Hi Shopify Community,
I’d like to request a feature that I believe would benefit every single Shopify merchant, from brand new stores on the Basic plan all the way up to Plus: built-in bot traffic filtering as a core part of the Shopify platform.
The problem: Bot traffic is no longer a niche concern. It’s a daily reality for merchants of all sizes. Bots inflate session counts, distort bounce rates, skew conversion data, and make it nearly impossible to make confident business decisions based on analytics. When your data is polluted, your marketing spend, inventory decisions, and growth strategies all suffer.
Why Shopify is uniquely positioned to solve this: Shopify already processes every single request that hits a merchant’s storefront. The infrastructure is already there. Adding bot detection and filtering at the platform level, rather than pushing merchants toward third-party apps, is a natural extension of what Shopify already does. It doesn’t require merchants to install anything, configure anything, or pay extra.
Why it should be on all plans, including Basic: Small merchants are often the most vulnerable to bot traffic and the least equipped to deal with it. They can’t afford enterprise firewall tools, and they shouldn’t have to. A merchant paying $39/month deserves clean data just as much as a Plus merchant paying thousands. This is simply good customer service and platform integrity.
The ask: Build native bot detection and filtering directly into the Shopify storefront layer. No third-party app required, no add-on fee, available to all stores. The development cost is a one-time investment that protects the entire merchant ecosystem and strengthens trust in Shopify Analytics as a reliable tool. Clean, accurate analytics is also a compelling selling point for Shopify itself, making this a win for the platform and merchants alike.
This is the kind of foundational infrastructure that makes Shopify better for everyone. I hope the team will consider it.
Thank you for listening.
Shopify has already come out with bot filtering in analytics 6 months ago. Check it out sometime. Customize your own reports with your filters.
Thank you! I had no idea this filter existed. Really appreciate you pointing that out. Quick follow-up though. Does this filter only exclude bots from analytics reports, or does it actually block bot traffic from hitting the store entirely? If it’s just a reporting filter, the underlying bot traffic is still consuming server resources and inflating session counts before being filtered out. Is there a native Shopify way to block bots at the door, or is that still a third-party solution?
No Shopify doesn’t block bot traffic itself. That’s in reporting.
There are good bots also. Bots that crawl your site for search engines. Bots that scan for viruses and dangerous material. Not all bot traffic is bad for you. There are even bots from Shopify itself. You actually need this activity.
But yes there are apps and services that will try to block unwanted bot traffic at the domain level. There are many people here who will swear up and down on Cloudflare or that other service whatever its called. And then there are just as many who say it didn’t work. So take that for whatever it’s worth.
That is a really good point and something I did not consider. Not all bots are bad. Search engine crawlers, security scanners, and Shopify’s own bots are all necessary and beneficial. Blocking indiscriminately could actually hurt SEO and store functionality. So the real ask is smarter bot filtering, not a blanket block. Separating the good from the bad at the platform level is exactly what Shopify could build natively, and that would be a genuinely valuable feature. Thanks for the Cloudflare heads up too. Mixed results are good to know before going down that road.
Thank you for the thorough summary. One thing worth emphasizing is that the third-party solution gap is a real problem. Based on community feedback, tools like Cloudflare and similar services produce mixed results and are not consistent across all merchants. That inconsistency is exactly why a native solution matters. Merchants should not have to rely on external tools with unpredictable outcomes to solve a problem that originates at the platform level.
A significant portion of the bot traffic I am seeing in my own analytics is originating from specific geographic regions, and based on conversations in the Shopify community, I am not alone in this. The key distinction I have noticed is that bots from known legitimate sources, such as search engine crawlers, tend to show normal behavioral patterns. The problematic traffic tends to come from regions with high concentrations of scraping and data harvesting activity, and it shows up clearly in bounce rates and session durations. The ask is not to block entire countries but for Shopify to build smarter behavioral detection that can distinguish malicious scraping and harvesting bots from legitimate crawlers, regardless of origin.
A smart built-in behavioral filter that Shopify controls and maintains would give every merchant a reliable and consistent baseline, regardless of technical skill level or plan tier. The partial solution in analytics reporting is a great start and shows Shopify has the capability. The next logical step is bringing that intelligence to the storefront edge. A lot of merchants are dealing with this and cleaner data would benefit everyone.
You can enable Spam protection under Online Store > Preferences in your Shopify dashboard and that will block majority of bot traffic.
Thank you for pointing that out! Both spam protection options are already enabled on our store, contact and comment forms as well as account creation and password recovery pages. That said, based on our analytics data, malicious bot traffic is still accounting for over 84% of our daily sessions. So while hCaptcha helps with form-based bot activity, the browsing and scraping bots that inflate session counts and hurt conversion metrics are still getting through. That is really the core of what this feature request is about. A native storefront-level solution that goes beyond form protection would make a significant difference for a lot of merchants dealing with the same issue.
Wanted to follow up with some hard data. Over the last three days, our store recorded 632 total sessions. Of those, 510 were identified as bot traffic, which is 80.7% of all sessions. The 122 legitimate human sessions had a 57.4% bounce rate and generated 4 cart additions and 3 checkout initiations. The 510 bot sessions had a 98.4% bounce rate and generated zero cart additions and zero checkouts. I am attaching a screenshot directly from Shopify Analytics. This is not an estimate. This is what Shopify itself is reporting.
As a small one-person shop, I do not have the resources to manage third-party bot blocking tools. Beyond polluting analytics, this level of bot traffic can slow page load times for real visitors and potentially impact search engine performance. This is exactly the type of protection that should exist natively at the platform level for every merchant, regardless of size or plan.
The missing piece is stopping them from hitting the store in the first place. Native storefront-level bot blocking would make a real difference for merchants dealing with this.
And your still going it alone by not searching the forums first and joining those threads and or cross referencing them.
If you want to champion this for more votes put in the right effort and work with existing efforts.
No amount of bringing the receipts matter when it’s 1 merchant going it alone yet again and again vs 5 MILLION+ merchants stores not complaining so any complaint is a grain of sand on a beach.
Fair point and I appreciate the feedback, truly. But full transparency since you clearly do not know me. This is my first time ever posting on any forum in my life. I also do not use social media and never have. I work four different jobs, play in several different bands, run two websites including this one, ranch, and do it all seven days a week. Finding the right thread is not exactly at the top of my list between playing music, feeding cattle, and shipping audio cables. I just wanted to get my real data out there and let it speak for itself. That said your point actually raises a good one. If there are already existing threads on this issue with votes behind them, that only proves the problem is widespread and has been for a long time. So maybe the additional ask is for Shopify to connect the dots between threads sharing the same issue and surface them as a unified voice rather than letting merchant frustration dissolve into a beach of individual grains that never add up to anything. The data exists. The frustration exists. Shopify has the tools to surface it. If you are aware of any existing threads and would like to share them feel free. But I noticed you did not link any. One grain of sand at a time.
Those could be AI visits these days, bot traffic is not necessarily a bad thing.
At least you can see how much human traffic you are getting to your store in Shopify’s reports.
To answer your question, there is no direct way to block bot traffic but the spam protections you have in the store settings should be more than enough to prevent fake orders or majority of fake form submissions.
hCaptcha handles fake orders and form submissions well and I am glad it is there. My concern goes beyond that though. Data integrity is where I am focused.
From April 14 to April 19, 2026, 86% of my sessions were bots. That is 1,282 bot sessions versus 205 human sessions out of 1,487 total. When that is your traffic reality, analytics lose their value. I cannot accurately measure human conversion rate, identify where real customers drop off, or make informed decisions about where to improve. The data I need to run a smarter business is buried under noise.
So here is a new and separate ask: Shopify already identifies and labels bot sessions. The data exists. Just let merchants toggle to a human-only analytics view. No bots, no skew, just real customer behavior. That one feature alone would be a meaningful win for every merchant trying to make data driven decisions.
