Shopify Bot Exploit – Add-to-Cart Abuse Is Corrupting Analytics & Shopify Refuses to Act at Platform

Shopify Discussion
,

Topic summary

A sophisticated bot exploit is targeting Shopify stores by generating massive fake add-to-cart activity through 18,000+ rotating IPs that mimic legitimate browser behavior. The attack corrupts analytics, inflates ad spend, damages email deliverability through fake customer accounts, and disrupts marketing attribution—issues that cannot be resolved by third-party apps since they operate after requests hit Shopify’s infrastructure.

Merchant Workarounds:

  • Creating Shopify Flow automations to auto-delete fake accounts based on patterns (empty names, specific fake addresses)
  • Segmenting bot profiles in email platforms like Klaviyo to protect sender reputation
  • Adjusting Google Ads strategies to manual campaigns due to corrupted conversion data
  • Some merchants deployed Armex firewall app with mixed results—effective bot blocking but reports of site slowdowns and accessibility issues

Core Issue:
Merchants argue only Shopify can solve this at the Cloudflare WAF level, but the platform has refused to intervene, directing merchants to inadequate app-based solutions. Multiple affected merchants express frustration with Shopify’s inaction and mention potential collective legal action for negligence.

Status: Ongoing problem with no official platform-level solution. Merchants continue sharing mitigation strategies while calling for Shopify infrastructure team intervention.

Summarized with AI on October 23. AI used: claude-sonnet-4-5-20250929.
67

For anyone dealing with this have you established if the bots are :

  • actually interacting with the page, triggering analytics events etc
  • loading the frontend, but using the ajax api to actually interact with the cart
  • or possibly newer abusing the new system for the MCP storefront api which also has cart functionality etc ( lets LLMs like chatgpt access store data on the frontend)
  • Mimics common browser user agents and request headers, appearing identical to real users> - Reaches storefront pages, skewing sessions, bounce rates, conversion rates, and marketing attribution> - Then exploits Shopify’s architecture to bypass front-end logic and spam cart activity at scale