I have driven myself crazy trying to understand why my conversion rate appeared to be dropping over the course of this year.
It turns out that my conversion rate has not dropped at all, even though the standard Shopify dashboard shows it dropping.
Once I filter out bot traffic in reports, I can see my true human conversion rate. This is the only conversion rate that matters.
Can I exclude bots from all session reporting in dashboards? Bot traffic is only going up in quantity and they are never going to buy anything (I think), so it does not make sense to have them hit core metrics like conversion rate.
If I set up cloudFlare to prevent bot traffic from even hitting the site, will I be sacrificing LLM visibility? I’m mostly just annoyed I need to dive through a few layers of menus to see my human conversion rate.
As for blocking bots, the LLM might not be heavily impacted, because it uses other methods. But your SEO, Price comparison engines, any affiliate or referral tools might all take a hit.
Nathan
edit___
I have just asked an ai and it suggested the following:
Start with soft measures (e.g., challenge high-risk bots, rate limiting) instead of outright blocking everything.
Monitor your Shopify sessions volume and conversion rate before/after to see if it meaningfully cleans up metrics.
You’re not alone—I’ve noticed the same thing. Bot traffic can definitely distort overall conversion metrics, so filtering for human sessions gives a much more accurate picture of store performance. As far as I know, Shopify doesn’t currently let you exclude bot traffic from the main dashboard metrics globally, so using filtered reports is the best option for now. If you are considering Cloudflare, I’d be careful with aggressive bot blocking, as you may want to allow verified bots while blocking malicious ones.
Two things that bit me beyond the dashboard number itself. First, bot sessions are not spread evenly across your traffic sources. They land almost entirely in direct and unknown, so when you compare conversion rate by channel, your direct traffic looks far worse than it is while paid and email stay roughly accurate. If you have ever concluded that direct converts badly and shifted budget on that basis, it is worth rerunning that comparison with the filter on. Second, once you pin the filtered report, be careful not to compare it against historical periods from the unfiltered dashboard. The bot share is not stable month to month, so a filtered July against an unfiltered April will show a conversion rate jump that is entirely an artefact. Cheapest fix is to rebuild six months of filtered monthly numbers once and keep them in a sheet as your real baseline, then only ever compare filtered to filtered. Takes about twenty minutes and it stops you from chasing a trend that does not exist.
The distinction that matters here is filtering versus blocking. Filtering bots out of your reports is pure upside, do it and your conversion rate becomes real again. Blocking at the edge is where you can quietly hurt yourself, and Nathan’s question is the right one: several popular bot protection setups now block AI crawlers by default, including the ones that feed shopping answers. The bots you probably want reading your store are GPTBot and OAI-SearchBot for ChatGPT, PerplexityBot, and ClaudeBot, plus the ordinary search crawlers. I check a lot of Shopify stores for AI visibility and I regularly find shops that turned on aggressive protection months ago and have been invisible to assistants ever since, with no error or warning anywhere.
The practical version: filter your analytics freely, and if you do block at the edge, use challenge or rate limit modes for unverified bots and keep a named allowlist for the crawlers above. Then check yourstore.com/robots.txt once after setup to make sure none of them ended up next to a Disallow line. The junk scanners hitting random URLs will keep bouncing off 404s either way, which is already the right outcome for them.
There isn’t a store-wide setting that removes bots from Shopify’s main dashboard cards. Those cards will still use Shopify’s standard session count.
A couple of practical options:
Save the filtered report and, if your plan supports scheduled reports, email it weekly so the human conversion rate lands in your inbox without menu digging.
Export the same filtered metric monthly and use that as your operating baseline. Keep the native dashboard number only as a traffic anomaly warning.
I would not proxy a Shopify domain through your own Cloudflare setup just to fix reporting. It can introduce SSL, checkout, and domain connection issues, while browser-like bots may still get counted.
If controlling crawlers through robots.txt.liquid, treat search crawlers and AI search crawlers separately from training crawlers. For example, OAI-SearchBot affects ChatGPT search visibility, while GPTBot is primarily for training. Blocking one does not have the same effect as blocking the other.
Bot traffic can complicate conversion reporting, especially when sessions rise without a change in customer activity.
If you have a way to filter out suspected bot traffic, use that view consistently when comparing conversion performance over time. Avoid comparing a filtered period directly with an older unfiltered period, as they define traffic differently.
Also, separate reporting from bot blocking. Filtering traffic for analysis doesn’t stop access to the storefront, while blocking bots might impact legitimate services and crawlers.
For reporting, save the filtered report and use the same criteria for each period. Keep the standard dashboard as a reference and use the filtered report for a clearer view of relevant traffic.
A built-in option to include or exclude bot traffic from dashboard metrics would help, especially for merchants focused on conversion rates.
Until that option exists, maintaining a consistent reporting method is key.
I can relate to the frustration. As bot traffic increases, it can make your overall conversion rate look worse even when actual customer behavior hasn’t changed.
At the moment, Shopify lets you view reports filtered for human sessions, but as far as i know, there isn’t a way to make all dashboard metrics exclude bots by default. Having an option to set Human-only sessions as the default for analytics and conversion reporting would make those core metrics much more meaningful.
Regarding Cloudflare, I’d be cautious about blocking bots too aggressively. Not all bots are undesirable, search engine crawlers and AI user agents may legitimately access your site. A better approach is usually to challenge or block malicious bots while allowing verified crawlers, rather than applying blanket restrictions that could affect discoverability.
I think a native dashboard toggle between “All Sessions” and “Human Sessions” would be a valuable enhancement, especially as automated traffic continues to grow.
I would solve the reporting problem separately from the traffic-control problem. Blocking every crawler to make the headline conversion rate look cleaner can remove legitimate search, monitoring and AI-discovery traffic without improving the customer journey.
For decision-making, keep two views: total sessions for operational awareness, and a human-qualified view for CRO. Define “qualified” consistently—for example, Shopify’s bot classification plus meaningful storefront interaction—and do not change the filter whenever the number looks uncomfortable.
Then compare transition rates such as product view to add to cart and checkout to purchase, not only orders divided by all sessions. Bots often distort the top of the funnel much more than the bottom.
Cloudflare can still be useful for abusive automation, but I would use verified-bot and rate-limiting rules rather than a blanket block. The open question is which traffic is merely non-buying versus actively harmful; the answer should come from request patterns and downstream behaviour, not from conversion rate alone.
Yeah, I ran into something similar where the numbers looked worse until I separated the traffic sources. It’s frustrating because the headline conversion rate makes it look like the store is performing worse when a chunk of that traffic was never going to buy anything anyway.
I wouldn’t block everything at the Cloudflare level without checking exactly which bots you’re filtering, though. There are legitimate crawlers you probably still want reaching the site, especially if you’re thinking about Google, AI search, or product discovery.
For the reporting side, I’ve found it more useful to look at the traffic and revenue together rather than relying on the default Shopify numbers. I use SiteGuru alongside Analytics for this, since you can see which pages are actually bringing in traffic and revenue instead of treating every session the same. I’d probably keep a separate human-only conversion metric rather than trying to make the default dashboard represent two different things.