Stop Fake Account Signups and Form Spam on Shopify

TL;DR: Fake account signups and newsletter spam are not a form problem, they are a traffic problem. Nearly all of it is automated bulk running from datacenters and proxies at machine speed, carrying headless or scripted-client fingerprints. Block that traffic before it reaches the form and most of the volume disappears without adding a captcha in front of real customers. A targeted attacker on residential IPs at human pace can still slip a few through, so treat this as removing the bulk, not achieving zero.

You wake up to fifty new customer accounts overnight, all with junk email addresses, none with an order. Your contact form is full of gibberish. Your newsletter list gained hundreds of subscribers you did not earn. This post explains what is actually happening, why captcha alone does not fix it, and how blocking the traffic before it hits the form removes most of the problem.

The symptoms, and what they mean

The pattern is consistent across stores:

• A flood of new customer accounts with junk or randomized email addresses, created in bursts, none of which place an order.
• Newsletter and contact forms filling with spam submissions faster than any human types.
• Your email tool's list polluted with fake and malformed addresses that never open anything.
• Sudden spikes in account creation activity with zero matching sales.

None of this is a real audience discovering your store. It is automated software submitting your forms. The tell is the shape of the traffic: it arrives in bursts, at machine speed, from network origins no real shopper uses.

Why bots target your signup and newsletter forms

There is no single motive, but the common ones all run at scale.

Testing stolen email lists. A bot has a list of email and password pairs from some unrelated breach. It submits them to signup or login forms across thousands of sites to see which ones are valid and reused. Your form is a free validity checker.

Seeding spam. Contact and newsletter forms that echo submitted content, or that trigger a confirmation email, get abused to relay spam or to send confirmation emails to victims (your store becomes the unwitting sender).

Abusing welcome discounts. If signing up grants a first-order discount code, a bot farms codes by creating accounts in bulk, then resells or reuses them.

Some of this is broad, untargeted internet spam that sprays every form it can find. Some of it targets your store specifically, usually when you run a discount or a drop. The broad kind is easier to stop because it does not adapt to you.

What Shopify and your email tool already give you

Shopify applies some spam protection on its own forms, and it can show a captcha challenge on certain flows. Your email platform has its own filtering and sometimes double opt-in. These help, and you should have them on. Details are in Shopify's own help documentation.

They are not complete, for two honest reasons. Captcha adds friction: every real customer pays a small tax to prove they are human, and abandonment goes up. And advanced bots now solve captchas cheaply through solver services, so captcha filters the lazy bots and waves the funded ones through. Double opt-in keeps fake addresses off your active list but does nothing about the volume of junk submissions hitting your forms in the first place.

Captcha is a challenge at the form. The complementary approach is to remove the traffic before it ever reaches the form.

The traffic-level angle

Here is the useful fact: most form-spam bots share a profile.

They run from datacenters (rented cloud servers) or hide behind proxies. They hit forms at a speed no human hand can match. And they present headless or scripted-client fingerprints, because they are automation, not a real browser driven by a person. Each of those is detectable at the visit, before the form loads.

If you filter on those signals, you remove the automated bulk without asking a single real customer to solve anything. The customer never sees a challenge because they were never suspect. The bot never reaches the form because it was blocked at the door.

The detection layers applied to signups

Four layers do most of the work against form spam. Each catches a different part of the automated population.

Headless markers identify browsers that are being driven by software rather than a person. Real signup traffic comes from real browsers with a human behind them. Automation frameworks leave detectable traces.

Request velocity catches the pattern of automation itself. A person filling a signup form does it once, slowly. A farming script does it hundreds of times a minute. Velocity detection flags that independent of where the traffic originates, which matters because sophisticated bots rotate IPs to defeat per-address limits.

Datacenter ASN blocks cover entire hosting providers with one rule. A visitor arriving from a cloud provider's address range is not a shopper, it is a server. Blocking by ASN removes the whole range at once. The ASN explainer covers how this works.

VPN and proxy detection catches abusers who route through anonymizing networks precisely to hide and to rotate. Applied with a risk threshold, it blocks high-risk proxy exits while letting low-risk privacy services through.

Cordon applies all four before the page renders, decides in under 50 milliseconds, and fails open if the detection service is ever unavailable, so a hiccup never blocks a real signup. Verified search engines like Google and Bing are always allowed and cannot be blocked, verification being network-level via reverse DNS, so this never touches indexing.

The deliverability cost is the expensive part

Fake signups are not just clutter. They cost money in two ways that compound.

First, your sender reputation. When your list fills with fake, malformed, and trap addresses, your emails to them bounce or draw spam complaints. Mailbox providers watch your bounce and complaint rates. High rates lower your sender reputation, and once that drops, your legitimate emails to real customers start landing in the spam folder. You paid to build an audience and then quietly lost the ability to reach it.

Second, direct cost. Most email platforms price per contact or per subscriber. Every fake address on your list is a line item you pay for every month, sending to people who do not exist. A list padded with bot signups inflates your bill while lowering your engagement metrics, which many platforms also use to throttle your sending.

Blocking the bots at the visit protects both: fewer fake addresses enter the list, so your reputation and your bill both stay clean.

Clean up and prevent: a step-by-step

1. Audit recent signups. Look at accounts created in the last few weeks. Cluster by creation time and email pattern. Bursts of similar or randomized addresses with no orders are your bot population. Note when the spikes happened; they often line up with a promotion or drop.
2. Enable bot and headless detection. Turn on bot detection (free plan) so headless and scripted clients are stopped before the form. Cordon targets confirmed automation, not loose heuristics, so real browsers pass.
3. Turn on datacenter blocking. No real customer signs up from a cloud server. Datacenter network blocking (AWS, Alibaba, Tencent, Huawei Cloud) on the Pro plan removes that whole population. The Anti-scraper preset bundles the common hosting ranges.
4. Add VPN and proxy blocking if abuse persists. For stores hit by proxy-rotating farmers, VPN and proxy detection (Growth, $19 per month) closes the rotation trick. Use the risk threshold so privacy services like iCloud Private Relay still pass.
5. Keep verified good bots allowed. Do nothing here; Cordon allows verified search engines and good bots by default and they cannot be blocked. Your indexing and previews stay intact.
6. Watch the visitor log for a week. Cordon's live log shows country, ASN, and which rule fired for each blocked visit (IPs are SHA-256 hashed with a daily-rotating salt, so it is GDPR-safe). Confirm the blocks look like automation, not customers, and adjust with allow rules if needed. Allow rules always win over block rules.

What this will not do

Plainly: this removes the automated bulk, which for most stores is the overwhelming majority of fake signups and form spam. It does not stop a determined, targeted attacker who runs from residential IP addresses, one submission at a time, at human pace, in a real browser. That traffic looks like a customer because it is deliberately built to. For that residual, double opt-in on your email tool and manual review of suspicious accounts are the right tools.

The goal is not zero. It is cutting the flood down to a trickle you can actually manage, without putting a captcha in front of every real customer who wants to sign up.

Frequently asked questions

Why is my Shopify store getting fake account signups?

Almost all of them are bots. They harvest signup and newsletter forms to test stolen email lists, seed spam, or farm welcome discount codes. Most run from datacenters or proxies at machine speed, which is what makes them identifiable and blockable before they reach the form.

Does captcha stop form spam on Shopify?

Captcha helps against basic bots and Shopify applies some spam protection on its own forms, but it adds friction for real customers and advanced bots now solve captchas cheaply. Blocking automated traffic at the visit removes the bulk without asking every shopper to prove they are human.

How do fake signups hurt my email deliverability?

Fake accounts fill your list with junk and trap addresses. Sending to them raises bounce rates and spam complaints, which lowers your sender reputation, so your real emails start landing in spam. Many email tools also price per contact, so fake addresses cost you money directly.

Can Cordon block bot signups without blocking real customers?

Yes, for the automated bulk. It targets confirmed automation signals (headless markers, request velocity, datacenter ASNs, high-risk proxies) and always lets verified search engines and allowlisted visitors through. A determined attacker on residential IPs at human pace can still get a few through.

Which Cordon plan do I need to stop form spam?

Bot detection is on the free plan. VPN and proxy blocking starts on Growth at $19 per month, and datacenter network blocking (AWS, Alibaba, Tencent, Huawei Cloud) starts on Pro at $49 per month. Every paid plan has a 7-day free trial.

---

If your signups spike without matching orders and the accounts share a pattern (junk addresses, datacenter ASNs, bursts at machine speed), the fix is to stop that traffic before it reaches the form. Cordon on the Shopify App Store installs as a theme app extension, decides in under 50 milliseconds, and has a 7-day free trial on every paid plan. See the full feature list or the bot traffic guide for the detection detail.