For several months, countless merchants — myself included — have been facing a massive surge of fake traffic from China and other regions in Asia.
These bots generate thousands of sessions with a 100% bounce rate, corrupt Shopify analytics, and completely destroy Meta Pixel learning and ad performance.
This issue is not marginal — it is hitting small and mid-sized stores the hardest, those without the technical access or financial means to deploy a real firewall upstream.
Shopify’s current response has been silence or redirection to third-party apps, which are technically incapable of solving the root of the problem.
This negligence puts thousands of independent businesses at risk.
We are asking Shopify to:
– Acknowledge the issue publicly.
– Implement native server-side protection (country/IP filtering, server-side captcha, real WAF).
– Communicate a clear timeline for mitigation.
If Shopify wants to remain the platform for creators and small business owners, it must provide basic protection against non-human traffic.
Hello there Nick @NickHM The bots invasion issue has been a problem for a while now and I’m sure the team are working on it. I think it’s difficult given the spread of AI agents now plus the reach of Shopify stores generally that’s making the wait that long. I think the end of the year AMAs on here would help to reveal a lot of new information with regards to how solutions have been coming about and steps to help reduce it much more in 2026.
Hi @Maximus3, thanks for trying to help. However, recommending a country-blocking app doesn’t address the root issue. The bots exploit a structural flaw in Shopify’s infrastructure and pollute our analytics. Paying for a country blocker to bypass a global problem is not acceptable. Shopify, as the platform provider, should implement server-side protections (IP/country filtering, server-side captchas, WAF) rather than pushing merchants to pay for a workaround.
I agree. But…a free country blocker that you set a blacklist for, say, all non us countries, would take care of most of the bots. And it’s not just an issue in Shopify. 37% of all internet traffic is malicious bots. You trust them to secure your store? I imagine the fees would skyrocket cause they sure as h3ll ain’t gonna pay for server-side protections like a waf. 2 billion dollar net income last year, they don’t even have a functional service department…
You are 100% correct NickHM! No Shopify app can block China bots.
Apps run AFTER Shopify has already served the full HTML, so bots still get every page they request.
Apps cannot:
Block IPs
Block countries
Block ASNs
Stop GET requests
Stop direct URL scraping
Intercept traffic before Shopify delivers content
They can only show overlays or redirects to humansafter the bot already received the HTML.
→ So you go and try to fix this at the Cloudflare level and…
Shopify does NOT allow Cloudflare to sit in front of the storefront.
Your DNS points to Cloudflare, but Cloudflare is NOT the proxy! (WHAT!?! -that’s right)
→ Shopify forces all traffic to terminate at Shopify’s own edge, not Cloudflare’s ←
Because of that: Cloudflare never sees the request! → Cloudflare then CANNOT:
block China
block an IP
challenge a bot
run a WAF rule
rate-limit
stop scraping
detect bot behavior
Every request goes directly to Shopify’s servers, and the content is returned before Cloudflare can do anything. Cloudflare can only manage DNS, not traffic, for a Shopify storefront….
Since Cloudflare never intercepts the request, it cannot block China bots — or any bots!
NickHM - Shopify NEEDS to find a quick solution for us asap!
Yeah not being able to block foreign countries, weather that’s USA or China is a fundamental problem. If Shopify had merchants best interest at heart, they would address this and implement some extra controls for the merchant.
After I hit up Shopify several times to employ the Cloudflare WAF and they refused to do the job that would be effective, I used Cloudflare myself by -
– Putting my domain on a 3rd party domain manager. Can be any of them. Shopify allows this and it’s good practice also not to keep your domain on the same service as your web host.
– Then move to the free Cloudflare account where you get the rules and also speed optimization. It cut off the head of the bot snake. On the day I did it, the bots had already hit me 700K times from 15 ISP sites … yep you read that right.
There is some playing with the DNS records and Name Servers … I would read up on all that. Leave the Apex (A) record on your 3rd party manager and let Cloudflare manage the rest. If it is not easy for you, hire someone to do it. The cost to create this thing yourself though is either $0 or less than $25 depending on if your domain is close to an update or needs a transfer fee. My cost was $12.
The problem for Shopify is that they think they want to allow human traffic from all over the world. Unfortunately for real people, the bots mimic human behavior and they don’t have a tool to combat that. Under the system described, you’re removing the traffic from the face of your Shopify server either through the domain manager or Cloudflare. The problem is fixed before it hits. It’s a mess out there so have fun anyway.
Any chance you can share some more info about your solution? I’m going round the circles with this. I have finally managed to get the Cloudflare work with Shopify, by removing A and AAAA records pointing to Shopify and leaving only CNAME which worked under O2O scheme and all was working well as it should (I was able to cut all bot traffic on Cloudflare - thousands). The joy ended up after I realised that this setup caused TLS certificate failure on Shopify Domains setting, which I have initially ignored and carried on with that setup, but soon realised that some of important features are not working due to this issue (mostly important Apple Pay express checkout), so I had to switch the Proxy back off on Cloudflare to get the features back to work. But now I’m at the starting point and face tons of bot abandoned checkouts and large bot traffic on site.
Sounds like you’re doing the right things so far. You have some services probably under a CNAME, that yes, work well once you turn off the orange cloud from Proxied to DNS only. I have a few of those and Cloudflare notifies me every time there is a new certificate issued.
go to Security - Security Rules and create a rule. Make a blocking rule. Blocking Country or Continent - Block China, Hong Kong, Singapore and any other country your don’t care about. You can block entire continents too. Place it First. Let it run for a day. Then investigate AS Num that are still from China under the Security → Analytics area and create a blocking rule for AS Num = . This happens as it’s traffic from outside the countries you blocked. This makes for harder decisions like bot traffic on Facebook or Microsoft for example. If you need Facebook or Microsoft (Bing) to index your site, then you want to allow it. I’ve found tons of evil bot traffic though in those ASN’s so you might want to block it instead. You’re weighing the cost to your website.
I also need to create some “Skip” rules for those services that on the website like what you mentioned. For me, it’s a Book A Meeting and Forms that are really linking to my CRM. That company’s server gets a free pass all the time with the Skip rule.
Also, a Cloudflare rep called me yesterday to offer help and followed up with some links on questions I asked. They are very helpful. If you book a meeting with them, they can answer general questions and point you in directions you might want.
The security rules setup in Cloudflare is already done and it works as it should, so it is not an issue (but thanks for explaining anyway).
My question was more about DNS setup. The only way we found the site traffic to be going through Cloudflare filters is when we did NOT set any A and AAAA records pointing to Shopify, but only use CNAME (proxied) pointing to Shopify. Then Cloudflare traffic fitters will work fine, but Shopify will show TLS failure in Domains settings. Shopify support said we do need A and AAAA records to fix this error, but when we add these to DNS settings, then these cannot be proxied and CNAME pointing to root domain needs to be removed, so all Cloudflare filters will not work.
So the main question is how to setup DNS settings to get traffic be proxied through Cloudflare but at the same time to satisfy Shopify TLS Certificate requirement?
May be you can share your DNS settings in Cloudflare?
Has anyone completely solved this problem? I’m talking to Shopify support, and they’re suggesting irrelevant apps that won’t keep my Meta Pixel clean, only block content.
I used Orange to Orange via Cloudflare, but Shopify doesn’t recommend it. Doing that completely cut off Chinese traffic. But I don’t know if my Meta Pixel or other pixels are negatively affected.
Could it be an app we’re using causing this? If those experiencing this problem could list the active apps in their stores, maybe we can find a common solution.
Because this seems to be a problem affecting only certain stores, not all Shopify stores.
Use a mix of fraud filters, IP blocks or country blocks apps, and server side CAPTCHA to prevent bot traffic. Monitor analytics and remove suspicious sessions through Google Tag Manager. Stacking these techniques shields your ads performance, keeps your analytics accurate, and preserves your store’s integrity even in the absence of Shopify’s native server-side bot protection.
Will Shopify respond by introducing measures to allow stores to block traffic from certain countries / regions as quickly as possible? NickHM’s comments above were from Nov 2025. Today, March 2026, Shopify support also simply directed me to use a third party app.
Over the last few days we have gotten - per Shopify’s reporting 25,000 bots - showing as direct traffic from the US. I can’t block US. I could block Council Bluffs, Iowa… but I can’t block Los Angeles… and the majority show they don’t come from any city. I had recognition team scrub the visits and they’re from miscellaneous US companies and schools (I’m guessing stolen or hacked email accounts). This is a huge problem. Hello - SHOPIFY??? ARE YOU THERE?
Shopify views security as a premium upsell and is terrified of accidentally blocking the AI bots that now drive significant search traffic. I’d recommend to deploy a simple Cloudflare Worker that identifies the bot traffic and redirects it to a static 404 or a lightweight HTML page off the Shopify domain. This saves your Shopify analytics and prevents the Shopify server from ever being served to the bot.
The frustration is fair, and the architectural point in the thread is the key one: Shopify terminates storefront traffic at its own edge, so you can’t put your own Cloudflare WAF in front of the myshopify layer, and apps only run after the HTML is served. That’s genuinely why storefront blockers can’t fully solve a pre-delivery traffic flood.
That said, there’s a difference between stopping the bots and stopping the damage, and the second is achievable now:
For ad performance, the priority is keeping the bot sessions out of your Meta Pixel/GA4 optimization signal, server-side filtering, excluding the bot regions from your reporting segments, and not letting the inflated sessions train your ad algorithms.
For analytics sanity, a country/IP app like Blockify can cut the share that’s storefront-level and log what it blocks, which at least restores readable numbers even if it can’t catch everything at the edge.
It’s worth being realistic in this thread: until Shopify adds native server-side filtering, no app fully fixes edge-level flooding. The honest play is damage control on analytics and ad signal while pushing for the platform fix, rather than expecting any single app to make it vanish.
SEARCH first per guidelines