Live on the Shopify App Store
Block bots, scrapers, VPNs and country fraud on your Shopify store.
One decision in under 50ms, on every visit. Blocked traffic never gets to browse. Real customers never notice. Google is never blocked.
Free plan included, 7-day free trial on paid plans. Cancel anytime.
cordon · live visitor log
armed
- 47.242.x.xAS45102 Alibabarule_country CNBLOCK
- 3.239.x.xAS14618 AWSdatacenter_asnBLOCK
- 84.86.x.xAS33915 VodafonecleanALLOW
- 185.220.x.xAS60729 Tor exittor_exit_nodeBLOCK
- 66.249.x.xAS15169 Googleverified_googlebotALLOW
- 129.226.x.xAS132203 Tencentauto_scraper_velocityBLOCK
- 88.130.x.xAS3320 DTAGcleanALLOW
- 104.28.x.xAS13335 residential proxyproxy_residentialBLOCK
The 73-second pitch
What bots cost you, and where Cordon draws the line
With sound. Country blocks, VPN detection, bot fingerprinting, the live log.
bot & scraper detection
Confirmed automation gets stopped. Real browsers never do.
Scrapers announce themselves in ways real shoppers cannot fake: python-requests and Scrapy user agents, headless Chrome markers left by Puppeteer and Selenium, and request patterns no human produces. Cordon checks all of them.
- User-agent fingerprinting for known scraping tools
- Headless browser markers (Puppeteer, Selenium, Playwright)
- Request-velocity detection: 40 product pages in 30 seconds is not a shopper
vpn, proxy & torGrowth and up
Live detection data, not a stale IP list
Fraudsters hide behind VPNs, residential proxies, and Tor so their real location never touches your order screen. IP lists from 2018 miss modern residential proxies entirely, because those exits look like home connections.
- VPN and proxy detection refreshed continuously
- Tor exit node blocking
- iCloud Private Relay allowlisted by default
country blocking
200+ countries, one click each
If you never ship to a region but keep eating chargebacks or scraper traffic from it, stop serving it. Pick countries from a flag picker, or apply a preset like Block China in one click.
- One-click flag picker for 200+ countries
- Quick presets: Block China, Anti-scraper, Strict mode
- Allowlist specific IPs inside a blocked country
datacenter & asnPro and up
Scrapers live in datacenters. Your customers do not.
Almost no real shopper browses from a rented server, yet AWS, Alibaba, Tencent, and Huawei Cloud are where most scraping traffic originates. Cordon ships a curated blocklist of hosting networks you can enable in one click.
- Curated datacenter list: AWS, Alibaba, Tencent, Huawei Cloud, and more
- Block any ASN with a single rule
- Verified good bots stay allowed even inside blocked networks
live visitor log
See every decision, without storing anyone's IP
The visitor log shows every allow and block in real time: country, network, and the exact rule that fired. You can watch a scraper hit the wall and know precisely why.
- Real-time allow and block decisions with reasons
- Country, ASN, and rule shown per event
- SHA-256 hashed IPs with a daily-rotating salt
Inside the app
A dashboard you check once a week, not babysit
Everything lives in your Shopify admin. Click any screenshot to see it full size.
How it works
One decision, on every visit
01
A visitor requests your store
The request carries an IP, a network (ASN), a country, and a browser fingerprint. Cordon reads all of it on the first page load.
02
Cordon decides in under 50ms
Your rules run against live geo, VPN, proxy, and datacenter data, plus bot and velocity checks. Cached decisions answer instantly.
03
Customers pass, threats stop
Real shoppers never see a thing. Blocked traffic hits your custom block screen. If Cordon is ever unreachable, it fails open.
Cordon in action: rules, live log, block screen.
Pricing
Starts free. Scales with your traffic.
Free
$0/mo
Try it out
Basic country and bot blocking to see Cordon work on your store.
- Country blocking
- Basic bot blocking
- Customizable block screen
- Live visitor log
Starter
$9/mo
10,000 visitors/mo
Geo and bot detection for stores getting started.
- Everything in Free
- 200+ country rules with flag picker
- IP and IP-range rules
- Allowlist and quick presets
Most popular
Growth
$19/mo
100,000 visitors/mo
Adds live VPN, proxy, and Tor detection.
- Everything in Starter
- VPN and proxy detection (live data)
- Tor exit node blocking
- Fraud-score threshold tuning
Pro
$49/mo
5,000,000 visitors/mo
Adds datacenter network and scraper detection.
- Everything in Growth
- Datacenter and hosting ASN blocks
- Request-velocity scraper detection
- Spoofed-crawler detection
Plus
$99/mo
5,000,000+ visitors/mo
For the biggest stores: longest retention and priority support.
- Everything in Pro
- 365-day log retention
- 10,000 rules
- Anti-scraping mode (in development)
- Priority support
7-day free trial on every paid plan. Cancel anytime from your Shopify admin.
Merchant reviews
Reviews from the Shopify App Store will appear here. Until then, read them at the source: Cordon on the App Store.
Frequently asked questions
Will Cordon block real customers?
No. Cordon only blocks traffic that matches rules you enable, and its bot detection blocks confirmed automation only. Ordinary privacy tools like iCloud Private Relay are allowlisted, and a fraud-score threshold keeps mobile and corporate networks shopping normally. If the service ever hiccups, Cordon fails open and everyone gets through.
Does blocking bots hurt SEO?
Not with Cordon. Verified search engines (Google, Bing) and good bots (GPTBot, ClaudeBot, PerplexityBot, Ahrefs) are always allowed and cannot be blocked, even by your own rules. Verification uses the crawler's real network, so a fake Googlebot still gets caught.
If I block datacenter traffic like AWS, won't that block Shopify or real customers?
No. Cordon reads each visitor's own connection, and real shoppers connect from home and mobile networks like Comcast or Vodafone, never from a rented AWS or Alibaba server. Where Shopify hosts its servers is irrelevant, because Cordon measures the shopper's browser, not Shopify's infrastructure. Datacenter blocking stops server-based scrapers and bots, while verified search engines and good bots that do run from the cloud (Googlebot, Bingbot, GPTBot) are exempted before the datacenter check ever runs. If you use a legitimate cloud service that visits your storefront, you allowlist it once.
Will it slow my store down?
No. The blocking decision takes under 50ms and runs from a theme app extension, not an injected script tag. Cordon is built to keep your Lighthouse scores intact.
How is this GDPR compliant?
Cordon never stores raw IP addresses in your visitor log. IPs are hashed with SHA-256 using a salt that rotates daily, which makes historical hashes permanently irreversible. A DPA is available for EU merchants.
What happens if Cordon goes down?
Your store keeps selling. Cordon fails open by design: if the detection service is unreachable, every visitor is allowed through. A hiccup on our side can never take your storefront offline.
Two minutes to install.
Everything unwanted stays outside.
Free plan included, 7-day free trial on paid plans. Cancel anytime.