Tons of bots creating and abandoning carts

Shopify Discussion
1

Over the last few weeks, I’ve had a massive influx of bots with similar names and addresses adding low price products to carts and then abandoning them. I’ve spoken with Shopify support regarding this issue and all they could tell me was to “install bot protection apps” and to turn on re-captcha. Neither has worked.

Almost all the emails are a name with three numbers after (ex. allen690@yahoo.com) and the address is typically empty or is:

House Number 43, Gray Colony
Bellevue Washington 98006
United States

I dived into the source of these bots by going to customer->select a bot->request customer data, and it says creation source is “Shopify App”. Any ideas on how to fix this? These are destroying my conversion rate numbers which are an important metric we use for tracking.

2

What are they attempting to do by adding products to their carts? My company sells fairly high value product ($1000) and what the bots add are accessories usually in the $100 range.

3

You’re not alone — we’re seeing the increased bot activity across our Shopify Plus store.

We’ve spent weeks working with third-party bot detection providers and even escalated to Shopify Plus support — and here’s what we found:

  • The bots are using over 18,000 rotating IPs and common browser user agents, making them indistinguishable from real users

  • They are hitting storefront pages, polluting analytics and funnel data, then triggering backend cart events directly

  • Apps and captchas do not stop them — they bypass the UI entirely

  • The only viable solution is at the Cloudflare WAF layer, which only Shopify controls

Unfortunately, Shopify support has declined to take action at the platform level, instead pointing merchants to apps that can’t technically stop these bots. We’ve now published a public call to action here on the forum outlining the problem, solution, and Shopify’s reluctance to implement a proper fix: https://community.shopify.com/topic/3031295

If you’re affected, please comment and upvote the post. We believe this is a platform-wide security issue, and the more voices involved, the harder it will be for Shopify to ignore.

Let’s get this fixed — together.

4

Yep, we’ve now been getting up to 400 Bot Add to Cart hits a Day! Including the House Number 43 one. Most seem to be from Bellevue, WA, but filtering for this is just silly. Upgrading to a $2,300/month Plus plan to protect our customers is NOT an appropriate answer from Shopify. This clearly seems to be a way to test Stolen Credit Cards since they seem to stop at the checkout page. Thanks a lot for showing us how important we are to you after years of being faithful customers who recommend you to everyone else, Shopify. This is NOT acceptable for a mature platform of your size and will only drive us to have to put more of our efforts into the evil Bezos beast instead. :cry:

5

Guessing testing Stolen Credit Cards? Apparently that’s not important enough for Shopify to try to protect us and save our analytics and ability to market to real customers who are considering Completing the Check Out Process.

6

We are seeing the same. 100 per hour for a week. Before we caught it, our Checkout Abandon open rates collapsed completely as a big batch got sent emails.

There are 3 types:

Those with address: House Number 43, Gray Colony, Bellevue Washington

Those with address: 23, Scottsdale, Happytown

Those with no address.

Almost all of them have an email format that includes 1-2 common names (first or last), and 3 numeric digits in various combinations. eg: smith.sanchez326@gmail.com, allen353taylor@yahoo.com

Shopify Plus support told us they could not do much about it, that we should contract with a bot blocking app, but here’s the reply we got from the best one our developer could recommend:

Our experts have reviewed your order and abandoned cart records, and we have confirmed that a bot is accessing your store. However, unlike typical bots, this one doesn’t need to access your product pages and can directly enter the checkout through links like the one below:

Since Shopify does not allow any app to run on the checkout page, apps like ours, which block IPs and countries, can only run within the Shopify system (on Shopify pages), by the time the bot reaches Shopify, it’s too late to block them. You will need to install some WAF (Web Application Firewall) tools (such as Cloudflare or Sucuri, these are not Shopify Apps). These tools are can intercept the bot requests before they reach Shopify, , and in theory, they can block any malicious access you want to intercept. Only such tools can work.

If the only reason you installed our app is to block this bot, you may consider uninstalling our app, and choose a WAF product to resolve the issues your store is currently facing. If you encounter any issues related to blocking visitors or even with the WAF in the future, feel free to contact us anytime.

Haven’t explored what a WAF is or how to install it yet…

Very disappointing that Shopify Plus doesn’t make this an SOP.

7

Yeah, once again Shopify is really showing how on top of things they are. Bot traffic corrupting analytics, inflating marketing spend, and interfering with storefronts — and the best their tech support can offer is “try an app” or “use checkout rules” (for bots that never even reach checkout). Brilliant.

Even escalating through Plus support and asking for help from management leads to radio silence. Really builds confidence in that “enterprise-level service,” doesn’t it?

Anyway, we’re currently setting up an external WAF solution since Shopify clearly isn’t stepping up. I’ll report back here once it’s running and let you all know how it goes.

8

Require customers to use email to log in to check out and it stops this bot.

9

We are seeing 1,000+ of these per day since April 7th. On our site they are not attempting to charge CCs, just starting checkout & add-to cart actions. Are others seeing CC testing occurring?

Shopify support has said they can’t do anything because it isn’t preventing normal checkouts. I’ve had to turn off my abandoned cart emails to prevent damage to our email domain reputation.

10

One thing our email provider helped us do is separate abandon cart from abandon checkout email automations. A user exists from abandoned cart automation if they a) start checkout, or b) place an order. Since the bots are going direct to checkout, you can still capture people are are abandoning cart prior to checkout.

We then created a BOT segment in our email provider with rules - a) have not opened any message, b) have not placed an order, c) have not visited any URL on our website where URL does not contain ‘checkout.’ So now we filter out BOT segment from all sends.

For the new abandon checkout automation, we then also created an exit rule where user exits the automation if a) places order, or b) enters segment ‘BOT’

This is not ideal, but it’s allowed us to resume more or less normal email marketing. There may be a few legit users that get swept up in the BOT segment but i think it’s very few if any.

11

One thing our email provider helped us do is separate abandon cart from abandon checkout email automations. A user exists from abandoned cart automation if they a) start checkout, or b) place an order. Since the bots are going direct to checkout, you can still capture people are are abandoning cart prior to checkout.

We then created a BOT segment in our email provider where they have to match all of these rules (and joiners). a) have not opened any message, b) have not placed an order, c) have not visited any URL on our website where URL does not contain ‘checkout.’ Now we filter out BOT segment from all sends.

Then for the newly created abandon checkout automation, we then also created an exit rule where user exits the automation if a) places order, or b) enters segment ‘BOT’

This is not ideal, but it’s allowed us to resume more or less normal email marketing. There may be a few legit users that get swept up in the BOT segment but i think it’s very few if any.

But if Shopify truly wants to live up to its reputation as world-class e-commerce, they should not force us to contract with third parties like Cloudflare to handle what should be a very SOP thing.

12

We seem to have successfully blocked the cart and checkout exploits by setting up a third party WAF. We are still in testing mode, so I will not share the details yet, but the solution seems to be in sight. Stay tuned and i’ll share once solution is fully confirmed.

13

Please let us know. Very weak on Shopify’s part tha we would need to do this.

14

Our bot attack seems to have finished. Not sure if Shopify did something or the bot just ran its course. 18,000 bad emails later…

15

Keep us posted on whether this is indeed getting better. We’ve had false hopes as well as they seem to pause and come back fairly quickly in waves. We had a few (10-ish) after midnight last night (less than usual) but yesterday we still had a fair amount.

16

We have successfully blocked bots. Now we’re in cleanup mode (all theirs party integrations need to be checked and updated if needed, these still some unknown seo implications, URLs structure of Shopify nav links needs to be manually updated,…). I need few more days to finalize this then I’ll post what I’ve done (to make sure I don’t give anyone wrong directions )

17

Thank you Jan, looking forward to your update. We’ve been hit by 1000s of bots adding to cart and opening accounts.

18

The bot attack tailed off for a week or so but now they are back and they are smarter this time. They are visiting home page, visiting, collection, then product before geting to cart and checkout. So it’s not as easy to bucketize them into a BOTS segment by lack of pages visted other than cart or checkout. Some bots are also moving from the checkout to the product page (via the link in checkout i assume), Then they add those products to the cart again. So now they are infiltrating our abandon checkout, abandon cart, AND abandon product email automations.

Shopify is pointing the fingers squarely at us - telling us it’s our problem and we need to find an app. Which seems completely ridiculous. Shouldn’t this be part of at least the Shopify Plus deal? I mean this is ABC security stuff, not some nice-to-have enhancement.

19

@JanVeroti do you have a 3rd party team set up the WAF for your store? If yes, can you recommend them to us, it’s hard to find trusted 3rd party security engineers online now. Thank you!

20

Hi. Yes, I’ve been working with a third-party team on a custom setup to deal with this.

The solution we’ve integrated is essentially an O2O (origin-to-origin) CDN-layer addition that sits in front of Shopify — similar in concept to how Cloudflare works. Our WAF (Web Application Firewall) runs on Akamai and is specifically designed for bot mitigation. Since implementing it, we haven’t had a single bot-related issue.

That said, it’s important to understand the trade-offs. Once you adopt this type of solution, you can’t run another CDN in parallel — which means you lose out on services like asset delivery optimization, page speed boosts, DDoS protection, etc. So your site must be cleanly coded and optimized to pass Core Web Vitals without the help of a traditional CDN before going down this path.

There are some SEO considerations too. Since the checkout domain becomes custom (via DNS), clicking back to the site from checkout keeps the checkout. subdomain in the URL — which has on-site SEO implications. A fix via Checkout Extensibility is in the works, but for now, you can patch it by replacing the native logo with a custom image link, adjusting your robots.txt, and using proper rel attributes.

Also worth noting: since the WAF performs deep bot detection (evaluating IP, ASN, ISP, headers, device info, etc.), you might occasionally hit a frontend verification check if you’re doing lots of refreshes while working on the site. It’s not messy, just something to be aware of.

I’d love to share the contact info for the company behind this, but they’ve asked me not to for now. They’re planning to launch a Shopify app soon (mostly a UI for DNS onboarding + traffic reporting). I’ll update here when I get the green light to share more.