Shopify Bot Exploit – Add-to-Cart Abuse Is Corrupting Analytics & Shopify Refuses to Act at Platform

That’s a solid first step — I did the exact same thing in the beginning using Arigato Automations and Shopify Flow.

The next (and important) step is to push a custom “bot” metric into Klaviyo (or whatever email platform you’re using) and create a segment of those profiles. Be sure to exclude this segment from all automated flows. The reason is that the sync delay between Shopify/Arigato/Flow automation and Shopify-to-Klaviyo can still cause bot profiles to be pushed into your email lists. This is critical because maintaining your email sending reputation is key — if it drops, you’ll need to re-warm your list, which is a slow and painful process.

Now, if you’re running ads (Search, Shopping, etc.), make sure the data feeding into your ad platforms is also clean. This gets tricky, especially if you’re using Shopify’s Google & YouTube app. Since fake profiles still get created and your session count stays high while conversion rate drops, that low-quality data feeds into Google Ads. PMAx (Performance Max) then starts to assume your campaigns are underperforming and scales down your reach — making it hard to scale spend even if you want to.

One workaround is to switch to manual shopping campaigns and build your targeting around SEO-style keyword segmentation. Just be careful not to scale campaigns too aggressively — aim for no more than 25–30% increases at a time, with enough pause between changes to avoid triggering a fresh learning phase in Google Ads.

Finally, when syncing product feeds from Shopify to Google, I recommend using a first-party data tool as your primary source — especially since GA4 is likely inaccurate in this scenario too.