Hi, I have been in contact with support multiple times for this, but they have no answer. Over the last few days, I have been inundated with new John Doe customers and have since deleted over 2000 and deleted over 1000 abandoned carts. I have tried all of their fixes, including downloading an app that they recommended, which did not catch a single bot. I also have the Spam Protection and hCaptcha on in the settings, but they are not working at all. I am so frustrated as I am worried this will impact the security of my site.
Shopify Flow can automatically delete customers as soon as they are created. Just tell it some parameters and let it work.
You have many other options at your disposal, including the double opt in for subscribers so you aren’t maxing out your email automations. Then there are the checkout rule apps and country blocker apps. Then you can add personalized captchas to make it even harder.
But as far as blocking all bots beforehand, you really only have one option: to require sign in. Otherwise, you just need to understand that if a human can add to cart, so can a computer program.
By automatically deleting these customers, does it impact the legitimacy of my site? I just did that and will see how it works. I have never had this issue in 15 years on Shopify until this week and am absolutely inundated. Shopify acknowledges there is a problem and is trying to ‘fix’ it. I just do not want my store integrity to take a hit.
No, it’s a tool for you to use. It won’t impact legitimacy. It won’t let you delete a customer who has already made a purchase, so you don’t have to worry about that.
They’ve updated their fraud prevention methods recently, got rid of Fraud Filter, replaced the AVS with Shopify Protect. They’ve created an app called Fraud Control, which also guides you on how to use Flow and gives you workflow templates. I highly suggest both Blockify Checkout and Blockify Fraud Filter as well.
This is a known issue and it’s usually caused by bots creating customer accounts / abandoned checkouts, not a security breach.
A few things that actually help when hCaptcha and apps don’t:
-
Set Customer accounts → Optional or Disabled (this stops most bot waves)
-
Enable email verification if you keep accounts on
-
Check Analytics → Sessions by location/referrer to spot and block obvious bot sources
-
Bots often generate abandoned carts, so fixing account creation usually stops those too
Shopify’s default protections don’t catch everything because this is abuse of normal forms, not a system bug.
(feel free to reach out for expert support)
Shopify recently introduced New Customer Accounts (found in Settings > Checkout). Unlike the Classic accounts, these require a one-time 6-digit code sent to the email to log in or create an account. Bots cannot easily automate the retrieval of these codes, which effectively kills “John Doe” account creation.
Is john doe bot still active for you? he was testing cards on my website daily since last Aug. but seems to have stopped this past saturday night. No bot checkouts since.
I have figured out how to get rid of JD, but now I have thousands of others. My website is current shut down, but this bot is still able to add to cart and even checkout. I cancelled the order. I am so angry that Shopify is not doing more to protect our sites. I have gone through multiple channels and nothing. I have downloaded an app and nothing.
Disable Shop users to automatically log in so that bots can not create a fake user account.
To remove the Shop login option, you can disable it under:
Settings > Customer accounts > Authentication
From there, turn off the option that allows customers to sign in using Shop.
Please keep in mind that disabling this feature is tied to Shop Pay. You will also need to deactivate Shop Pay as a payment method by going to:
Settings > Payments > Manage > Manage payment methods
and turning off Shop Pay.
Once both are disabled, customers will no longer be able to log in using Shop
The fact that bots can still hit checkout even with your storefront shut down is telling you something useful: they’re not using your storefront at all. They’re making direct requests to Shopify’s checkout endpoints, which means anything protecting your frontend - hCaptcha, account creation barriers, even taking the store offline - is completely invisible to them. That’s why nothing has worked so far.
This is the frustrating part that doesn’t get explained clearly enough. Most of Shopify’s built-in protections, and most of the apps merchants typically try first, operate at the storefront layer. But the bots you’re dealing with now are bypassing that layer entirely. They know Shopify’s checkout flow well enough to script it directly.
At this point, what you need is filtering at the checkout/API level, not the storefront. Shopify Functions-based checkout rules can block or flag orders based on patterns - suspicious email formats, mismatched address data, specific IP ranges - before the order actually goes through. A few apps plug into that layer. Blockify’s checkout rules work there, which is why it’s more relevant for what you’re describing than the standard storefront-side blockers.
It’s also worth pulling your analytics to look at where the checkout sessions are actually originating from. If the bot traffic is concentrated in specific regions or IP blocks, a targeted block at that layer can cut the volume quickly rather than playing whack-a-mole with individual accounts.
And to your question about store integrity - none of this is a sign your store has been compromised. These bots are abusing normal public-facing Shopify infrastructure that any store is exposed to. It’s annoying and disruptive, but it’s not a breach.
This definitely feels more like bots hitting checkout/account endpoints directly rather than normal storefront traffic.
We’ve seen abandoned checkouts spike pretty badly from that kind of activity before.
If you haven’t already, I’d probably focus on:
customer account settings
Shop Pay flows
traffic/referrer patterns
unusual country spikes
Especially since it kept happening even with the storefront offline.
this is a bot attack targeting your checkout, and unfortunately it’s become extremely common. the bots create fake customers and abandoned carts to either test stolen credit cards or just spam your store. deleting them manually is a losing battle because they’ll keep coming back.
a few things that actually help: enable Shopify’s built-in bot protection under Settings > Checkout (if it’s not already on), add a CAPTCHA to your checkout flow, and consider an app like Blockify or Fraud Filter to block suspicious IPs and regions. also check if the John Doe entries are all coming from the same IP range or country, because you can often block the source at the market/geo level. the abandoned carts are annoying but harmless unless you have automated abandoned cart emails running, in which case disable those until you get this under control or you’ll be emailing bots.
The fact that bots are still hitting checkout even with your storefront shut down is actually the key thing to understand here - those bots aren’t browsing your site like a customer would. They’re calling Shopify’s cart and checkout endpoints directly, often with previously cached tokens or just by hammering the API. Shutting down the storefront doesn’t close those endpoints.
That’s why storefront-level captchas and account protections only go so far. The bot traffic you’re seeing at checkout is operating a layer below all of that.
For this specific situation, a few things worth looking at:
Switching to New Customer Accounts (Settings > Checkout) is probably the most effective move for the account creation side - the one-time 6-digit email code is genuinely hard to automate compared to classic accounts.
For the checkout abuse specifically, you need something that acts at the checkout level rather than the storefront. Shopify’s Checkout Extensibility now lets apps block or challenge requests before an order is placed. Apps built on that - including Blockify’s checkout blocking which was mentioned earlier in this thread - can catch bots that bypass storefront protections entirely.
Also worth checking your Analytics for session sources. Bot waves like this usually spike from specific IP ranges or referrers, and if you can identify those, country or IP blocking can cut the volume significantly even if it doesn’t eliminate it.
The short version: if something can still reach Shopify’s checkout URL, it can generate abandoned checkouts regardless of what your storefront looks like. That’s a Shopify platform-level limitation, and your protection layer needs to be at checkout, not just the front end.
Many standard firewall and fraud apps act too late in the user journey. By the time a Checkout Extensibility app challenges a request or an anti-fraud tool flags an order, the checkout record has already been created in Shopify’s database. Merchants end up paying for monthly app subscriptions only to find their backend analytics are still getting flooded with fake abandoned checkouts. Bots can auto-generate thousands of fake email addresses in seconds, but passing SMS or phone number validation format checks is much harder to script. Card-testing bots almost always target the absolute cheapest item in a store to see if a stolen card clears authorisation. Temporarily hiding low-value SKUs or setting a minimum order value can abruptly kill the bot wave’s incentive.