Orders for products that don't have an add to cart button

Technical Q&A

Topic summary

A store is receiving fraudulent orders for products that lack an “add to cart” button, have no price ($0), and zero inventory. Shopify Support indicated this is a theme-level issue rather than a platform problem.

Root Cause:
Bots are exploiting Shopify’s AJAX Cart API to directly add products to cart, bypassing the frontend interface. Shopify doesn’t natively support “presentation-only” products (archived, request-price items).

Proposed Solutions:

  • Set extremely high prices or shipping rates for non-sale items
  • Use metaobjects and webpages to create product landing pages instead of actual product listings
  • Implement Shopify Functions apps to handle such orders during checkout
  • Use automation tools (Shopify Flow or Mechanic app) to auto-cancel $0 orders
  • Install the Cart Lock app, which specifically prevents $0 products from being ordered

Status: Multiple workarounds provided; issue remains unresolved pending implementation.

Summarized with AI on October 29. AI used: claude-sonnet-4-5-20250929.
1

My store has received several orders for products that have no add to cart button. These products are not for sale, and therefore have no price attached to them, so the orders are coming through with $0 price tags. The products have a 0 set for their inventory, so I’m not sure how they’re even being ordered. Shopify Support is suggesting that the issue is with the theme itself, and not the platform. If anyone has dealt with this problem or is willing to review the code to identify the vulnerability allowing for this, I’d be very appreciative!

Example of a product that was “ordered” without an Add to Cart button: https://mezuzahmosaics.com/collections/menorah-collection/products/marcovsky-hanukkiah

2

Hi @Sheryl_Marcus :waving_hand: It’s bots using the ajax api to try and “buy” free product.

https://shopify.dev/docs/api/ajax/reference/cart

Publishing a product to the on the online sales channel frontend means this cannot be prevented.

Shopify has no concept of presentation only products: archived products, request-price products, etc.

Workarounds:

  1. Give such products an excessive shipping rate, or an absurd high price, $10,000,000,000,000,000.00
  2. Use metaobjects and webpages feature to present product landing pages.
  3. Or shopify-function apps to handle such orders in the checkout.
  4. or shopify-flow, or mechanic app, to auto-cancel such orders.
1 Like
3

Hi @Sheryl_Marcus , you can restrict the $0 price products from ordering using the Cart Lock app https://apps.shopify.com/cart-lock

Here’s a short video that directly addresses this issue: