Hi,
This year I’m getting TONS of bots crawling on my website daily 50+ visitors and active carts. The hits will come all at one time then leave all at once. It’s totally messing up my conversion. I don’t know how to stop this or where it’s coming from. I thought it was Facebook/ig ads so I stopped running ads and it’s still happening. Can someone please help?
Hello,
I understand your problem. Here are some steps to help you identify and mitigate the issue:
Shopify has built-in bot protection to handle known bad bots. Ensure it’s enabled by reaching out to Shopify Support if you’re unsure.
Add CAPTCHA to any forms on your site, like contact forms or login pages. This can help block bots trying to interact with your store.
Use Shopify’s analytics or a tool like Google Analytics to investigate the origin of the traffic. Bots often come from specific regions or use unusual user agents. If you notice patterns (all traffic from one IP range), you can block them.
Shopify allows you to block IP addresses. Identify suspicious IP ranges from your analytics and block them in your admin settings under Online Store → Preferences → Spam Protection.
Consider using an app like Cloudflare or Shopify apps like BotDefender to filter bot traffic. These tools can differentiate between human users and bots more effectively.
Even though you’ve paused your ads, double-check your ad accounts to ensure you don’t have any rogue campaigns or retargeting pixels that could be driving bot traffic.
Since you mentioned the bots hit all at once, this could indicate automated scripts. Set up server logs or use an app to detect spikes in activity and flag potential patterns.
This should help!
Same. Venezuela has been attacking my Shopify for months. I just installed an app, Blockify, and have blocked the country, but now seeing Colombia. It’s really messing with my analytics and stock availability.
The wave pattern you’re describing - all hitting at once, then all gone - is pretty classic botnet behavior, usually scrapers or fake traffic services. The Venezuela origin is common right now and showing up across a lot of stores.
One thing worth flagging that the previous replies don’t cover: if bots are creating active carts and your store has inventory tracking enabled, those carts can temporarily reserve stock depending on your setup. That’s worth checking if you’re seeing unexpected ““out of stock”” situations.
On the country-blocking route - as the other reply shows, it tends to be a temporary fix. The operators just shift to a different IP pool (Colombia, Brazil, etc.). It can reduce the immediate noise but probably won’t eliminate the problem long-term. If you do go that path and the traffic shifts countries, you’ll need to keep adding blocks reactively, which gets tedious.
For your analytics distortion specifically, one practical workaround is to create a filter or segment in Google Analytics that excludes the suspicious traffic - either by country or by behavioral signals like session duration under a few seconds with no page scrolling. That won’t stop the bots from hitting your site, but at least your conversion data becomes readable again while you work on the underlying fix.
Cloudflare’s free plan is also worth trying before paid apps - their bot detection runs at the DNS level and catches a lot of this without you having to manually identify IP ranges. Setup takes maybe 30 minutes and it handles the country-shifting problem better than simple IP/country blocks.