Thank you so much, @JanVeroti this is going to be helpful for all of us here. Appreciate it! Please keep us updated, curious about this app they’re launching!
Been following you closely @JanVeroti hoping to hear that you’ve got the answer that will save us. We’ve been dead in the water with this chaos and really disappointed in Shopify for not doing anything about it. Kudos to your team for finding a solution. Crossing my fingers that it’s something we can afford in order to get our shop and marketing rolling again. Frustrated as heck that Shopify isn’t making this a priority for the customers that put their trust in them.
We are seeing EXACTLY the same issue.
More than 1000 bot customers added per day. Every day, since November 2024.
Our Shopify store (not plus) is tightly integrated with Klaviyo, and in Klaviyo we are seeing bot events that begin in checkout without any page visits (added to cart, checkout started), as well as “fake” form events (from Shopify).
The bots are not adding payment info or trying to run credit cards…
Can’t figure out WHY they are here.
99% of the bots do not have a first or last name, so my methods have included adding filters to Klaviyo flows to trap no-FirstName-set profiles to its own list, then a flow that deletes the profiles via webhook.
We also have a Shopify FLOW workflow that deletes Shopify customers with 0 orders.
BUT THIS does not help us avoid corrupting the Klaviyo metrics with BOUNCES for checkout started flows and browse abandon flows.
And this does not circumvent or solve for the bots who use a name and look like they complete a klaviyo form and checkout started. these are the profiles that can’t be solved by automation.
Klaviyo has been as helpful as they can be, but this is NOT their problem.
But as long as we are syncing Shopify to Klaviyo (backfill checkout form content) - it is corrupting the Klaviyo metrics AND ALL RELATED merchant -created customer lists for advertising.
Shopify refuses to accept any responsibility for this. I have opened cases going back to November.
I added “Negate Bot Protection” app. But it does not do anything in checkout. Where this is all happening.
They appear to have entirely disappeared as of Friday 09-MAY-2025, approx 11:30am EDT – but that was short lived, and a few days later, then came back with a vengeance!
I have tried everything.
@JanVeroti the WAF technique in my opinion is tossing the baby out with the bathwater. ESPECIALLY if using a backfill to Klaviyo.
Now, we COULD disable the backfill to Klaviyo, and that would probably eliminate the risk of bounces and bad data in Klaviyo. BUT - we lose the real customer metrics.
I am also part of a global group of merchants that are also experiencing this. We are all seeing similar issues.
Where is Shopify Engineering?
I can share my Klaviyo flows and filters… but this REALLY needs to be solved at the source.
HOW can Shopify permit this traffic to infiltrate and contaminate the servers and all the merchant data?
HEEEEEEELLLLLPPPPP us Shopify?
EXACT same issue @Robert_Behnke --and I noticed the same disappearance about 09-MAY-2025, then it all came backwith a vengeance about 5 days later. Please see my reply to @JanVeroti above.
This bot issue is crazy and nonstop. You can stop the abandonded cart by require log in, but the rest of the site gets tons of fake traffic killing any value to analytics. Shopify is just ignoring this issue.
Hi Jeremy.
You needto push a custom “bot” metric into Klaviyo and create a segment of those profiles (you can do that using shopify flow). Be sure to exclude this segment from all automated flows. The reason is that the sync delay between Shopify/Flow automation and Shopify-to-Klaviyo can still cause bot profiles to be pushed into your email lists. This is critical because maintaining your email sending reputation is key — if it drops, you’ll need to re-warm your list, which is a slow and painful process.
See my full reply that has this part as well on this thread: https://community.shopify.com/post/3054446
I don’t know if this is just a coincidence. I know best practice is to unsubscribe instead of delete known bad emails. However a few days ago i just got so frustrated at the 90K plus emails clogging up shopify and omnisend (our version of klaviyo). Even though we had been mainly successfully quarantining them with rules based segments (no orders, less than 5 page visits including checkout). I went ahead and DELETE this segment. Then 100 more per hour. Then delete again after another day and 2000+ bad emails. Repeat repeat repeat. Last time i mass deleted was about 3 hours ago and i only have 28 new bot emails. So maybe actively deleting does something to the sender to slow it down? I’m sure i deleted a handful of legit customers (at least subscribers, not customers since anyone who has made a purchase is not in the bot segment).
Will post again if i truly see a big slowdown that endures.
I’m still getting some but it looks like, at least for now, the pace is 1 every 3 minutes or so instead of like 5 per minute.
Yes, but… the bot emails are useless, and there is no redeeming or future value of the profile as suppressed or unsubscribed.
An unsub or suppressed profile can feed retargeting or custom audiences. But bot profiles have no value.
Make them go away.
That’s what i’m doing now. Thanks for the validation.
The solution is here.
As I mentioned in earlier posts, we’ve spent weeks battling Shopify’s inability to deal with malicious bot traffic, especially fake add-to-carts and inflated session data. We implemented a third-party WAF to fix it, and after extensive testing, refinement, and real-world usage, that solution is now available to everyone.
It’s called Armex: Block Checkout Bots and it’s now live in the Shopify App Store.
We’ve been running it in production for a while, and I can confidently say: this is the only real, working solution right now for merchants dealing with Shopify’s lack of bot protection.
- Blocks bots before they hit your checkout
- Cleans up your analytics & ad performance
- No more fake profiles and messed up Klaviyo data
- No more fake sessions inflating data
- Easy setup, no coding - just follow instructions
Install this app and follow the instructions. This is as close to a plug-and-play fix as it gets — and it actually works.
App link: https://apps.shopify.com/bora-ip-blocker-country-block
Thanks for posting this. What do we know about this app or the developer. It has been out since November of 2023 and only has 1 review. How are they able to do what all other apps say they do not have access to?
Any update with this. Since yesterday I am having the same bot same address as you are stating happening to me every min.
I agree with Barry_Berhoff’s question. Their app has been around since 2023. Where is the info that this was updated recently to target this? Would love to see some more information from others that this is working and not causing any unforeseen issues.
Anyone else tried this solution? I am at my wits end with these bots, but messing around with our DNS doesn’t make me very comfortable.
This is the one and ONLY solution. It’s invite by link only as the app is new. I got the link from another blocker app that couldn’t solve our abandoned cart issue. After installing the app I contacted support. They walked me through the steps (took 30 minutes or so). We went from hundreds of abandoned carts and customer signups a day to none in less than 24 hrs. Use the link. This app does what none of the other blocker apps do, fix the issue.
It Sure Is!
Working PERFECTLY.
And… support has been quick to answer any quesitons.
I am not removing my klaviyo flows or filters, and I am keeping the N8N server too – but Armex app with the firewall and script is the missing element to say goodbye to the bots.
This SHOULD have been a Shopify solution.
But… Thank you!!
Installed and issue fixed within hours. Congrats and a huge thank you for creating a real deal fix for this issue. I can sleep now.
Anyone else quite suspicious of this “solution”? I got these emails from “Boostymark” the “BM: Country blocker IP Blocker” that was also supposedly a secret solution, and started in 2023. Then they recommended going over to the new “Armex” app, which if you look at the privacy policy is generic and clicking into the app owner profile of Bora App, the privacy policy looks generic and similar to Boostymark, but their website is restricted. As I read these reviews for this Bora App “Armex” they seem suspicious. Anyone not affiliated with either app seeing any signs of this working, but also not being something that could potentially be a phishing scam?
No.
It works.
And they are transparent in the support – they tell you how to solve this without using their app (if you are on Shopify Plus).
I posted a 5-star review.