How to Block Tor Traffic on Shopify (2026)
Tor traffic is a common source of card testing and abuse on Shopify. Here is how to block Tor exit nodes on Shopify, why it is safe to do, and how it differs from blocking VPNs.
On this page
TL;DR: Shopify cannot block Tor on its own. Tor exit nodes are a small share of real shopping traffic but a large share of card testing and abuse, and unlike consumer VPNs, almost nobody browses a normal store over Tor by accident. That makes Tor one of the few networks you can safely block with a blanket rule. Cordon treats Tor as high-risk by default and blocks it before the page renders, while still verifying and allowing Googlebot.
Tor is the anonymity network built to make a visitor untraceable. Some people use it for legitimate privacy. On an ecommerce store, the traffic that arrives over Tor skews heavily toward fraud, because it is the strongest way to hide who and where you are. This guide explains why Tor shows up in your logs, why it is safe to block, and how to do it on Shopify in 2026.
Why Tor traffic hits your store
You did not do anything to attract it. Tor traffic finds stores because:
- Card testing wants maximum anonymity. A fraudster testing stolen card numbers wants zero traceability, and Tor provides more of it than a VPN. When card testing runs over Tor, each attempt can come from a different exit node.
- Banned users come back invisible. Someone you blocked for refund abuse or chargebacks can return over Tor with no way to tie them to the old identity.
- Scrapers and probes hide origin. Automated tools that probe your endpoints or scrape your catalog sometimes route through Tor to avoid a simple IP block.
The common thread: people use Tor on a store when they specifically do not want you to know who they are. On a storefront selling physical goods, that is rarely a good customer.
Why Tor is safe to block (when a VPN is not)
This is the key point that separates Tor from VPN blocking. Blocking every VPN is risky because millions of ordinary customers use consumer VPNs and iCloud Private Relay. Tor is different in two ways:
- The exit nodes are published. Tor's exit node list is public and updated continuously, so a good blocker knows with high confidence when a request comes from Tor. There is very little guesswork and almost no false positives.
- Almost nobody shops over Tor by accident. Tor is slow and deliberate. People do not casually browse a boot store over Tor the way they leave a VPN running. The real-customer cost of blocking it is close to zero for most stores.
That combination, high confidence plus low collateral damage, is why Tor is one of the few networks you can block with a blanket rule and not worry about it. For VPNs you want a risk threshold; for Tor, an outright block is usually the right call.
What Shopify does about Tor (nothing)
Shopify has no Tor setting. It does not evaluate whether a visitor arrived over Tor, a VPN, or a plain home connection. Shopify fraud analysis may raise the risk score on an order that a Tor visitor eventually places, but that happens after the order exists, once the authorization has already hit your processor. Nothing on the platform stops the Tor visit from reaching your storefront and checkout. To block it before that point you need an app that recognizes Tor exit nodes in real time.
How to block Tor on Shopify with Cordon
Tor blocking is part of the same anonymized-traffic detection as VPN and proxy blocking, so if you already block one, adding Tor is a toggle.
- Install Cordon from the Shopify App Store and enable the app embed in your theme. It is a theme app extension, so no script tags and no theme code edits.
- Upgrade to Growth or above if needed. Tor, VPN, and proxy detection starts on Growth at $19 per month, with a 7-day free trial.
- Enable proxy and Tor blocking, or apply the Anti-scraper preset, which switches on the anonymized-traffic signals including Tor.
- Customize the block screen so a blocked visitor sees your message rather than a raw error.
- Allowlist any exceptions. This is rare for Tor, but if you have a specific reason to let a known address through, allowlist entries win over every rule.
- Check the live visitor log. Blocked Tor visits show up with the reason, so you can confirm the rule is doing what you expect. IPs are SHA-256 hashed with a daily-rotating salt.
Will this affect SEO or Googlebot?
No. Cordon verifies crawlers against their real networks before any Tor rule runs, so Googlebot, Bingbot, and the crawlers that feed AI search are always allowed. Google does not crawl over Tor, so blocking Tor and staying fully indexable are not in tension. If you want the detail on how crawler verification protects rankings, see do bot blockers hurt SEO?
Tor is one layer, not the whole fence
Blocking Tor closes the most anonymous route into your store, but a determined fraudster who finds Tor blocked will try a VPN or a residential proxy next. That is why Tor blocking sits alongside VPN and proxy detection, country rules, and bot detection in one policy rather than being treated as a complete solution on its own. The feature list shows how the signals combine.
Frequently asked questions
Is it safe to block all Tor traffic on a store?
For most stores, yes. Tor is a tiny fraction of real shopping traffic and a large fraction of card testing and abuse. Unlike a VPN, almost nobody browses a normal storefront over Tor by accident, and the exit-node list is published, so false positives are rare. Blocking it outright rarely costs a real sale, which is why Tor is one of the few networks safe to block with a blanket rule.
How is blocking Tor different from blocking a VPN?
Tor exit nodes are published and identifiable, so they can be blocked with high confidence and little collateral damage. Consumer VPNs are used by plenty of ordinary customers, so blocking them needs a risk threshold to avoid losing real shoppers. That is why Cordon treats Tor as high-risk by default while scoring VPN traffic more carefully.
Can I block Tor without blocking Googlebot?
Yes. Cordon verifies crawlers against their real networks before any Tor or proxy rule runs, so Googlebot, Bingbot, and other verified crawlers are always allowed. Google does not crawl over Tor, so there is no conflict between blocking Tor and staying fully indexable.
Does Shopify block Tor by default?
No. Shopify has no setting that detects or blocks Tor exit nodes. Shopify fraud analysis may flag a resulting order after it is placed, but nothing on the platform stops a Tor visit from reaching your storefront or checkout in the first place.
Which Cordon plan includes Tor blocking?
Tor detection is included alongside VPN and proxy blocking on the Growth plan at $19 per month for 100k visitors, and on every plan above it. Every paid plan has a 7-day free trial.
Wrapping up
Tor is the clearest case in traffic filtering: high-confidence detection, almost no real customers to lose, and a heavy fraud skew. Shopify cannot block it, so the fix is an app that recognizes Tor exit nodes and decides before the page renders. Try Cordon on the Shopify App Store. Tor, VPN, and proxy blocking are on every paid plan with a 7-day free trial, and the free plan covers country and bot blocking. See the pricing page for details.