How to Stop Competitors Scraping Your Shopify Prices
Competitors run bots that poll your product pages and /products.json to undercut you. Here is how price scraping works and the detection that slows it down.
On this page
TL;DR: Competitors and price-intelligence vendors run bots that poll your product pages and
/products.jsonon a fixed schedule to undercut you automatically. Robots.txt does nothing and hiding prices kills conversion. Request-velocity detection, datacenter blocking, and ASN blocking catch the automated pollers and slow a determined competitor from minutes to days, which is often enough to protect a promotion. Cordon runs all three.
If your promotions get matched within minutes of going live, or a rival is always priced one euro under you across your whole catalog, you are probably being scraped. This is not catalog theft (copying your images and descriptions wholesale). This is narrower and more mechanical: automated monitoring of your prices, on a timer, so a repricing engine can react. This post explains how it works, how to spot it in your own logs, and what actually slows it down.
How competitor price scraping works
Price monitoring is a small, well-defined job, which is what makes it so easy to automate.
A bot polls your prices on a schedule. Either the competitor or a price-intelligence vendor they pay runs a crawler that requests your product pages and, more often, your /products.json endpoint. That endpoint returns a clean JSON feed of every product with its variants and current prices, no login required, so the bot does not even have to parse your HTML. The crawl runs on a fixed interval: hourly, every fifteen minutes, sometimes every few minutes on high-value SKUs.
A repricing tool consumes the feed. The scraped prices flow into a repricing engine that compares them against the competitor's own catalog and sets their price just below yours. The whole loop is automated. No human watches your store. A price you set at 09:00 can be undercut by 09:05.
The infrastructure is predictable. These crawlers run on servers, not phones. That means datacenter networks: AWS, Alibaba Cloud, Tencent, Huawei Cloud, and a long tail of VPS providers. Price-intelligence vendors often run from their own known network ranges. Real shoppers never browse from an AWS IP.
Why it hurts
Price scraping is not a vanity problem. It attacks margin directly.
- A race to the bottom. If a rival auto-matches you one cent under, every price cut you make is instantly matched. You train each other downward and the only winner is the customer, at the expense of both margins.
- Your pricing strategy becomes public. Bundle logic, psychological pricing, regional differences, and planned markdowns are all visible to anyone polling your feed. Your strategy is only as private as your
/products.json. - Promotions get neutralised before they work. A flash sale is supposed to pull demand toward you for a window. If a competitor's bot sees the new price within minutes and matches it, the promotion never gets its head start. The discount cost you margin and bought you nothing.
How to catch price scrapers in your visitor log
A live visitor log is the fastest way to confirm you are being scraped rather than guessing. Cordon's log shows country, ASN, and the rule that fired for every request, with IPs hashed for GDPR. Here is what to look for, in order:
- Sort by network (ASN) and count hits. One ASN generating a large share of your traffic, especially a hosting or cloud ASN, is the strongest single signal. Shoppers arrive from hundreds of residential and mobile networks. A scraper arrives from one datacenter.
- Check the interval. Line up timestamps from the same network against the same product URLs. A fixed cadence (every 15 minutes, every hour, on the dot) is a machine. Humans do not browse on a metronome.
- Look at the requested paths. Repeated hits to
/products.json,/collections/*/products.json, or the same handful of high-value product URLs, with nothing else (no cart, no checkout, no images loaded), is monitoring, not shopping. - Read the session duration. Near-zero dwell time means the client grabbed the data and left. A real shopper reads, scrolls, and lingers.
- Match the ASN to a known vendor or cloud. If the ASN belongs to a price-intelligence company or a cloud provider you have no business relationship with, you have found your scraper.
See our guide on spotting and stopping bot traffic for the wider version of this workflow, and what an ASN block is for why the network number is the right unit to act on.
What does not work
Two popular ideas fail, for reasons worth stating plainly.
Robots.txt. It is a text file that asks crawlers to stay out of certain paths. Googlebot honors it. A commercial price scraper reads it, at most, as a map of what you consider valuable. There is no enforcement. The server serves the price whether the client obeyed the file or not.
Hiding prices behind a login. This does stop the anonymous scraper, and it also stops every real shopper who has not created an account, which is most of them. You would trade a margin problem for a conversion catastrophe. Price gating is a B2B wholesale pattern, not a defense for a consumer store.
What actually works
The goal is not a perfect wall. It is to make monitoring expensive and slow enough that your pricing decisions get a head start. Three layers do that.
| Layer | What it catches | What it misses |
|---|---|---|
| Request-velocity detection | Fixed-interval polling and any client loading pages far faster than a human | A scraper deliberately slowed to a human pace |
| Datacenter network blocking | Bots running on AWS, Alibaba, Tencent, Huawei Cloud, and other hosting networks | Bots routed through residential proxies |
| ASN blocking (specific vendor networks) | Known price-intelligence vendor networks, blocked whole with one rule | Vendors who rotate to networks you have not blocked yet |
Request-velocity detection watches how fast a client pulls pages. A monitoring bot on a fifteen-minute timer, or one that grabs your whole catalog in seconds, does not move like a person. This layer catches the polling pattern regardless of the user agent it claims.
Datacenter and ASN blocking removes the servers these tools run on. Most scraping originates from cloud IP ranges, and Cordon's datacenter blocking (Pro plan and up) targets exactly those networks: AWS, Alibaba, Tencent, Huawei Cloud, and similar. If you identify a specific price-intelligence vendor by ASN in your log, you can block that whole ASN with a single rule. Real shoppers browse from residential and mobile networks, so the collateral damage is close to zero.
Cordon ships an Anti-scraper preset that turns these layers on together, and every decision is made in under 50 milliseconds at the edge, so your storefront speed is untouched. Verified search engines like Google and Bing are always allowed and cannot be blocked, so this does not touch your SEO. If that worries you, we wrote up whether bot blockers hurt SEO separately.
The honest limit
A competitor who genuinely wants your prices can still get them. They can route through residential proxy networks so their requests look like home connections, and they can throttle their bot to a slow, human-like pace so velocity detection does not trip. That defeats the network and speed layers.
But it costs them. Residential proxy bandwidth is not free, and slowing the bot from every-few-minutes to once-a-day is the whole point. A promotion that used to get matched in five minutes now gets a full day to run before the rival even sees it. For most stores, buying your pricing decisions a head start of hours or days is the actual win, not an impossible perfect block. This is the same trade-off we describe in stopping scrapers stealing your catalog: raise the cost, slow the attacker, protect the window that matters.
Frequently asked questions
How do competitors scrape my Shopify prices?
Competitors or their price-intelligence vendors run bots that poll your product pages and the /products.json endpoint on a fixed schedule, sometimes every few minutes. A repricing tool then reads that feed and sets their price just below yours automatically.
Can I stop price scraping without hiding my prices?
Yes. Hiding prices behind a login kills conversion for real shoppers, so that is the wrong tool. Request-velocity detection, datacenter blocking, and ASN blocking stop the automated pollers while leaving your public prices visible to actual customers and search engines.
How do I tell if a bot is scraping my prices?
Look in your visitor log for the same network hitting the same product URLs on a fixed interval, traffic from hosting or datacenter ASNs instead of home networks, near-zero session duration, and repeated hits to JSON endpoints like /products.json.
Does robots.txt stop price scrapers?
No. Robots.txt is a polite request that commercial scrapers ignore. Stopping a price-monitoring bot requires detecting and refusing the requests, not asking it nicely to stay away.
Can a determined competitor still watch my prices?
Yes, if they pay for residential proxies and browse at a human pace. That costs them real money and slows them from minutes to days, which is usually enough for a flash promotion to run before it gets matched.
If competitors are matching your prices faster than your promotions can work, Cordon gives you the visitor log to prove it and the velocity, datacenter, and ASN blocking to slow it down. It installs as a theme app extension with no script tags, makes its decision in under 50 milliseconds, and starts on a free plan. See pricing for where datacenter blocking begins.