Tons of bots creating and abandoning carts

[Blakem2244]

Over the last few weeks, I've had a massive influx of bots with similar names and addresses adding low price products to carts and then abandoning them. I've spoken with Shopify support regarding this issue and all they could tell me was to "install bot protection apps" and to turn on re-captcha. Neither has worked.

Almost all the emails are a name with three numbers after (ex. allen690@yahoo.com) and the address is typically empty or is: 

House Number 43, Gray Colony
Bellevue Washington 98006
United States

I dived into the source of these bots by going to customer->select a bot->request customer data, and it says creation source is "Shopify App". Any ideas on how to fix this? These are destroying my conversion rate numbers which are an important metric we use for tracking.

[JanVeroti]

You’re not alone — we’re seeing the increased bot activity across our Shopify Plus store.

We’ve spent weeks working with third-party bot detection providers and even escalated to Shopify Plus support — and here’s what we found:

• The bots are using over 18,000 rotating IPs and common browser user agents, making them indistinguishable from real users

• They are hitting storefront pages, polluting analytics and funnel data, then triggering backend cart events directly

• Apps and captchas do not stop them — they bypass the UI entirely

• The only viable solution is at the Cloudflare WAF layer, which only Shopify controls

Unfortunately, Shopify support has declined to take action at the platform level, instead pointing merchants to apps that can’t technically stop these bots. We’ve now published a public call to action here on the forum outlining the problem, solution, and Shopify’s reluctance to implement a proper fix: https://community.shopify.com/c/shopify-discussions/shopify-bot-exploit-add-to-cart-abuse-is-corrupt...

If you’re affected, please comment and upvote the post. We believe this is a platform-wide security issue, and the more voices involved, the harder it will be for Shopify to ignore.

Let’s get this fixed — together.

[CloudMinion]

Yep, we’ve now been getting up to 400 Bot Add to Cart hits a Day! Including the House Number 43 one. Most seem to be from Bellevue, WA, but filtering for this is just silly. Upgrading to a $2,300/month Plus plan to protect our customers is NOT an appropriate answer from Shopify. This clearly seems to be a way to test Stolen Credit Cards since they seem to stop at the checkout page. Thanks a lot for showing us how important we are to you after years of being faithful customers who recommend you to everyone else, Shopify. This is NOT acceptable for a mature platform of your size and will only drive us to have to put more of our efforts into the evil Bezos beast instead. 😢

[JeremyRoberts]

We are seeing EXACTLY the same issue.
More than 1000 bot customers added per day. Every day, since November 2024.
Our Shopify store (not plus) is tightly integrated with Klaviyo, and in Klaviyo we are seeing bot events that begin in checkout without any page visits (added to cart, checkout started), as well as "fake" form events (from Shopify).

The bots are not adding payment info or trying to run credit cards...
Can't figure out WHY they are here.
 
99% of the bots do not have a first or last name, so my methods have included adding filters to Klaviyo flows to trap no-FirstName-set profiles to its own list, then a flow that deletes the profiles via webhook.
We also have a Shopify FLOW workflow that deletes Shopify customers with 0 orders.
BUT THIS does not help us avoid corrupting the Klaviyo metrics with BOUNCES for checkout started flows and browse abandon flows.
And this does not circumvent or solve for the bots who use a name and look like they complete a klaviyo form and checkout started. these are the profiles that can't be solved by automation.

Klaviyo has been as helpful as they can be, but this is NOT their problem.
But as long as we are syncing Shopify to Klaviyo (backfill checkout form content) - it is corrupting the Klaviyo metrics AND ALL RELATED merchant -created customer lists for advertising.

Shopify refuses to accept any responsibility for this. I have opened cases going back to November.
I added "Negate Bot Protection" app. But it does not do anything in checkout. Where this is all happening.

They appear to have entirely disappeared as of Friday 09-MAY-2025, approx 11:30am EDT -- but that was short lived, and a few days later, then came back with a vengeance! 


I have tried everything.

@JanVeroti the WAF technique in my opinion is tossing the baby out with the bathwater. ESPECIALLY if using a backfill to Klaviyo.

Now, we COULD disable the backfill to Klaviyo, and that would probably eliminate the risk of bounces and bad data in Klaviyo. BUT - we lose the real customer metrics.

I am also part of a global group of merchants that are also experiencing this. We are all seeing similar issues.
Where is Shopify Engineering?

I can share my Klaviyo flows and filters... but this REALLY needs to be solved at the source.
HOW can Shopify permit this traffic to infiltrate and contaminate the servers and all the merchant data?
HEEEEEEELLLLLPPPPP us Shopify?

[JanVeroti]

Hi Jeremy.

You needto push a custom “bot” metric into Klaviyo and create a segment of those profiles (you can do that using shopify flow). Be sure to exclude this segment from all automated flows. The reason is that the sync delay between Shopify/Flow automation and Shopify-to-Klaviyo can still cause bot profiles to be pushed into your email lists. This is critical because maintaining your email sending reputation is key — if it drops, you’ll need to re-warm your list, which is a slow and painful process.

See my full reply that has this part as well on this thread: https://community.shopify.com/c/shopify-discussions/shopify-bot-exploit-add-to-cart-abuse-is-corrupt...

[MaxIntegrations]

Hey all, we have had the same issue for almost 2 months. We have finally resolved it by setting up an O2O proxy with CloudFlare to Shopify's CloudFlare instance and configuring just 1 simple WAF rule. Feel free to contact me with questions, or contract my services to quickly get it set up for you!

If you'd like to contact me, my email address is max@maxintegrations.net

[jrobles2025]

Same here, 

We noticed an abnormal growth in traffic/subscribers. Which consequently increase our Mailchimp bill because they charge per tier on the amount of contacts. I doubt Mailchimp has anything to do with it, but bringing it up just in case it ends up being the common link among everyone... to increase our monthly bill.

[Blakem2244]

What are they attempting to do by adding products to their carts? My company sells fairly high value product ($1000) and what the bots add are accessories usually in the $100 range.

[CloudMinion]

Guessing testing Stolen Credit Cards? Apparently that’s not important enough for Shopify to try to protect us and save our analytics and ability to market to real customers who are considering Completing the Check Out Process.

[Robert_Behnke]

We are seeing the same. 100 per hour for a week. Before we caught it, our Checkout Abandon open rates collapsed completely as a big batch got sent emails. 

There are 3 types:

Those with address: House Number 43, Gray Colony, Bellevue Washington

Those with address: 23, Scottsdale, Happytown

Those with no address.

Almost all of them have an email format that includes 1-2 common names (first or last), and 3 numeric digits in various combinations. eg: smith.sanchez326@gmail.com, allen353taylor@yahoo.com 

Shopify Plus support told us they could not do much about it, that we should contract with a bot blocking app, but here's the reply we got from the best one our developer could recommend:

Our experts have reviewed your order and abandoned cart records, and we have confirmed that a bot is accessing your store. However, unlike typical bots, this one doesn't need to access your product pages and can directly enter the checkout through links like the one below:

Since Shopify does not allow any app to run on the checkout page,  apps like ours, which block IPs and countries, can only run within the Shopify system (on Shopify pages), by the time the bot reaches Shopify, it’s too late to block them. You will need to install some WAF (Web Application Firewall) tools (such as Cloudflare or Sucuri, these are not Shopify Apps). These tools are can intercept the bot requests before they reach Shopify, , and in theory, they can block any malicious access you want to intercept. Only such tools can work.

If the only reason you installed our app is to block this bot, you may consider uninstalling our app, and choose a WAF product to resolve the issues your store is currently facing. If you encounter any issues related to blocking visitors or even with the WAF in the future, feel free to contact us anytime.

Haven't explored what a WAF is or how to install it yet....

Very disappointing that Shopify Plus doesn't make this an SOP.

[JanVeroti]

Yeah, once again Shopify is really showing how on top of things they are. Bot traffic corrupting analytics, inflating marketing spend, and interfering with storefronts — and the best their tech support can offer is “try an app” or “use checkout rules” (for bots that never even reach checkout). Brilliant.

Even escalating through Plus support and asking for help from management leads to radio silence. Really builds confidence in that “enterprise-level service,” doesn’t it?

Anyway, we’re currently setting up an external WAF solution since Shopify clearly isn’t stepping up. I’ll report back here once it’s running and let you all know how it goes.

[Barry_Berhoff]

Require customers to use email to log in to check out and it stops this bot.

[JimmyLax]

We are seeing 1,000+ of these per day since April 7th.  On our site they are not attempting to charge CCs, just starting checkout & add-to cart actions.   Are others seeing CC testing occurring? 

Shopify support has said they can't do anything because it isn't preventing normal checkouts.  I've had to turn off my abandoned cart emails to prevent damage to our email domain reputation. 

[Robert_Behnke]

One thing our email provider helped us do is separate abandon cart from abandon checkout email automations. A user exists from abandoned cart automation if they a) start checkout, or b) place an order. Since the bots are going direct to checkout, you can still capture people are are abandoning cart prior to checkout. 

We then created a BOT segment in our email provider with rules - a) have not opened any message, b) have not placed an order, c) have not visited any URL on our website where URL does not contain 'checkout.' So now we filter out BOT segment from all sends. 

For the new abandon checkout automation, we then also created an exit rule where user exits the automation if a) places order, or b) enters segment 'BOT' 

This is not ideal, but it's allowed us to resume more or less normal email marketing. There may be a few legit users that get swept up in the BOT segment but i think it's very few if any.

[Robert_Behnke]

One thing our email provider helped us do is separate abandon cart from abandon checkout email automations. A user exists from abandoned cart automation if they a) start checkout, or b) place an order. Since the bots are going direct to checkout, you can still capture people are are abandoning cart prior to checkout. 

We then created a BOT segment in our email provider where they have to match all of these rules (and joiners).  a) have not opened any message, b) have not placed an order, c) have not visited any URL on our website where URL does not contain 'checkout.' Now we filter out BOT segment from all sends. 

Then for the newly created abandon checkout automation, we then also created an exit rule where user exits the automation if a) places order, or b) enters segment 'BOT' 

This is not ideal, but it's allowed us to resume more or less normal email marketing. There may be a few legit users that get swept up in the BOT segment but i think it's very few if any.

But if Shopify truly wants to live up to its reputation as world-class e-commerce, they should not force us to contract with third parties like Cloudflare to handle what should be a very SOP thing.

[JanVeroti]

We seem to have successfully blocked the cart and checkout exploits by setting up a third party WAF. We are still in testing mode, so I will not share the details yet, but the solution seems to be in sight. Stay tuned and i'll share once solution is fully confirmed.

[Barry_Berhoff]

Please let us know.  Very weak on Shopify's part tha we would need to do this.

[rayrodriguez88]

@JanVeroti do you have a 3rd party team set up the WAF for your store? If yes, can you recommend them to us, it's hard to find trusted 3rd party security engineers online now. Thank you!

[JanVeroti]

Hi. Yes, I’ve been working with a third-party team on a custom setup to deal with this.

The solution we’ve integrated is essentially an O2O (origin-to-origin) CDN-layer addition that sits in front of Shopify — similar in concept to how Cloudflare works. Our WAF (Web Application Firewall) runs on Akamai and is specifically designed for bot mitigation. Since implementing it, we haven’t had a single bot-related issue.

That said, it’s important to understand the trade-offs. Once you adopt this type of solution, you can’t run another CDN in parallel — which means you lose out on services like asset delivery optimization, page speed boosts, DDoS protection, etc. So your site must be cleanly coded and optimized to pass Core Web Vitals without the help of a traditional CDN before going down this path.

There are some SEO considerations too. Since the checkout domain becomes custom (via DNS), clicking back to the site from checkout keeps the checkout. subdomain in the URL — which has on-site SEO implications. A fix via Checkout Extensibility is in the works, but for now, you can patch it by replacing the native logo with a custom image link, adjusting your robots.txt, and using proper rel attributes.

Also worth noting: since the WAF performs deep bot detection (evaluating IP, ASN, ISP, headers, device info, etc.), you might occasionally hit a frontend verification check if you’re doing lots of refreshes while working on the site. It’s not messy, just something to be aware of.

I’d love to share the contact info for the company behind this, but they’ve asked me not to for now. They’re planning to launch a Shopify app soon (mostly a UI for DNS onboarding + traffic reporting). I’ll update here when I get the green light to share more.

[rayrodriguez88]

Thank you so much, @JanVeroti this is going to be helpful for all of us here. Appreciate it! Please keep us updated, curious about this app they're launching!

[CloudMinion]

Been following you closely @JanVeroti hoping to hear that you’ve got the answer that will save us. We’ve been dead in the water with this chaos and really disappointed in Shopify for not doing anything about it. Kudos to your team for finding a solution. Crossing my fingers that it’s something we can afford in order to get our shop and marketing rolling again. Frustrated as heck that Shopify isn’t making this a priority for the customers that put their trust in them.

[Robert_Behnke]

Our bot attack seems to have finished. Not sure if Shopify did something or the bot just ran its course. 18,000 bad emails later...

[CloudMinion]

Keep us posted on whether this is indeed getting better. We’ve had false hopes as well as they seem to pause and come back fairly quickly in waves. We had a few (10-ish) after midnight last night (less than usual) but yesterday we still had a fair amount.

[JanVeroti]

We have successfully blocked bots. Now we’re in cleanup mode (all theirs party integrations need to be checked and updated if needed, these still some unknown seo implications, URLs structure of Shopify nav links needs to be manually updated,…). I need few more days to finalize this then I’ll post what I’ve done (to make sure I don’t give anyone wrong directions )

[t1m]

Thank you Jan, looking forward to your update. We've been hit by 1000s of bots adding to cart and opening accounts. 

[Robert_Behnke]

The bot attack tailed off for a week or so but now they are back and they are smarter this time. They are visiting home page, visiting, collection, then product before geting to cart and checkout. So it's not as easy to bucketize them into a BOTS segment by lack of pages visted other than cart or checkout. Some bots are also moving from the checkout to the product page (via the link in checkout i assume), Then they add those products to the cart again. So now they are infiltrating our abandon checkout, abandon cart, AND abandon product email automations. 

Shopify is pointing the fingers squarely at us - telling us it's our problem and we need to find an app. Which seems completely ridiculous. Shouldn't this be part of at least the Shopify Plus deal? I mean this is ABC security stuff, not some nice-to-have enhancement. 

[JeremyRoberts]

EXACT same issue @Robert_Behnke  --and I noticed the same disappearance about 09-MAY-2025, then it all came back with a vengeance about 5 days later. Please see my reply to @JanVeroti above.

[Barry_Berhoff]

This bot issue is crazy and nonstop.  You can stop the abandonded cart by require log in, but the rest of the site gets tons of fake traffic killing any value to analytics.  Shopify is just ignoring this issue.

[Robert_Behnke]

I don't know if this is just a coincidence. I know best practice is to unsubscribe instead of delete known bad emails. However a few days ago i just got so frustrated at the 90K plus emails clogging up shopify and omnisend (our version of klaviyo). Even though we had been mainly successfully quarantining them with rules based segments (no orders, less than 5 page visits including checkout). I went ahead and DELETE this segment. Then 100 more per hour. Then delete again after another day and 2000+ bad emails. Repeat repeat repeat. Last time i mass deleted was about 3 hours ago and i only have 28 new bot emails. So maybe actively deleting does *something* to the sender to slow it down? I'm sure i deleted a handful of legit customers (at least subscribers, not customers since anyone who has made a purchase is not in the bot segment). 

Will post again if i truly see a big slowdown that endures.

[Robert_Behnke]

I'm still getting some but it looks like, at least for now, the pace is 1 every 3 minutes or so instead of like 5 per minute.

[JeremyRoberts]

---

@Robert_Behnke wrote:

I know best practice is to unsubscribe instead of delete

---

Yes, but... the bot emails are useless, and there is no redeeming or future value of the profile as suppressed or unsubscribed.
An unsub or suppressed profile can feed retargeting or custom audiences. But bot profiles have no value.
Make them go away.

[Robert_Behnke]

That's what i'm doing now. Thanks for the validation.

[JanVeroti]

The solution is here.

As I mentioned in earlier posts, we’ve spent weeks battling Shopify’s inability to deal with malicious bot traffic, especially fake add-to-carts and inflated session data. We implemented a third-party WAF to fix it, and after extensive testing, refinement, and real-world usage, that solution is now available to everyone.

It’s called Armex: Block Checkout Bots and it’s now live in the Shopify App Store.

We’ve been running it in production for a while, and I can confidently say: this is the only real, working solution right now for merchants dealing with Shopify’s lack of bot protection.

• Blocks bots before they hit your checkout
• Cleans up your analytics & ad performance
• No more fake profiles and messed up Klaviyo data
• No more fake sessions inflating data
• Easy setup, no coding - just follow instructions

Install this app and follow the instructions. This is as close to a plug-and-play fix as it gets — and it actually works.

App link: https://apps.shopify.com/bora-ip-blocker-country-block

[Barry_Berhoff]

Thanks for posting this.  What do we know about this app or the developer.  It has been out since November of 2023 and only has 1 review.  How are they able to do what all other apps say they do not have access to?

[CloudMinion]

I agree with Barry_Berhoff’s question. Their app has been around since 2023. Where is the info that this was updated recently to target this? Would love to see some more information from others that this is working and not causing any unforeseen issues.

[ckinnee]

Anyone else tried this solution?  I am at my wits end with these bots, but messing around with our DNS doesn't make me very comfortable. 

[MaxIntegrations]

I'd like to update y'all on our CloudFlare WAF solution. We have since seen a reduction of 99.9% in bot activity, and are still seeing steady human user activity! It has been non-blocking to the user experience, other than a "Please wait a few seconds while we make sure you're human" page when the user first hits the site. It has been extremely effective against these bots, down to only one to three abandoned checkouts a day. It seems the CDN (CloudFlare, AWS, whatever you use) is the only layer of the application at which this activity can truly be stopped.

[Michael_Ryan]

Did it and it works. 

[JeremyRoberts]

---

@JanVeroti wrote:

The solution is here.

Install this app and follow the instructions. This is as close to a plug-and-play fix as it gets — and it actually works.

App link: https://apps.shopify.com/bora-ip-blocker-country-block

---

It Sure Is!

Working PERFECTLY.
And... support has been quick to answer any quesitons.

I am not removing my klaviyo flows or filters, and I am keeping the N8N server too -- but Armex app with the firewall and script is the missing element to say goodbye to the bots.
This SHOULD have been a Shopify solution.
But... Thank you!!

[Michael_Ryan]

Installed and issue fixed within hours. Congrats and a huge thank you for creating a real deal fix for this issue. I can sleep now. 

[SP_MT]

Anyone else quite suspicious of this "solution"? I got these emails from "Boostymark" the "BM: Country blocker IP Blocker" that was also supposedly a secret solution, and started in 2023. Then they recommended going over to the new "Armex" app, which if you look at the privacy policy is generic and clicking into the app owner profile of Bora App, the privacy policy looks generic and similar to Boostymark, but their website is restricted. As I read these reviews for this Bora App "Armex" they seem suspicious. Anyone not affiliated with either app seeing any signs of this working, but also not being something that could potentially be a phishing scam? 

https://static.bora-app.com/private-policy.html

https://rbn.boostymark.com/private-policy.html

[JeremyRoberts]

---

@SP_MT wrote:

Anyone else quite suspicious of this "solution"? 

---

No.

It works.
And they are transparent in the support -- they tell you how to solve this without using their app (if you are on Shopify Plus).

I posted a 5-star review.

[Michael_Ryan]

Armex is owned by BM. They created Armex because the BM app does not solve this issue. We were getting blasted by bots, thankfully only recently. We installed BM and then complained when it did not solve the issue...so BM recommend Armex.

We installed Armex and within 24 hours our bot traffic stopped. We were nervous about messing with the DNS as well but Armex support was super helpful and quick with replies in walking through the set up. (We also used our Server Support Chat to assist with the DNS changes.)

We left one of the reviews for Armex and it is legit. The app is not "public" yet on Shopify search because Armex doesn't want everyone downloading without getting the tech support to properly set it up. (at least that's what they told us). I specifically asked Armex if Shopify is cool with this app since Shopify has done nothing to fix the issue, they said "yes" they have worked with Shopify in the development process to make sure it works properly. 

We have been using it for less than a week and zero bot abandoned carts and zero new customer sign ups. You can see the traffic that is getting blocked...and sales are still coming in as they should. We have not seen any issues with the app interfering in a way that would negatively impact our shop. Try it. It works 

[UGL]

Any update with this. Since yesterday I am having the same bot same address as you are stating happening to me every min.

[MaxIntegrations]

Hey all, we have had the same issue for almost 2 months. We have finally resolved it by setting up an O2O proxy with CloudFlare to Shopify's CloudFlare instance and configuring just 1 simple WAF rule. Feel free to contact me with questions, or contract my services to quickly get it set up for you!

If you'd like to contact me, my email address is max@maxintegrations.net

[Michael_Ryan]

This is the one and ONLY solution. It’s invite by link only as the app is new. I got the link from another blocker app that couldn’t solve our abandoned cart issue. After installing the app I contacted support. They walked me through the steps (took 30 minutes or so). We went from hundreds of abandoned carts and customer signups a day to none in less than 24 hrs. Use the link. This app does what none of the other blocker apps do, fix the issue. 

https://apps.shopify.com/bora-ip-blocker-country-block