If you have shopped for bot protection on Shopify, you have probably noticed that every app claims to stop bots, the descriptions all sound roughly the same, and merchants in forums report wildly different results with the same products. One person says an app fixed everything. The next says it did nothing. Both are often telling the truth.
The reason is that these tools do not all run in the same place, and where a tool runs decides what it is physically able to see. It is the single most useful thing to understand before you buy anything, and almost nobody explains it, so here it is.
There are four layers. Each one catches things the others cannot, and each one is blind to things the others handle easily.
Layer 1: the storefront script
Where it runs: JavaScript in your theme, executing in the visitor’s browser on your pages.
What it catches: scrapers, crawlers, obvious automation browsing your catalogue, add-to-cart abuse that happens on your actual cart page. Good at cleaning up session noise and keeping junk out of your on-page analytics.
What it cannot see: anything that never loads one of your pages. If a request goes straight to a cart permalink and lands in checkout, this code is never executed. Not evaded — never executed.
This is the layer most “bot blocker” apps live on, and it is why so many merchants with the direct-to-checkout problem report that their bot blocker “does nothing.” It is doing exactly what it says; the traffic simply never arrives where it is standing.
Trade-off: essentially none. It is cheap, it is easy, and it cannot break checkout because it is not near checkout. Just do not expect it to solve a problem that happens somewhere it is not.
Layer 2: the DNS proxy, or WAF
Where it runs: in front of your domain. You repoint your DNS so traffic reaches the vendor’s network first, gets filtered, and is then forwarded to Shopify.
What it catches: potentially everything that uses your domain, including requests heading for checkout, because the filter sits upstream of Shopify entirely. This is the only layer that can drop a request before Shopify ever processes it, which means it is the only layer that can prevent a checkout record from being created at all. It also handles volumetric attacks and DDoS well.
What it cannot see: anything about your store’s internal state. It is looking at raw HTTP requests — addresses, headers, rates, fingerprints. It does not know whether this shopper is logged in, what is in the cart, or whether the session has any history with you. It makes its decision on network signals alone.
Trade-off, and it is a real one: you are routing all of your store’s traffic through a third party. That is a hard dependency in the path between your customers and your checkout, including during your highest-traffic sale of the year. It is another company handling your customers’ request data. And when it misfires, it misfires in front of everything — there is no graceful degradation to “the store still works.”
Plenty of serious businesses make this trade deliberately and are happy. The point is that it is a trade, not a free upgrade, and the apps that use this model do not always make it obvious that repointing your DNS is what you are agreeing to.
Layer 3: checkout validation, inside Shopify
Where it runs: server-side within Shopify’s own checkout, as code Shopify executes while processing the checkout.
What it catches: the checkout itself, with full access to what Shopify knows about it — whether the buyer is platform-authenticated, what the cart carries, what was submitted. It cannot be bypassed by skipping your storefront, because it is not on your storefront. It runs regardless of how the shopper arrived.
What it cannot see: anything before Shopify started processing. Which matters more than it sounds: Shopify creates the abandoned-checkout record when the email address is captured, and that happens before a checkout validation gets its say. So this layer can stop a fraudulent order being completed. It cannot stop the junk record appearing in your admin.
Trade-off: no DNS change, no new dependency in front of your store, works on any plan. But it acts late in the journey, so it is the wrong tool if your actual complaint is the count of abandoned checkouts rather than what they are polluting.
Layer 4: order review and fraud scoring
Where it runs: after the order exists, against the order record.
What it catches: chargeback risk, stolen cards, suspicious order patterns. This is Shopify’s own fraud analysis plus the apps built around it.
What it cannot see: anything that never becomes an order. Fake abandoned checkouts, junk customer accounts and pixel pollution all happen without an order ever existing, so this layer never hears about them.
Trade-off: none to speak of, and you should have it on. It just is not an answer to the bot-traffic question most merchants are asking.
Putting it together
| Your actual problem | Layer that reaches it |
|---|---|
| Scrapers inflating sessions | 1 — storefront |
| Junk abandoned-checkout records in your admin | 2 — only a proxy, upstream of Shopify |
| Fake checkouts polluting Klaviyo / your ESP | 1, 2 or 3, depending on how it is wired |
| Card testing reaching your processor | 2 or 3 |
| Fraudulent orders that completed | 3 or 4 |
| DDoS and volumetric attacks | 2 |
The table is the whole article. Most disagreements about whether a bot app “works” dissolve once both people say which row they were in.
How to tell which layer an app is on
Vendors rarely say it plainly, but it is usually easy to work out:
- If setup asks you to install a theme app embed, there is a storefront component — layer 1.
- If setup asks you to change your DNS, nameservers, or mentions a CDN, proxy mode, bridge mode or edge nodes, it is layer 2. This is the big one to notice, because it is the biggest commitment and the easiest to agree to without registering what you agreed to.
- If the listing says it works with Checkout and the app requests validation permissions, there is a layer 3 component.
- If it talks about order risk, chargebacks or fraud analysis, that is layer 4.
An app can span several layers. Several of the good ones do. What you want to avoid is buying a layer-1 tool for a problem that lives at layer 2 or 3, which is the single most common disappointment in this category.
FAQ
My bot blocker has great reviews but did nothing for me. Were the reviews fake?
Probably not. More likely those reviewers had a layer-1 problem and you have a layer-2 or layer-3 problem. Read reviews for which symptom the reviewer described, not for the star rating.
Is a WAF overkill for a small store?
It depends entirely on whether you need the one thing only it can do — dropping requests before Shopify sees them. If your problem is downstream pollution rather than the records themselves, you can usually solve it without taking on the DNS dependency.
Why can’t a Shopify app just block the request like a WAF does?
Because a Shopify app runs inside Shopify. By the time any app code executes, Shopify has already received and begun processing the request. Only something positioned in front of Shopify can refuse it, and the only way to be in front of Shopify is to own the DNS path.
How do I know an app actually stopped something?
This is genuinely hard, and worth being sceptical about. Bot waves frequently stop on their own after one to three weeks, which means anything installed near the end of a wave gets the credit. Ask for a before-and-after on a number you were already tracking — abandoned checkouts per day, or bounce rate on your recovery flow — rather than trusting the absence of an event you could not see in the first place.
Where Doorman fits
Doorman is layer 3 with a layer-1 component: real storefront sessions are attested, and the checkout is validated server-side inside Shopify. No DNS change, no proxy, works on any plan.
That means it reaches the things layer 1 cannot — a bot that skipped your storefront entirely still has to pass a server-side check — and it does not reach the thing only layer 2 can, which is stopping the abandoned-checkout record from being created in the first place. If that record count is your actual complaint, a proxy is the honest answer and you should weigh the DNS trade seriously.
If what you care about is fraudulent orders completing, and your email tool and pixel staying clean, that is layer 3’s job.
The founding cohort is open — doormanapp.com.