In my company’s business, we have a custom Shopify solution where our website is based on Shopify (using custom themes), but we do not offer e-commerce or any type of online ordering.
Despite this, we recently had a customer place an online order. How could this be possible? In the Shopify admin, it is stated that the customer place the order via “online store” but since we do not offer online ordering (to our knowledge) this is not specific or helpful enough.
Well, we could use more information. Like, do you have any defined products, active, even if the price is 0? What was ordered? But if the user made an order you have some payment methods and shipping defined?
But when you ask if it is possible, it is. There are a lot of scripts that are automatically executed to search through Shopify stores and choose a free or random product for the purpose of testing credit cards. So bots can place orders, but maybe it is just a human with the same intent.
This is almost certainly a card-testing bot, and it doesn’t need your buy buttons to place an order.
Your custom theme hides the shop, but Shopify’s cart and checkout URLs stay live underneath. A bot can read your product and variant IDs from yoursite .com/products.json and send one straight to checkout with a link like yoursite .com/cart/VARIANT-ID:1. As long as a product is Active, published to the Online Store, and a payment method is on, the order goes through and shows as “Online Store”.
How to tell it’s a bot / card test
Small or odd total, unfamiliar name and email.
Billing and shipping that don’t match, or a foreign address.
A high risk flag on the order, often several attempts close together.
Do this now
Cancel and refund the order, and mark it as fraudulent so Shopify learns from it.
Stop it happening again
Pick based on whether your catalog needs to stay public.
If products don’t need to be visible to the public:
Remove them from the Online Store sales channel: Product > Publishing > remove Online Store. No purchasable product means no order.
Hey @twhitfield, any product still published to the Online Store sales channel stays buyable by its own URL, even if your theme never shows a buy button. Shopify serves the product page and the cart routes itself, independently of what your theme links to, so anyone with a product URL or a cart permalink can walk straight into checkout. Go to Products, select all, then Actions and Manage sales channel availability, and take Online Store off anything that shouldn’t be purchasable. Then open that order and look at its conversion detail for the landing page the buyer arrived on, which usually tells you how they found it.
That can definitely be an unexpected surprise! What likely happened is that someone (or a bot) used a direct checkout link or cart permalink, since shopify provide a fixed product link template.
Even if your custom theme removes all the “Add to Cart” buttons and cart icons, Shopify’s backend still allows checkouts for any product that is published to the Online Store sales channel. Bots often scan Shopify stores and force items into the cart using these hidden background routes to test credit cards.
To completely prevent this from happening again, you need to remove the sales channel availability for your products:
Go to your Shopify Admin and click Products.
Select all your products using the master checkbox.
Click the three dots (Actions) and select Manage sales channel availability (or click Bulk edit).
This ensures that even if someone tries to force a cart link, Shopify’s backend will reject it because the item isn’t officially available to that channel. As a bonus tip, you can check the “Conversion summary” on that specific order page to see exactly what landing page or referring link the buyer used.
