We are being attacked by a bot and Shopify does nothing to help us. They keep pushing off on third party apps but the apps keep saying they cannot control it due to Shopify checkout rules. So we are stuck in a place where Shopify is very in adequate and can do nothing to help out a store. They also say we are not the only ones stating this. It is Shopify lack of action and concern it puts it all on the stores to deal with it. This is a Shopify issue only. It is the way they have their checkout set up. The apps like Blockify cannot override the rules so they are basically useless in stopping this so its just a waste of money. Shopify needs to get their act together.
Is there any trend or identifiable pattern with the bot orders? We experienced something similar in the past (because of shipping insurance) and I’ve set up a flow to automatically cancel bot orders as an interim solution
Shopify admits they cannot stop this “ this bot problem is something that Shopify is still working on to be stopped, I am positive that our Developers will be able to find a way to stop this, so you would not have to manually delete them.”
check this out: Shopify Bot Exploit – Add-to-Cart Abuse Is Corrupting Analytics & Shopify Refuses to Act at Platform - #57 by A_at_HHN
also what is your store link?
David, you are absolutely right that most standard apps cannot override Shopify’s checkout rules. Card testing bots exploit this by skipping the storefront entirely. Custom flows and forced logins are temporary fixes, but they hurt your bottom line. You can check out how they solve this specific Shopify vulnerability at https://sensfrx.ai/plugins/shopify-fraud-prevention
I am having the same problem and its cost me hours, days and thousands of dollars tryin got fix it. Have you tried Cloudfare? I’m just trying to get that up and running now, but its been a nightmare so far as the bot controls are so tight, it stopped apple pay, paypal etc rom working, im hoping my developer can fix that soon
The frustration here is valid - this is a genuinely widespread problem right now, and the thread linked by djp2803 shows how many stores are dealing with the same thing.
One thing worth clarifying though, because it affects what will actually help: the type of bot matters a lot. Card testing bots typically bypass storefront-level tools entirely because they hit Shopify’s checkout API directly rather than going through the browser. That’s why apps that operate at the storefront or session level can’t stop them - it’s not really a gap in those apps, it’s just a different attack vector. For card testing specifically, enabling 3D Secure on your payment method adds an authentication step that makes automated card runs significantly harder. It won’t catch everything but it cuts out a large portion of the traffic. Worth also checking with your payment processor whether they have velocity rules you can tighten on their side.
If the issue is more add-to-cart abuse inflating your analytics rather than actual card testing, that’s a different problem and Cloudflare can help - though as CindyAmeli86 is finding, getting it right without breaking Apple Pay and PayPal requires setting up bypass rules for payment provider IPs (Stripe, Braintree, etc.). It takes some developer time to configure properly but it’s fixable.
The Shopify Flow approach edorti mentioned is worth doing in parallel regardless. If there’s any consistent pattern in the orders - same product being targeted, specific country codes, similar address formats, low-value thresholds - you can build a flow to auto-cancel and avoid the manual cleanup overhead while waiting for a proper fix.