Shopify Bot Exploit – Add-to-Cart Abuse Is Corrupting Analytics & Shopify Refuses to Act at Platform

Shopify Discussion
,
23

the klaviyo metric you can push with shopify flow.

The ads data is trickier and takes a bit. Remove Google & Youtube app (it sucks anyways), instead set up GTM (server-side is best) and serve GA and ads tags with that. Doing so you can filter out bot traffic (not all but most).

You need to set your own triggers. Best I could recommend is time spent on site. Set this to 3 sec for example (most bots are under a second) and check that visiting browser is not headless or flagged.

Here’s some js variables examples that you could work off of in your GTM:

BotUserAgentBlock

function() {
  var ua = navigator.userAgent.toLowerCase();
  var knownBots = ['puppeteer', 'phantomjs', 'headless', 'python-requests', 'scrapy', 'curl', 'wget'];
  return knownBots.some(function(bot) {
    return ua.indexOf(bot) !== -1;
  }) ? false : true;
}

ReferrerCheck

function() {
  var ref = document.referrer;
  if (!ref) return false;
  var suspiciousPatterns = ['/?', '://localhost', '127.0.0.1'];
  return suspiciousPatterns.some(function(p) {
    return ref.indexOf(p) !== -1;
  }) ? false : true;
}

And add a simple bot blocker app that allows you to block by IP and ASN. I can get you with the list to block once you have that :wink: