Any one else have a big spike in sessions from outside where they sell? These last two weeks have been insane. I installed Blockey and it is starting to look better but Shopify still counts it as a session. It is really throwing off my conversions! I guess it takes time for foreign traffic to get the message. Any other solutions out there?
Yeah you’re not alone, this wave has been hammering stores for months and a lot of merchants are stuck on the same thing. Quick reality check on Blockify and similar apps: they block at the storefront/Liquid level, so the page already loaded and Shopify counted the session before the redirect kicked in. No way around that on standard plans because you can’t put a real firewall in front of Shopify’s edge.
While this is going on, stop trusting blended conversion rate. Segment by country and look at the rate just for the markets you sell to. That’s your real number.
Best,
Moeed
Moeed’s right that storefront-level apps can’t stop the session count. The session is logged the moment Shopify’s edge serves the page, and Liquid runs after that.
The only real fixes happen before the page hits Shopify.
Cloudflare in front of your domain (Plus only, since standard plans don’t let you change A records away from Shopify): set a country-allowlist Worker, return 403 for everything else. Shopify never sees those requests, so no session.
Shopify’s own Markets-level access controls if you have Markets Pro: hide the storefront entirely from regions you don’t sell to. Doesn’t block bots specifically but stops a lot of scraper traffic loading from real residential IPs in those regions.
Inside the analytics: like Moeed said, segment conversion by country. Also worth comparing your Shopify session count against Google Analytics filtered by countries you actually sell to. The delta tells you what fraction of reported sessions are even relevant to your conversion math.
Two weeks of insane spikes usually correlates with a botnet rotation or a price-comparison scraper running on a category. Anything specific change around the start of the spike (new campaign, app install, price test)?
Hi, lumine’s diagnosis is technically correct and the Cloudflare Worker approach is the cleanest fix for Plus. I want to add one thing from the analytics side for stores that can’t use Cloudflare (standard plans)
Separate your conversion metrics from your session metrics entirely.
The spike in sessions from foreign bot traffic inflates your overall conversion rate denominator, which makes your store look like it’s performing worse than it is. Before you spend time chasing the bot traffic itself, recalculate your CVR using only sessions from the countries you actively sell to. In most cases I see this, the real conversion rate is 1.5-2x what the overall Shopify dashboard shows. That changes what you prioritize fixing.
On the bot side, if you’re not on Plus, the best lever without Cloudflare is: install a bot-blocking app (you already have Blockey), then in Google Analytics 4 create an audience excluding your non-target countries and use that filtered view as your primary dashboard. Shopify’s native analytics don’t let you filter by geography, but GA4 conversions filtered by country gives you a clean signal.
What country is the spike coming from? That usually narrows down whether it’s a scraper or credential stuffing.
Spikes in foreign sessions is a bot or proxy traffic inflating your analytics. Use Cloudflare WAF rules (or other similar edge filters) to challenge suspicious countries + server side blocking, refine reporting by splitting out traffic by geo, removing known bots to help stabilise conversion analysis and decision making.
Has anyone found a solution for this or any formal response/fix from Shopify? I am getting 10,000+ sessions from Singapore a day and it is killing analytics and shutting down some of my apps as it is putting them over their monthly limits. I don’t understand how this can’t be shut down from the front end.
Shopify, please help.
Thank you for your reply. I have to say, things are looking much better with Blokey installed. Can you tell me how I would set up segments by country in Shopify? Or is that just something I do in GA?
Mary
Blockey is working for me. I was having so many sessions in Singapore and Vietnam that it was really killing my analytics as well. I looked this morning and there were only a trickle of sessions coming from those locations. It is not expensive and seamless to install.
Nothing specific changed. I did install Blockey and that has made a huge difference. I still get a few sessions from outside where I sell but not like it was. I blocked everything but the US and Canada and its territories. I’ll just use GA to figure it out I guess.
Glad Blockey is working out.
For country segments, Shopify does have a Sessions by location report under Analytics > Reports > Acquisition. You can filter by country there to see traffic without the bot noise.
For anything more detailed - like segmenting conversions by country or building audiences for email - GA4 is honestly much better for this. In GA4 you can add Country as a secondary dimension in almost any report, or build an Exploration with country as a breakdown. That gives you a much cleaner picture.
Cleanest setup: Shopify Analytics for quick sanity checks, GA4 for the real analysis.
Thank you! Very helpful!
Mary
We’ve seen this happen a few times too, especially from crawler/proxy traffic that inflates sessions without behaving anything like real customers.
The frustrating part is that it can make conversion rates suddenly look terrible even when actual order volume hasn’t really changed much.
Breaking analytics down by country/source usually made things much easier to interpret for us.
bot traffic is a plague right now and it’s messing up everyone’s analytics. the best thing you can do is filter it out of your reporting so you’re making decisions based on real data. in Shopify analytics, segment by country and only look at your actual target markets.
beyond Blockey, check your Shopify admin under Analytics > Reports > Sessions by location. if you see huge spikes from countries you don’t ship to, that’s your bot traffic. some people also add a country redirect or geo-block at the theme level for countries they’ll never serve. won’t stop the sessions from counting but at least your site won’t slow down serving pages to bots.