Orders for products that don't have an add to cart button

[Sheryl_Marcus]

My store has received several orders for products that have no add to cart button. These products are not for sale, and therefore have no price attached to them, so the orders are coming through with $0 price tags. The products have a 0 set for their inventory, so I'm not sure how they're even being ordered. Shopify Support is suggesting that the issue is with the theme itself, and not the platform. If anyone has dealt with this problem or is willing to review the code to identify the vulnerability allowing for this, I'd be very appreciative!

Example of a product that was "ordered" without an Add to Cart button: https://mezuzahmosaics.com/collections/menorah-collection/products/marcovsky-hanukkiah

[PaulNewton]

Hi @Sheryl_Marcus 👋 It's bots using the ajax api to try and "buy" free product.

https://shopify.dev/docs/api/ajax/reference/cart 

Publishing a product to the on the online sales channel frontend means this cannot be prevented.

Shopify has no concept of presentation only products: archived products, request-price products, etc.

Workarounds:

1. Give such products an excessive shipping rate, or an absurd high price, $10,000,000,000,000,000.00
2. Use metaobjects and webpages feature to present product landing pages.
3. Or shopify-function apps to handle such orders in the checkout.
4. or shopify-flow, or mechanic app, to auto-cancel such orders.