly through the app listing page in our app store to let them know and hopefully the developer will be able to assist you in a pricing plan that works for your business and site.
I know that it would be great if we had a way to stop bot traffic on your store, but regardless of the platform or website host, there is no easy way to do so. The most accurate solutions are for businesses to look into advanced software for their website that uses machine learning to recognize and stop bot traffic. This is not something we are able to provide as each store is unique and requires it's own setup. I have a great article from Cloudflare (a widely used website infrastructure platform) on this topic:
And here is a quote on the topic of managing bot traffic from that article:
How can websites manage bot traffic?
The first step to stopping or managing bot traffic to a website is to include a robots.txt file. This is a file that provides instructions for bots crawling the page, and it can be configured to prevent bots from visiting or interacting with a webpage altogether. But it should be noted that only good bots will abide by the rules in robots.txt; it will not prevent malicious bots from crawling a website.
A number of tools can help mitigate abusive bot traffic. A rate limiting solution can detect and prevent bot traffic originating from a single IP address, although this will still overlook a lot of malicious bot traffic. On top of rate limiting, a network engineer can look at a site’s traffic and identify suspicious network requests, providing a list of IP addresses to be blocked by a filtering tool such as aWAF. This is a very labor-intensive process and still only stops a portion of the malicious bot traffic.
Separate from rate limiting and direct engineer intervention, the easiest and most effective way to stop bad bot traffic is with a bot management solution. A bot management solution can leverage intelligence and use behavioral analysis to stop malicious bots before they ever reach a website. For example, Cloudflare Bot Management uses intelligence from over 25,000,000 Internet properties and applies machine learning to proactively identify and stop bot abuse.
At this time there is no guaranteed solution for stopping or restricting bot traffic, regardless of the platform you are using. This doesn't mean that your feedback on this topic goes unnoticed though. I have passed this feedback onto our developers to ensure they understand the importance of this to our merchants. If you have additional feedback about this topic please don't hesitate to share it with me here.
Thank-you for your reply and I do appreciate it. I'm far from an expert on this so the following points may easily be undermined, but...
I don't much care if an army of bots visit my site as long as they're harmless, so in my mind at least it's not about stopping them. It's simply about not seeing them in Shopify analytics. Without any adjustment to Google analytics (as far as I'm aware) these bots aren't registered. I think I remember reading somewhere that maybe it's because they're not around long enough for the page to fully load, but I'm not sure if there's any truth in that. Regardless of the reason, they just don't show up.
Now other threads on this topic have said the solution is to simply use Google Analytics, and whilst that's a fair point, it isn't a solution because Shopify Analytics is still rendered useless. Equally, contacting an app developer and getting them to workaround the problem is not a solution but a way of deflecting away from the real issue.
I don't mean to sound harsh on this, but when you see something so relentlessly wrong, it really does irritate, and as far as I'm concerned part of the service I'm paying for is rendered useless. This is made seem worse by the fact that something I'm not paying for ie Google Analytics seems to be unaffected.
So how is it that Google Analytics aren't affected but Shopify is?
That's a great question Pete and while I am also not an expert in Google Analytics, I'm happy to share the insight into this I do have.
To the best of my understanding the reason Google Analytics is able to filter out bot traffic in their analytics reports is because Google has the tools and infrastructure to recognize potential bot creating websites. The source of where the bot comes from can tell Google a lot and they have the database and information about so many websites that they can apply to their review. Google has very in-depth trust factors they use to rank the trust and safety of a website, so if it's a site that creates bots for scraping store data, they are probably going to be able to recognize that and filter it out of their analytics. They have all this because Google's main job is information! We don't have access to that database to be able to apply it to our own analytics.
This is great feedback though and I have submitted all the points you have brought up here to our developers to be aware of.
My Quay Books website is based in Ireland
For some reason which I do not understand, for the last 3 days, I am getting a lot of visitors to my Quay Books website from Chile. The great majority of visitors to the website are normally from Ireland. But the number of visitors from Chile is this week exceeding the number of visitors from Ireland. This baffles me! Thanks, Pat at Quay Books.
I am also facing the same problem. In my case the traffic is from Ireland from a single source and theyre using Linux system. I could see their sessions using Lucky Orange. They just open the website and exit in 8-10 secs and they keep repeating it. And the worst part is they're coming through Facebook so that's costing me unnecessary ad costs.
Any solution to this please?