How to Block VPN on Shopify (2026 Guide)
Shopify has no built-in VPN block. Here is how to block VPN, proxy, and Tor traffic on Shopify in 2026 without blocking iPhone users on Private Relay or your real customers.
On this page
TL;DR: Shopify has no built-in VPN block. To block VPN, proxy, and Tor traffic you need an app like Cordon that queries live proxy detection data and blocks the visit before the page renders. The one thing that matters is a risk threshold: block high-risk rotating proxies and Tor, but let low-risk privacy services like iCloud Private Relay through so you do not block millions of ordinary iPhone shoppers.
"How to block VPN on Shopify" is one of the most searched questions merchants ask once fraud or abuse starts, and the honest answer is that Shopify itself cannot do it. This guide covers why merchants want it, what Shopify offers (nothing, at the visit level), the realistic options in 2026, and the one setting that separates a useful VPN block from one that drives away real customers.
Why merchants want to block VPN traffic
A VPN or proxy hides where a visitor really is. That is fine for privacy, and most VPN users are honest. The problem is the minority who use anonymized connections to do things they could not do from their real IP:
- Card testing and stolen-card checkout. A fraudster's real IP would sit in a different country than the card's billing address, so they route through a VPN to hide the mismatch. See the full pattern in Shopify VPN fraud.
- Evading a country block. If you block a country, the standard bypass is a VPN endpoint in a country you allow. VPN detection closes that side door.
- Discount and refund abuse. Discount-code farmers create dozens of accounts behind rotating IPs so per-IP limits never trigger. Banned refund abusers come back through a fresh VPN exit.
- Drop sniping. Limited releases get hit by bots checking out through pools of thousands of residential proxies, so each purchase looks like a different household.
None of this needs you to block every VPN user forever. It needs the ability to switch anonymized traffic off when it turns into a problem.
What Shopify offers natively (nothing, at the visit level)
This is short because there is not much to say. Shopify has no setting anywhere in the admin that detects a VPN, a proxy, or Tor. Shopify fraud analysis scores an order after it is placed, which is useful as a safety net but does not stop the anonymized visit from reaching checkout in the first place. Shopify Markets controls where you sell and ship, not who can browse. Nothing on the platform looks at whether an IP is anonymized.
So if your goal is "traffic hiding behind a VPN should not be able to check out," you have to add a layer. There are two realistic ways.
Your options compared
| Option | Detects residential proxies | Blocks before page load | Spares Private Relay users | Setup effort |
|---|---|---|---|---|
| Static IP blocklist / old app | No, misses them | Sometimes | No, blocks all relays | Medium |
| Live detection app (Cordon) | Yes | Yes | Yes, via risk threshold | Minutes |
| Cloudflare rules (headless only) | Partly | Yes | Manual | High |
Option 1: static IP blocklists (the legacy approach)
Most older blocking apps ship a downloaded list of known VPN and datacenter IP ranges. That worked when anonymizing meant renting a server on a fixed IP. It fails against modern residential proxies, which route through real home connections that look like normal customers on any static list. It also tends to block every relay it does recognize, including iCloud Private Relay, so you lose real iPhone customers. A stale list is worse than nothing because it gives you false confidence while missing the traffic that actually costs you money.
Option 2: a live detection app (the right answer for a themed store)
Cordon queries live commercial proxy detection data per visitor and caches the decision, so it catches residential proxies that static lists miss and makes the block decision at the edge before your page renders. The decision runs in under 50 milliseconds, and it is installed as a theme app extension, so there are no script tags and no Lighthouse hit. This is the correct primary mechanism for any store on a standard Shopify theme.
Option 3: Cloudflare rules (headless stores only)
If you run a headless storefront (Hydrogen or a custom front end) behind Cloudflare, you can write proxy-blocking rules at the CDN. This is powerful but out of reach for the vast majority of merchants, who do not control the proxy in front of their store. Even headless merchants usually still want the app layer for the visitor log, the risk threshold, and the block screen.
The setting that matters most: block risk, not relays
Here is the mistake that gives VPN blocking a bad name. iCloud Private Relay is switched on by default for a large share of iPhone users. It is technically a relay. A blocker that blocks "all relays" blocks those shoppers, and you never find out why your mobile conversion rate dropped.
Cordon blocks on a fraud score, not on the mere fact that an IP is a relay. Low-risk privacy services (Private Relay, reputable consumer VPNs used by ordinary people) score below the threshold and pass through. High-risk exits, rotating residential proxies, and Tor score above it and get the block screen. That is the whole difference between blocking anonymized fraud and blocking everyone who cares about privacy.
Block VPN traffic with Cordon in under 3 minutes
- Install Cordon from the Shopify App Store and enable the app embed in your theme. No code edits, no script tags.
- Upgrade to Growth or above if you are on the free plan. VPN, proxy, and Tor detection starts on Growth at $19 per month, with a 7-day free trial.
- Toggle on VPN and proxy blocking, or start from the Anti-scraper preset, which switches on the anonymized-traffic signals for you.
- Leave the risk threshold at the default unless you have a specific reason to change it. The default is tuned to pass iCloud Private Relay and block high-risk proxies.
- Allowlist known customers who legitimately shop through a VPN (a wholesale buyer on a corporate network, for example). Allowlist entries win over every rule.
- Watch the live visitor log for a day or two to see what got caught and why. IPs are SHA-256 hashed with a daily-rotating salt, so the log stays GDPR-safe.
A pattern worth copying: leave VPN blocking off during normal trading and switch it on the moment a fraud or discount-abuse wave starts. It is one toggle, so you can react in seconds.
Will this block Google?
No. Crawler verification runs before any VPN or proxy rule. A request claiming to be Googlebot is checked against Google's real network, and verified crawlers are always allowed, unconditionally. There is no VPN setting that can touch them. A fake Googlebot spoofing the user agent from a proxy network fails verification and gets blocked, which is exactly what you want. We covered the mechanics in do bot blockers hurt SEO?
Frequently asked questions
Can Shopify block VPN users natively?
No. Shopify has no setting that detects or blocks VPN, proxy, or Tor traffic. It does not evaluate whether a visitor's IP is anonymized at all. Blocking VPN traffic requires an app that queries live proxy detection data, or your own edge infrastructure if you run a headless store.
Will blocking VPNs also block iPhone customers on Private Relay?
Not if the blocker scores risk instead of blocking every relay. Cordon applies a fraud-score threshold, so low-risk privacy services like iCloud Private Relay pass through while high-risk rotating proxies and Tor exits are blocked. Blanket blocking of every relay is the legacy approach, and it does block iPhone shoppers, which is why VPN blocking got a bad reputation.
Should I leave VPN blocking on all the time?
Most merchants do not. Legitimate customers use VPNs too, so a common pattern is to leave it off during normal trading, switch it on when a fraud or abuse wave starts, and switch it off once the attack burns out. In Cordon it is a per-store toggle, so you can react in seconds.
Why can't a static IP blocklist catch VPNs?
Because residential proxies route traffic through real home internet connections that look like ordinary customers on any static list. A downloaded list of known VPN ranges misses them completely and may only recognize an exit for a few hours before the pool rotates it. Detection needs live commercial data that scores how an IP is behaving right now.
Which Cordon plan includes VPN blocking?
VPN, proxy, and Tor detection is included on the Growth plan at $19 per month for 100k visitors, and on every plan above it. The free plan covers country and bot blocking. Every paid plan has a 7-day free trial, so you can enable VPN blocking during a fraud wave and evaluate it on your own traffic.
Wrapping up
Shopify cannot see a VPN, so it cannot block one. The fix is a layer that queries live detection data, decides before the page renders, and, most importantly, blocks on risk so your iPhone customers on Private Relay keep shopping. If that is what you need, try Cordon on the Shopify App Store. The free plan covers country and bot blocking, and VPN, proxy, and Tor detection is on every paid plan with a 7-day free trial. Full details are on the pricing page.