If bots are hitting your store and you want them gone, start with the free options. Some of them help a little, one or two of them help a lot, and none of them cost you anything but an afternoon. I am going to walk through those first, honestly, including the point where each one stops working, and then cover what you reach for when the free path runs out.
Not every store needs to pay for this. If your problem is mild, the free layer might be all you ever need, and I would rather you figure that out here than buy something you don’t need.
First, figure out what kind of bot you have
Bots get lumped into one word, but they don’t all do the same thing, and the fix depends on which one is hitting you.
- Scrapers and scanners crawl your product pages, inflate your session counts, and make your analytics lie. Mostly an accuracy problem, rarely a money problem.
- Checkout abusers hit the cart URL directly, create fake abandoned checkouts, spin up junk customer accounts, and pollute your email flows. This is the big one for most merchants.
- Card testers run stolen card numbers through your checkout in small bursts to see which ones still work. This is the expensive one, because it touches your processor relationship.
If you want the full taxonomy with the patterns spelled out, the Shopify bot traffic field guide goes deep on all seven. For now, just hold onto which bucket you are in, because it changes what you should turn on first.
The free stuff, in the order I would try it
Shopify’s built-in checkout protection
Shopify has a checkout CAPTCHA and some baseline bot defenses you can switch on in your settings. Turn them on. They will catch the lazy bots, the ones running an off-the-shelf script that actually loads your storefront and clicks through like a slow human.
Where it stops: the CAPTCHA only fires if the bot loads the page it lives on. A lot of the bots filling your abandoned checkouts never see your storefront at all. More on that in a minute.
The human or bot session filter
Shopify shipped a native filter in late 2025 that splits human from bot sessions in your reports. It is free and it is one checkbox. Turn it on.
Where it stops: it cleans Shopify’s own reports and nothing else. Your Google Analytics, your Meta pixel, your Klaviyo profiles, none of those get the memo. I wrote up exactly what it does and doesn’t touch here: what Shopify’s human or bot session filter actually does.
A WAF or rate limiting in front of your store
If you are getting hammered by sheer volume, a web application firewall (Cloudflare has a free tier) can rate-limit by IP, block known-bad ranges, and challenge suspicious traffic before it reaches Shopify.
Where it stops: this routes your DNS through a third-party proxy, which is fine when it works and genuinely painful when it doesn’t. A misconfigured rule can block real customers, and the worst time to discover that is mid-sale. The volumetric stuff it handles well. The patient bot that looks like one slow shopper, it mostly doesn’t.
Downstream cleanup
If the damage you actually feel is in your email tool (bounce rates climbing, your bill creeping up), you can filter the bots out on that side. The recipes for Klaviyo, which mostly carry over to Omnisend and Mailchimp, are here: filter bot abandoned carts out of Klaviyo.
Where it stops: this is cleanup, not prevention. The bot still hit your store, still fired your pixel, still created a customer record. You are just keeping one tool clean. Worth doing, but know what it is.
Where the free path runs out
Here is the thing that makes Shopify bots stubborn, and it is worth understanding before you spend a dollar.
Most checkout-abuse bots don’t browse your store. They hit a cart URL directly, something like /cart/44123:1, a variant id and a quantity, which drops them straight onto your checkout with an item already in the bag. They skip your homepage, your product page, your collection pages, all of it. So the CAPTCHA that lives on your storefront never renders, because they were never on your storefront. The session filter never sees a session to flag. The pixel that fires on add-to-cart fires anyway, because Shopify processed a real cart event.
By the time anything downstream could react, the bot has already done its damage. The webhook has fired, the pixel event is logged, the Klaviyo profile exists, the customer record is sitting in your admin. The free tools are either standing at the wrong layer or arriving a few seconds too late.
That gap, the few seconds between the bot hitting checkout and your tools reacting, is where the real pollution happens. And it is why merchants who have done everything on the free list still post in the forums asking why nothing works.
The two things that actually block at the source
When you decide the free layer isn’t enough, you are really choosing between two categories. It helps to know that going in, because the marketing around all of these apps blurs the line.
Edge or DNS-layer blocking. You reroute your domain through a third-party proxy (Cloudflare and similar) that inspects traffic and drops bots before they ever reach Shopify. The theory is clean. In practice it means handing your DNS to another service, tuning rules carefully, and accepting that a bad rule can break legitimate checkout traffic. It is powerful for volume and fragile for nuance, and the setup is not casual.
Shopify checkout-layer blocking. This keeps your DNS exactly where it is and stops the bot at the session layer inside Shopify, before the webhook fires, before the pixel event, before any customer profile gets created. Your downstream tools never see the bot at all, because there is nothing for them to see. The tradeoff is that you are trusting the block to be accurate so you don’t catch real buyers, which is the whole job of doing it well.
Neither one is free, and both are a real step up from the manual layer. The right call depends on whether your pain is mostly volume (edge leans useful) or mostly pollution of your pixel, email, and customer list (checkout-layer leans useful).
A quick way to see where you stand
Before you buy anything, spend ten minutes in your own admin. Sort your orders by date and look for bursts at odd hours, check whether your abandoned checkouts have real names on them or gibberish, and see whether the same cheap variant keeps turning up. That will tell you which of the three buckets above you are actually in, and most merchants can answer it faster than they expect to.
If it looks like card testing, the card-testing cost calculator will put a number on what it is costing you in dispute fees and processor risk. That number is usually higher than people guess, and it is the one that decides whether this is urgent or just annoying.
FAQ
Will Shopify’s CAPTCHA stop fake abandoned carts?
Partly. It catches bots that load your storefront and walk through checkout. It does not catch the ones hitting your cart URL directly, which is the majority of the fake-abandoned-cart problem. So you will see a dent, not a fix.
Is Cloudflare enough on its own?
For volumetric attacks, often yes. For the patient bot that mimics a single slow shopper, usually no, and the DNS rerouting carries its own risk during high-traffic sales. Treat it as one layer, not the answer.
Do I need an app at all?
If your bot traffic is mild and the free layer brought it down to noise, no. Run the audit, see where you land, and only pay if the pollution is still hitting your pixel, your email tool, or your customer list after you have turned on the free stuff.
Why do bots target small stores?
Because small stores are softer targets and card testers don’t care about your revenue, they care that your checkout will run a card. Store size has almost nothing to do with whether you get hit.
Where Doorman fits
Doorman is a Shopify checkout-layer bot blocker. It stops bots at the session layer inside Shopify, before the webhook, before the pixel, before any customer record, so your analytics, your email tool, and your customer list stay clean without you rerouting DNS or babysitting WAF rules. The free fixes in this post are the right first move, and if they hold, great. If the pollution is still getting through, that is the gap a checkout-layer block is built to close.
The founding cohort is open, no credit card… doormanapp.com.