Disable Right-Click and Protect Images on Shopify
How to disable right-click on Shopify, why it is mostly theater against scrapers, and what actually stops competitors cloning your images and catalog at scale.
On this page
TL;DR: Disabling right-click on Shopify stops a curious human from saving one image and nothing more. Scrapers never right-click: they fetch your image URLs and product JSON directly over HTTP, so the block never touches them. Casual deterrent is a browser trick; stopping competitors cloning your catalog is a network problem that needs scraper detection. Cordon handles the network side.
"How do I disable right-click on Shopify" is one of the most searched merchant questions, and it usually comes from a real fear: a competitor cloning your product photos. The honest answer is that right-click blocking does almost nothing about that fear. This post explains exactly what it does, who it stops, and what you actually need if the real worry is copycats lifting your catalog wholesale.
What right-click blocking actually does
Right-click blocking is a small piece of JavaScript that runs in the visitor's browser. It listens for the context-menu event (the menu that appears when you right-click) and cancels it. Fancier versions also block drag-and-drop saving and the keyboard shortcuts for copy and save. Some Shopify themes ship it as a toggle, and several "content protection" apps bundle it.
That is the whole mechanism. It changes what one specific human interaction does inside one browser session. It does not encrypt, hide, or remove anything. Your images are still served at their normal URLs, and the browser still downloaded every one of them to render the page.
Why it is mostly theater
The problem is that right-click is only one of many ways to get an image, and it is the only one this trick blocks.
- View source and dev tools. Every image URL is right there in the page HTML and the network tab. Two clicks in developer tools and the file is open in a new tab.
- Screenshots. The operating system's screenshot tool does not care what JavaScript says.
- Disable JavaScript. Turn JS off and the context-menu block never loads, but the images still do.
- The images are already downloaded. By the time you see the page, your browser has fetched and cached every image. It is sitting on disk.
And here is the part that matters most for the real fear. Automated scrapers never right-click. A scraper is a script, not a person with a mouse. It requests your product page or your /products.json feed over HTTP, reads the image URLs out of the response, and downloads the files directly. There is no context menu in that flow. The right-click block is JavaScript that only runs when a human interacts with a rendered page, and the scraper is neither human nor rendering the page. The defense and the threat never meet.
Who each approach actually stops
It helps to be blunt about which visitor each tool touches.
| Right-click blocking (browser) | Network-level scraper blocking | |
|---|---|---|
| Casual human saving one image | Deters (they can still screenshot) | Not the target |
| Human using dev tools or view-source | Does nothing | Not the target |
| python-requests or curl hitting /products.json | Does nothing (no browser runs the JS) | Blocked on velocity and datacenter ASN |
| Scrapy crawling your whole catalog | Does nothing | Blocked on velocity, UA, and ASN |
| Headless Chrome / Puppeteer clone bot | Does nothing | Blocked on headless markers and velocity |
| Competitor cloning your catalog wholesale | Does nothing | This is exactly what it stops |
The pattern is clear. Right-click blocking sits entirely in the "casual human" column. Everything that steals catalogs and images at scale lives in the rows below it, and none of those rows are affected by a context-menu trick.
So who steals images at scale, and how
The real threat is not a shopper with a mouse. It is tooling.
python-requests or curl hitting /products.json in a loop is the simplest version. No browser, no JavaScript, just HTTP requests pulling your catalog including image URLs. Scrapy, the industrial scraping framework, handles pagination and rotation and can crawl your whole sitemap in minutes. Headless browsers like Puppeteer and Selenium drive a real Chrome with no visible window, used when a target already blocks the simpler tools. All of it typically runs from datacenter networks: AWS, Alibaba Cloud, Tencent, Huawei Cloud, and the long tail of VPS providers.
The output feeds copycat stores: your photos, your descriptions, your catalog, reposted under a different brand running ads against your keywords. We cover the full mechanics in stop scrapers stealing your Shopify product catalog and on our stop content scraping page.
What actually stops it: network-level scraper blocking
Because the threat is a script fetching URLs, the defense has to live at the network, not in the browser. Four layers do the work:
- User-agent fingerprinting catches lazy scripts, default library user agents, and malformed headers.
- Headless-browser markers catch Puppeteer and Selenium even when they spoof a normal browser user agent, because headless Chrome leaves detectable traces.
- Request-velocity detection catches anything loading pages far faster than a human, regardless of what network it runs on or what user agent it claims.
- Datacenter and ASN blocking removes the cloud servers these tools run on. Blocking a whole ASN takes one rule and real shoppers are almost never on those networks.
Cordon runs all four, ships an Anti-scraper preset that turns them on together, and makes each decision in under 50 milliseconds at the edge. Verified search engines (Google, Bing) and good bots (GPTBot, ClaudeBot, PerplexityBot, Ahrefs) are verified at the network level and always allowed, so none of this touches your SEO. If that is a concern, we wrote do bot blockers hurt SEO on exactly that.
A layered image-protection checklist
If protecting your images matters, stack the cheap deterrents on top of the real defense. Do them in this order:
- Watermark high-value product images. A subtle brand mark makes a stolen image traceable and less useful on a copycat store. This is the only measure that survives after an image has been taken.
- Add a right-click deterrent, and test it. Free, quick, and it does stop the most casual copying. Watch your analytics after turning it on, because it also blocks right-click-to-open-in-new-tab and can annoy genuine shoppers. If conversion dips, turn it off.
- Turn on network-level scraper blocking. This is the layer that actually stops competitors and copycats cloning your catalog and images in bulk. Everything above it is a deterrent; this is the defense.
- Watch your visitor log. Confirm which networks are hitting your image and JSON endpoints, and block the ASNs that turn out to be scrapers. The log shows country, ASN, and the rule that fired, with IPs hashed for GDPR.
The honest framing: if your goal is stopping a casual visitor from saving one image, a right-click blocker is fine and free. If your goal is stopping competitors from cloning your images and catalog wholesale, that is a network problem, not a browser problem, and it needs scraper detection.
A note on bundled tools
Several content-protection apps lead with right-click blocking as if it were the main event. It is not. If an app's headline feature is disabling the context menu, understand that you are buying a casual-human deterrent, not scraper protection. Securify, for example, bundles right-click tools alongside its blocking features, and we compare where that leaves you against real network-level detection in our Cordon vs Securify comparison. For the wider field, see our best Shopify bot blocker apps roundup.
Frequently asked questions
How do I disable right-click on Shopify?
A small JavaScript snippet disables the browser context menu and sometimes drag-and-save. Some apps and themes include it as a toggle. It deters a casual human from saving one image and does nothing against automated scrapers.
Does disabling right-click actually protect my images?
Barely. Anyone can view source, open dev tools, take a screenshot, or disable JavaScript to get the image. Scrapers never right-click at all: they fetch your image URLs and product JSON directly over HTTP, so the block never applies to them.
Who does right-click blocking actually stop?
A curious human who would have saved one image by right-clicking, sometimes. It does not stop competitors, copycats, or any automated tool cloning your catalog, because those never use the context menu.
What actually stops competitors stealing my images at scale?
Image theft at scale is a network problem, not a browser problem. Scraper detection using user-agent fingerprinting, headless-browser markers, request-velocity limits, and datacenter ASN blocking stops the tools that fetch your images in bulk.
Should I still turn on right-click blocking?
It is fine as a free, low-cost deterrent against casual copying, but test it first because it can annoy real users who right-click to open links in new tabs. Do not treat it as real protection against catalog cloning.
Right-click blocking is a deterrent. If the real worry is competitors cloning your images and catalog, Cordon does the network-level part: user-agent fingerprinting, headless markers, velocity limits, and datacenter ASN blocking, all decided in under 50 milliseconds with verified search engines always allowed. See features for the full detection stack and pricing to start free.