Features
Every layer of the perimeter
Six defenses, one decision, under 50ms. Jump to a layer:
bot & scraper detection
Confirmed automation gets stopped. Real browsers never do.
Scrapers announce themselves in ways real shoppers cannot fake: python-requests and Scrapy user agents, headless Chrome markers left by Puppeteer and Selenium, and request patterns no human produces. Cordon checks all of them.
Detection is deliberately conservative. It blocks confirmed automation only, so an unusual but real browser (an in-app webview, an old Android phone) shops normally.
- User-agent fingerprinting for known scraping tools
- Headless browser markers (Puppeteer, Selenium, Playwright)
- Request-velocity detection: 40 product pages in 30 seconds is not a shopper
- Spoofed-crawler detection: a fake Googlebot from the wrong network gets blocked
vpn, proxy & torGrowth and up
Live detection data, not a stale IP list
Fraudsters hide behind VPNs, residential proxies, and Tor so their real location never touches your order screen. IP lists from 2018 miss modern residential proxies entirely, because those exits look like home connections.
Cordon uses live commercial detection data and a tunable fraud-score threshold, so privacy-conscious real customers (iCloud Private Relay, corporate VPNs) keep shopping while proxy fraud stops at the door.
- VPN and proxy detection refreshed continuously
- Tor exit node blocking
- iCloud Private Relay allowlisted by default
- Fraud-score threshold you control
country blocking
200+ countries, one click each
If you never ship to a region but keep eating chargebacks or scraper traffic from it, stop serving it. Pick countries from a flag picker, or apply a preset like Block China in one click.
Blocking a country never touches search engines. Googlebot crawling from the US keeps indexing your store even if you block every other visitor from a region.
- One-click flag picker for 200+ countries
- Quick presets: Block China, Anti-scraper, Strict mode
- Allowlist specific IPs inside a blocked country
- Customizable block screen with your own message
datacenter & asnPro and up
Scrapers live in datacenters. Your customers do not.
Almost no real shopper browses from a rented server, yet AWS, Alibaba, Tencent, and Huawei Cloud are where most scraping traffic originates. Cordon ships a curated blocklist of hosting networks you can enable in one click.
Need finer control? Block any individual network operator by its ASN. IPs rotate; the network they belong to does not.
- Curated datacenter list: AWS, Alibaba, Tencent, Huawei Cloud, and more
- Block any ASN with a single rule
- Verified good bots stay allowed even inside blocked networks
- ASN visible on every visitor log entry
edge blockingPlus
Blocking that cannot be bypassed by disabling JavaScript
On the Plus plan, a Cloudflare edge worker enforces your rules before a request ever reaches the storefront. The decision happens in under 10ms, globally, and works even against clients that never execute a line of JavaScript.
Paired with anti-scraping mode, persistent scrapers can be served decoy data instead of a block screen, so they never learn they were caught.
- Sub-10ms enforcement at 300+ edge locations
- Works against curl, raw HTTP clients, and headless tools
- Anti-scraping mode: serve decoys, not block screens
- Included in the Plus plan
live visitor log
See every decision, without storing anyone's IP
The visitor log shows every allow and block in real time: country, network, and the exact rule that fired. You can watch a scraper hit the wall and know precisely why.
Privacy is structural, not a checkbox. IPs are hashed with SHA-256 using a salt that rotates daily, which makes historical hashes permanently irreversible. There is nothing to leak and nothing to subpoena.
- Real-time allow and block decisions with reasons
- Country, ASN, and rule shown per event
- SHA-256 hashed IPs with a daily-rotating salt
- GDPR-safe by design, DPA available
All of it configured from one embedded Shopify admin
No script tags, no theme edits, no DNS changes. Install, pick your rules, done.
Free plan included, 7-day free trial on paid plans. Cancel anytime.