Hi, I have been experiencing bot traffic on my store for the past months that are either abandoning their checkout or even checking out. The bots are using all countries at the checkout from India to US, UK and more. It’s very annoying and Shopify Support said they couldn’t help me. I get around 100 new bot customers daily… Does anyone else got this issue and have any tips on how to solve this or know the cause? It would really help!
@M161 I’ve seen this happen to quite a few stores recently, and it’s almost always caused by automated bots targeting checkout or signup forms that don’t have any protection in place. One of the first things I’d suggest is turning on Google reCAPTCHA for your checkout, customer login, and contact forms, you can do that directly in your Shopify admin under Online Store > Preferences. That alone filters out a lot of fake activity. Also, if you have the “create account after checkout” option turned on, it’s worth disabling it so bots don’t keep generating fake profiles.
Another thing that helps is installing a bot protection app like Shop Protector or Bot Protection. They’re lightweight and automatically block suspicious traffic before it reaches checkout. If the issue started suddenly, there’s a good chance one of your form URLs or scripts got picked up by spam bots, which happens more often than people think. I’d also recommend checking your site for any exposed API keys or old scripts that could be attracting unwanted traffic. Once you put those protections in place, the fake checkouts and abandoned carts usually stop within a day or two.
You are likely getting hit by automated card testing bots
to stop them, turn on google reCAPTCHA in your shopify preferences, install a bot protection app, enable shopify fraud filters and use dloudflare firewall rules to block suspicious IPs/countries
These steps make your checkout harder to automate and usually cause the bot traffic to drop off within a few days
Yes, my reCAPTCHA is already on, and the account is not selected. I also used the app Blockify but that didn’t help. So, I’m thinking it’s because of the scripts, but I have no idea how to fix that.
They mostly try to checkout using the cheapest product, which in my case is shipping protection. But yesterday I have changed the option to only appear in the cart, when the value is above 20eur. This helped reduce it already, but it’s not fully gone yet.
@M161 Yeah, that actually makes sense. It’s good you adjusted the shipping protection rule, that usually helps filter out some of those bot attempts. If reCAPTCHA and Blockify didn’t fully stop it, then you’re probably right, it’s likely coming from some leftover script or app snippet still running in the background.
If you want, I can take a quick look at your theme scripts and pinpoint what’s triggering those fake checkouts. It’s usually a small leftover code that keeps allowing automated traffic through. Would you like me to help you with that?
Hi,
Hope this will help
-
Markets: Only keep the countries you sell to.
-
Shipping zones: remove rates for all other countries.
-
Turn on hCaptcha for forms + auth pages.
-
Add honeypot to forms
Code example
<input type="text" name="website" value="" autocomplete="off" tabindex="-1" style="position:absolute;left:-10000px;">
-
Install one blocker app (IP/country/VPN/email).
-
Set up Shopify Flow: auto-cancel High risk orders.
-
Review Fraud analysis daily for a week, then weekly
Yes, that would be great!!
If reCAPTCHA and Blockify didn’t fully stop it, then you’re probably right
Notice how the response is just telling what you want to hear, what exactly is it saying your right about when you didn’t make any actual argument.
Then why does it go into unfounded technical gibberish
Think it through when your being glazed and the contexts are all over the place to get access to your store for no actual reason.
Do the actual research first.
Shopify Support is usually helpless here because stopping the traffic (the Bouncer approach) is nearly impossible without Enterprise-level tools. The bots just change IPs and keep coming.
However, you can easily fix the ‘100 new customers’ problem.
I switched my strategy from ‘Blocking’ to ‘Cleaning.’ I use a tool called NoBot (https://nobot.versoly.page/) that acts like a 24/7 janitor. It detects those new bot accounts and auto-deletes them instantly. It won’t stop the traffic counter, but it ensures your customer list and analytics stay clean without you doing manual work
Hi @M161
This is commonly known as card testing or scraping. Block via Cloudflare, add reCAPTCHA on checkout and accounts, limit your checkout to the shipping countries you sell to, disable abandoned checkout emails, and add a couple of fraud filters that auto-cancel your orders. Increase rate limiting, obscure checkout URL, watch for bursts by ip patterns.
| These bots are getting smarter and often bypass Shopify’s basic tools by hitting checkout directly from all kinds of countries. What has helped most merchants in your situation: |
- Enable hCaptcha in Online Store → Preferences → Spam protection
- Set “Customer accounts” to Required at checkout
- Use Shopify Flow to auto-cancel suspicious orders
- Limit shipping to only your real target countries
The ““leftover script”” theory is almost certainly not what’s causing this. Card testing bots hit checkout URLs directly - they don’t need anything in your theme to do it. So cleaning up scripts won’t fix anything here, and it’s worth being cautious about anyone offering to poke around your store files based on that theory without clear evidence.
What you’re dealing with is textbook card testing. The bots find the cheapest item available, punch through checkout as fast as possible, and see if a stolen card number goes through. Your €20 minimum for shipping protection was actually a smart move - it removed the easiest vehicle. If the volume dropped after that, you’re on the right track.
The most effective remaining step you haven’t mentioned trying is requiring customer accounts at checkout. LFGabel’s screenshot above shows the option. It’s not a perfect wall, but card testing bots typically aren’t set up to create accounts with real email verification flows - it breaks their automation. The tradeoff is slightly more friction for real customers, so it depends on your store’s conversion context.
If you want something more targeted, Cloudflare’s free plan lets you set rate limiting rules on the /checkouts/ URL path specifically. You can cap how many checkout requests a single IP can make in a short window. That’s closer to the source of the problem than IP/country blocking at a broader level.
The ““cleaning”” approach spectrahq mentioned (auto-deleting fake accounts) is worth combining with the above - it won’t stop the attempts but keeps your customer list and analytics usable while you work on reducing the volume.
When the bot checkouts span every country (India, US, UK, all at once) that’s a strong sign they’re routing through rotating proxies/residential IPs, which is also why country-blocking alone tends to disappoint here, there’s no single region to cut.
A few things that fit this specific pattern better:
VPN/proxy detection rather than country blocking, since the countries are spoofed. Some IP/fraud apps (Blockify among them) can block proxy/VPN/Tor traffic, which targets the actual delivery method instead of the fake locations.
Manual payment capture so the ones that complete don’t pull funds before review.
If they’re hitting checkout directly with no storefront browsing, the durable layer is still a WAF in front of the domain, proxies make storefront blocking a moving target.
If you can tell whether these have any product/page activity behind them or land straight on checkout, that decides whether a storefront proxy-blocker will help or whether you need the WAF. Happy to narrow it down if you describe one example.
Adding one signal to the proxy/VPN point above: even with rotating IPs across countries, these operations usually reuse the same shipping address (or a tiny set of them) while rotating emails. That’s cheap to check and works from checkout data alone, no IP needed.
I develop an abandoned checkout app (Efsun) and that’s the core of the bot flagging I built for this, alongside disposable email domains and email velocity. The account requirement suggestion above is underrated too, it kills most permalink bots outright.
Shopify recently published this Reduced bot noise in abandoned checkouts - Shopify Changelog, has anyone noticed it makes a difference?
There’s a new app on the Shopify store that deals with this exact problem CartWatch: Stop Bot Checkouts - Block bots and prevent bot abandoned carts in your email... | Shopify App Store