Help
Log in

Protecting your store from bots

Shopify uses multiple tools to protect your store from bots and automated traffic. Bots are used widely throughout the internet, some bots can be beneficial and others harmful. For more information about bot types, refer to Bot types and intents.

In this article you can learn more about the ways Shopify handles automated traffic and bots, and how you can reduce bot impact on your store.

On this page

How Shopify protects your store from bots

Shopify uses Cloudflare services to protect your store from bots. All requests that come to your online store on Shopify must first pass through Cloudflare. Shopify uses features, such as Web Application Firewall (WAF) and Distributed Denial of Service (DDoS) protection, to shield your store from the majority of automated traffic and bots. Cloudflare is always active on your store and requires no action from you.

Occasionally, such as in cases when behavior seems automated or a user is connected through a virtual private network (VPN), visitors might receive a Cloudflare verification challenge when navigating your Shopify store. The verification challenge reads "Your connection needs to be verified before you can proceed", prompting them to verify their connection. Verifying that they're human takes a few seconds, and visitors can then continue as usual.

Shopify also uses hCaptcha that helps to analyze the behavior of visitors to your online store. hCaptcha is a security tool that blocks spam from bots and lets legitimate users access your content or services without unnecessary friction. Learn more about protecting your store with hCaptcha.

Reducing bot impact on your store

You can use the following strategies to understand and reduce the impact of bots on your Shopify store:

  • Confirm that hCaptcha is active in your store: hCaptcha is activated by default on all Shopify stores. Confirm that hCaptcha is active to limit spam bot activity on contact and comment forms and customer account pages.
  • Update your theme and apps regularly: Update your Shopify theme and apps regularly to ensure you have the latest patches and improvements.
  • Monitor traffic analytics: Use Shopify analytics or Google Analytics to monitor traffic for spikes or patterns that might indicate bot activity.
  • Implement order risk assessment: Implement a fraud protection strategy to limit fraudulent order activity.
  • Educate your staff: Ensure that staff that manages your store understands bots and how to recognize them.
  • (Plus only) Activate bot protection: If your store is on the Shopify Plus plan, then you can activate bot protection for your checkout.