Message for every one in response to the answers i have recieved which i really appreciate all the help.
The setup was done correctly. The DNS, CNAME records and everything else were configured properly and the website was working fine in cloudflare but now we are no longer on cloudflare just to clarify..
After that, I manually enabled additional blocking/security rules because I wanted to test how much of this suspicious traffic could actually be stopped. A significant amount of traffic was successfully blocked, particularly through the search endpoints, but at the same time a large number of suspicious visits were still getting through.
The important point is that just because traffic was still appearing through the search endpoints does not mean nothing was being blocked. A lot of requests were being blocked, but many others were still passing through.
Today the situation became significantly worse. No matter what Cloudflare settings or security rules I tried, the abnormal traffic would not stop. At the same time, our sales completely dropped. This website normally receives orders every day, so seeing this amount of activity while having virtually no genuine sales was extremely concerning.
Eventually, I decided to move the domain back to Shopify’s own DNS. Shortly after doing this, genuine orders started coming through again. However, the abnormal cart and checkout activity is still continuing, with numerous visits and events being recorded.
This is the actual problem I am trying to resolve.
I understand that everyone commenting here is trying to help, and I appreciate the responses, but most of the suggestions so far are focused on identifying whether the traffic is bot traffic or genuine customer traffic. That is useful as a first step, but that part has already effectively been identified.
Shopify Analytics is recording the abnormal activity. Google Analytics is also showing the abnormal activity. Our live chat analytics and monitoring tools are showing the same thing. We monitor customers entering the website, adding products to cart and reaching checkout, and we also use live chat to engage with customers. The behaviour we are seeing is clearly not normal customer behaviour.
So this is not simply a case of relying on one Shopify report.
The bigger issue is that all of this artificial activity is completely destroying the accuracy of our analytics. When there are hundreds or thousands of fake sessions, cart additions and checkout events mixed together with genuine customers, it becomes extremely difficult to identify actual customer behaviour, genuine conversion rates, abandoned carts and the real performance of the website.
Shopify says that its infrastructure already uses Cloudflare and that bot traffic is regularly blocked. However, clearly a substantial amount of automated traffic is still reaching the storefront and triggering customer actions such as add-to-cart and checkout events.
What I am looking for now is not another explanation of how to identify bot traffic. I am looking for an actual technical solution to stop, rate-limit or isolate this activity before it contaminates the storefront analytics.
I have four websites, and although this particular website is currently my main and highest-volume store, I am seeing similar behaviour across the others as well.
This is becoming a serious issue. Shopify merchants should not have to accept massively distorted analytics, fake cart activity and fake checkout activity without having an effective way of controlling it.
I am not on Shopify’s lowest plan, nor am I on Shopify Plus. I am on a mid-level Shopify plan, and I would expect there to be some practical protection or escalation route available for this type of problem.
If anyone has dealt with this exact issue and has found a genuine solution — particularly something that stops the automated add-to-cart and checkout activity rather than simply identifying it afterwards — I would really appreciate hearing what worked.
