Bot Traffic Investigation & Blocking Solution

Technical Q&A
1

I am a Shopify app developer working with a client store, Sand Dollar Dubai.

The merchant is experiencing unusually high traffic from Singapore. We checked Shopify Analytics for the last 7 days and found approximately:

  • 107K sessions from Singapore

  • Approximately 98K of those sessions are classified by Shopify as Bot using the Human or bot session dimension

  • The majority of the bot traffic is shown as Direct / no referrer

The merchant does not want to block Singapore as a country because legitimate customers from Singapore need to continue accessing the store.

Their requirement is to:

  1. Identify suspicious/automated traffic.

  2. Ideally identify the source IP addresses/IP ranges.

  3. Identify suspicious VPN/proxy/datacenter traffic where possible.

  4. Identify automated/bot behavior.

  5. Block the abusive traffic.

  6. Continue allowing legitimate Singapore visitors.

What we currently know

Shopify Analytics allows us to identify that a large amount of Singapore traffic is classified as bot traffic, but the report does not provide the source IP addresses or IP ranges.

I am developing a public Shopify app using PHP, Shopify’s official API library, OAuth, Admin GraphQL API, webhooks, and a Theme App Extension.

I am trying to understand what the correct Shopify-supported architecture is for this use case.

Questions

1. Can a Shopify app obtain the IP address of a visitor to the normal Online Store?

For example, if a visitor requests:

  • /

  • /products/...

  • /collections/...

  • /pages/...

  • /search

  • etc.

Is there any Shopify API, webhook, analytics API, request header, log, or other supported mechanism that allows an app to obtain the visitor’s IP address for those normal storefront requests?

2. Can a Theme App Extension be used to block bots?

If my Theme App Extension loads JavaScript on the storefront, can it reliably identify and prevent an automated visitor from accessing the storefront?

Or does the request already reach Shopify before the Theme App Extension JavaScript executes?

I understand that client-side JavaScript may not be sufficient against non-browser bots, so I would like to confirm the Shopify-supported approach.

3. Can an App Proxy be used for this purpose?

I understand that App Proxy requests are forwarded to our backend and that Shopify documents the X-Forwarded-For header containing the client IP.

However, does an App Proxy only receive requests to the configured /apps/... route, or is there any supported way for an App Proxy to inspect/protect normal storefront URLs such as /products/... and /collections/...?

4. Is there any Shopify-native way for an app to block a storefront visitor?

For example:

Visitor → Shopify storefront → Shopify/app determines bot → block

Is there an API or supported mechanism for an app to reject/block a visitor before the storefront page is served?

5. Does Shopify expose bot information to apps?

Since Shopify Analytics can classify sessions as Human or Bot, is there any API/report/export available to an app that provides additional information about those bot sessions, such as:

  • IP address

  • IP range

  • user agent

  • ASN/network

  • VPN/proxy

  • datacenter

  • bot type

  • request information

6. What is the recommended architecture for this problem?

If Shopify does not expose a way for a normal public app to inspect and block all Online Store requests, what is the Shopify-recommended solution for this use case?

For example, should the merchant use:

  • Shopify’s native bot protection

  • A Shopify security app

  • A WAF/CDN

  • Cloudflare or another external security layer

  • Something else supported by Shopify

The requirement is specifically not to block Singapore as a whole.

We want something conceptually like:

Singapore + legitimate visitor → ALLOW

Singapore + abusive bot → BLOCK

rather than:

Singapore → BLOCK

Any guidance on the supported architecture or APIs would be greatly appreciated.

4

The boundary here is earlier than a public app can reach. For a normal Shopify Online Store request, a Theme App Extension runs after Shopify has served the page, and an app proxy sees only its own /apps/... path. Neither gives you a storefront-wide, pre-request enforcement point.

Shopify’s published bot tooling also separates measurement from enforcement. The Human or bot session dimension is for filtering analytics, while Shopify’s Cloudflare and WAF layer is managed by Shopify. The documented Plus bot protection is checkout-focused and scheduled, rather than a general storefront IP firewall. A standard public app should not promise historical session IPs, ASN or VPN classification, or per-request blocking controls when Shopify does not expose them.

I would structure the investigation in three tracks:

  1. Confirm harm. Compare bot-tagged sessions with add-to-cart, checkout, search, account creation, and origin-load spikes. If they only inflate sessions, filter them in reporting instead of adding brittle blocking.
  2. Preserve evidence. Give Shopify Support UTC time windows, affected paths, the store domain, country split, and bot-session counts so they can inspect the edge logs they control.
  3. Separate storefront type. For a standard Online Store, use Shopify’s managed protections and escalate persistent abusive patterns. For a headless or Hydrogen storefront, log requests at your own edge and forward Shopify-Storefront-Buyer-IP on Storefront API requests so Shopify can apply buyer-level protection.

I would avoid putting an unsupported proxy in front of a normal Shopify-hosted store or using theme JavaScript as a security control. Both can miss non-browser clients, and Shopify’s own guidance places network bot management at its edge.

5

there isnt any way to do that without blocking real customers