# Cordon > Cordon is a Shopify app that blocks bots, scrapers, VPN and proxy fraud, datacenter networks, and unwanted countries before they reach your store. Sub-50ms detection, fails open, never blocks Google. Cordon is a paid Shopify app, live on the Shopify App Store: https://apps.shopify.com/cordon Key facts: detection decisions in under 50ms; fails open (an outage never blocks real customers); verified search engines and good bots (Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot, Ahrefs) are always allowed and cannot be blocked; visitor IPs are stored only as SHA-256 hashes with a daily-rotating salt (GDPR-safe); built as a theme app extension with no script tags. ## Main pages - [Home](https://usecordon.com): what Cordon blocks and how - [Features](https://usecordon.com/features): country blocking, VPN/proxy/Tor detection, bot and scraper detection, datacenter and ASN blocks, live visitor log - [Pricing](https://usecordon.com/pricing): Free plan; Starter $9/mo; Growth $19/mo (adds VPN/proxy/Tor); Pro $49/mo (adds datacenter and scraper detection); Plus $99/mo (365-day logs, priority support); 7-day free trial on paid plans - [About](https://usecordon.com/about): who builds Cordon and the principles behind it - [Support](https://usecordon.com/support): support@usecordon.com - [Privacy](https://usecordon.com/privacy) and [DPA/GDPR](https://usecordon.com/dpa) ## Use cases - [Stop content scraping](https://usecordon.com/use-cases/stop-content-scraping): Detect and block the scrapers copying your Shopify product data, prices, and photos: headless browsers, python scripts, and datacenter crawl farms. - [Block VPN checkout fraud](https://usecordon.com/use-cases/block-vpn-checkout-fraud): Block the VPNs, residential proxies, and Tor exits that card testers and serial refunders hide behind, without blocking privacy-conscious real customers. - [Block traffic by country](https://usecordon.com/use-cases/block-traffic-by-country): Block visitors from any of 200+ countries on Shopify with a one-click flag picker, without touching your theme and without ever blocking Google. ## Comparisons - [Cordon vs Blockify](https://usecordon.com/compare/cordon-vs-blockify): An honest comparison of Cordon and Blockify for Shopify: detection data quality, where blocking happens, performance cost, SEO safety, and GDPR handling. - [Cordon vs Blocky](https://usecordon.com/compare/cordon-vs-blocky): Cordon vs Blocky for Shopify merchants: how the two apps compare on proxy detection quality, blocking architecture, SEO safety, and privacy. - [Cordon vs Securify](https://usecordon.com/compare/cordon-vs-securify): Cordon vs Securify for Shopify: blocking architecture, scraper defense, right-click protection theater vs real detection, and GDPR-safe logging compared. - [Best Shopify bot-blocker apps](https://usecordon.com/compare/best-shopify-bot-blocker-apps): an evaluation framework for the whole category ## Blog - [Dozens of Tiny Failed Orders? You Are Being Card Tested](https://usecordon.com/blog/card-testing-attack-shopify): A run of small declined orders overnight is not a glitch. It is someone checking stolen cards against your checkout. Here is how to confirm it, stop it today, and keep your payment processor happy. - [Is ChatGPT Scraping My Shopify Store? How to Tell, and What to Do](https://usecordon.com/blog/is-chatgpt-scraping-my-shopify-store): AI crawlers and shopping agents are visiting Shopify stores in growing numbers. Here is how to tell which ones are real, what they take, and why blocking all of them is usually the wrong call. - [Someone Copied Your Product Listings. Here Is How They Did It](https://usecordon.com/blog/someone-copied-my-shopify-product-listings): Your descriptions and photos have turned up on a marketplace or a lookalike store. Here is how they were collected, what you can realistically stop, and what to do about the copy that already exists. - [Can You Disable products.json on Shopify? The Honest Answer](https://usecordon.com/blog/shopify-products-json-disable): Every Shopify store publishes its full product list at /products.json with no password. Here is exactly what it exposes, why you cannot switch it off, and what actually reduces the damage. - [Shopify Traffic But No Sales? Check Who Is Actually Visiting](https://usecordon.com/blog/shopify-traffic-but-no-sales): Sessions are up and orders are not. Before you rebuild the product page again, work out how much of that traffic is people. Here is how to check, and the boring causes to rule out first. - [65% of One Store's Traffic Was a Single Scraper](https://usecordon.com/blog/shopify-scraper-traffic-case-study): A Shopify store took 33,700 visits in 22 hours. 21,840 came from one datacenter network. Here is how to find the same pattern in your own logs. - [Does Shopify Block Bots and Countries by Default? (2026)](https://usecordon.com/blog/does-shopify-block-bots-and-countries): A clear answer on what Shopify blocks natively and what it does not. Shopify handles DDoS and platform security, but does not block bots, scrapers, VPNs, or countries at the visitor level. - [Geo Restrict Your Shopify Store to Specific Countries](https://usecordon.com/blog/geo-restrict-shopify-store-to-countries): How to allowlist countries on Shopify so only your target markets can browse. Everyone else is blocked, and Google stays fully allowed for SEO. - [How to Stop Bot Clicks and Fake Traffic on Your Shopify Ads](https://usecordon.com/blog/stop-bot-clicks-shopify-ads): Bots and click farms inflate your Shopify ad clicks and drain your Meta and Google budget. Here is how to spot invalid traffic and block it before it burns your ad spend. - [How to Block Tor Traffic on Shopify (2026)](https://usecordon.com/blog/how-to-block-tor-traffic-shopify): Tor traffic is a common source of card testing and abuse on Shopify. Here is how to block Tor exit nodes on Shopify, why it is safe to do, and how it differs from blocking VPNs. - [Shopify Store Security: A 2026 Checklist](https://usecordon.com/blog/shopify-store-security-checklist): Shopify secures the platform, checkout, and PCI. You own your accounts, apps, staff, and who you let in. A practical 2026 security checklist for merchants. - [Stop Fake Account Signups and Form Spam on Shopify](https://usecordon.com/blog/stop-fake-account-signups-form-spam-shopify): Fake customer accounts and newsletter spam are automated bulk traffic. Block bots, proxies, and datacenter IPs at the visit to remove most of it without friction. - [Disable Right-Click and Protect Images on Shopify](https://usecordon.com/blog/disable-right-click-protect-images-shopify): How to disable right-click on Shopify, why it is mostly theater against scrapers, and what actually stops competitors cloning your images and catalog at scale. - [How to Block VPN on Shopify (2026 Guide)](https://usecordon.com/blog/how-to-block-vpn-on-shopify): Shopify has no built-in VPN block. Here is how to block VPN, proxy, and Tor traffic on Shopify in 2026 without blocking iPhone users on Private Relay or your real customers. - [How to Stop Competitors Scraping Your Shopify Prices](https://usecordon.com/blog/stop-competitors-scraping-shopify-prices): Competitors run bots that poll your product pages and /products.json to undercut you. Here is how price scraping works and the detection that slows it down. - [How to Block Checkout Bots on Shopify Drops](https://usecordon.com/blog/block-checkout-bots-shopify-drops): Checkout bots empty Shopify drops in seconds. What Shopify covers natively, how bots actually work, and how to block datacenter ASNs and headless browsers. - [Reduce Chargebacks on Shopify by Blocking Fraud Traffic](https://usecordon.com/blog/reduce-chargebacks-shopify-block-fraud-traffic): Most chargeback tools act after the order exists. Blocking fraud traffic at the visit stops card testing before fees, disputes, and rate damage begin. - [Should You Block AI Crawlers on Your Shopify Store?](https://usecordon.com/blog/should-you-block-ai-crawlers-shopify): For merchants, blocking GPTBot or ClaudeBot removes you from AI shopping answers. Allow verified AI crawlers, block the scrapers that impersonate them. - [How to Block an IP Address on Shopify (2026 Guide)](https://usecordon.com/blog/how-to-block-an-ip-address-on-shopify): Shopify has no built-in visitor-level IP blocking. What Shopify can do natively, why theme hacks fail, and how to block IPs, ranges, and networks properly. - [Shopify Bot Traffic: How to Spot It and Stop It](https://usecordon.com/blog/shopify-bot-traffic-how-to-spot-and-stop): Bot traffic on Shopify looks like a spike with zero extra sales and a collapsing conversion rate. How to recognize it in your reports and stop the bad bots. - [How to Stop Discount Code Abuse on Shopify](https://usecordon.com/blog/stop-discount-code-abuse-shopify): Discount code abuse on Shopify: how one buyer farms welcome codes behind rotating proxies, why email limits fail, and how to block the anonymizing layer. - [What Is an ASN? Blocking One Stops Thousands of Bots](https://usecordon.com/blog/what-is-an-asn-block-bad-bots): An ASN identifies a network operator like AWS or Comcast. Bot IPs rotate constantly but the ASN stays stable, so one ASN block can stop a scraper farm. - [Blockify vs Cordon vs Blocky: Shopify Blockers Compared](https://usecordon.com/blog/blockify-vs-cordon-vs-blocky): A fair comparison of Blockify, Cordon, and Blocky across detection quality, blocking layer, performance, SEO safety, GDPR handling, and pricing. - [Do Bot Blockers Hurt SEO? Block Bots, Not Google](https://usecordon.com/blog/do-bot-blockers-hurt-seo): A bot blocker only hurts SEO if it blocks verified crawlers. Learn how Googlebot verification works and how to block scrapers without losing rankings. - [Shopify VPN Fraud: How to Stop Proxy Checkout Fraud](https://usecordon.com/blog/vpn-proxy-checkout-fraud-shopify): VPN and proxy checkout fraud hides stolen cards behind rotating IPs. Learn how to read the signals and block VPN traffic on Shopify before orders happen. - [Stop Scrapers Stealing Your Shopify Product Catalog](https://usecordon.com/blog/stop-scrapers-stealing-shopify-product-catalog): Every Shopify store exposes its full catalog by default. Here is how scrapers take it, why robots.txt fails, and the detection layers that actually stop them. - [How to Block a Country on Shopify (2026 Guide)](https://usecordon.com/blog/how-to-block-a-country-on-shopify): Shopify has no built-in visitor-level country block. Here are three ways to block a country on Shopify, from liquid hacks to purpose-built blocking apps. ## Full content - [llms-full.txt](https://usecordon.com/llms-full.txt): full text of all key pages in Markdown --- # Pricing (full detail) ## Free: $0/month (Try it out) Basic country and bot blocking to see Cordon work on your store. - Country blocking - Basic bot blocking - Customizable block screen - Live visitor log ## Starter: $9/month (10,000 visitors/mo) Geo and bot detection for stores getting started. - Everything in Free - 200+ country rules with flag picker - IP and IP-range rules - Allowlist and quick presets ## Growth: $19/month (100,000 visitors/mo) Adds live VPN, proxy, and Tor detection. - Everything in Starter - VPN and proxy detection (live data) - Tor exit node blocking - Fraud-score threshold tuning ## Pro: $49/month (5,000,000 visitors/mo) Adds datacenter network and scraper detection. - Everything in Growth - Datacenter and hosting ASN blocks - Request-velocity scraper detection - Spoofed-crawler detection ## Plus: $99/month (5,000,000+ visitors/mo) For the biggest stores: longest retention and priority support. - Everything in Pro - 365-day log retention - 10,000 rules - Anti-scraping mode (in development) - Priority support Every paid plan has a 7-day free trial. Billing runs through Shopify and can be cancelled anytime. Enterprise plans above 5M visitors/month are available via support@usecordon.com. --- # Use cases ## Stop scrapers from cloning your Shopify catalog Every Shopify store publishes its catalog in machine-readable form, and scrapers know it. Competitors clone your product descriptions and photography, price trackers undercut you within hours of a change, and dropshipping copycats relist your bestsellers on their own domains. The tooling is commodity: python-requests, Scrapy, Puppeteer, Selenium. Most of it runs from rented servers on AWS, Alibaba, or Tencent, or hides behind rotating residential proxies. robots.txt is a polite request they ignore. - **Fingerprint the tools**: Scraping libraries and headless browsers leave markers real shoppers cannot fake. Cordon recognizes python-requests, Scrapy, Puppeteer, and Selenium signatures on the first request. - **Watch the velocity**: A human does not load 40 product pages in 30 seconds. Request-velocity detection catches scrapers that fake a clean browser but cannot fake human pacing. - **Block the networks they rent**: Almost no real customer shops from a datacenter. One click blocks AWS, Alibaba, Tencent, Huawei Cloud, and other hosting ASNs where crawl farms live. - **Catch the fake Googlebots**: Scrapers impersonate search engines to walk through allowlists. Cordon verifies crawlers against their real networks: a Googlebot UA from an Azure box gets blocked, the real Googlebot never does. Plans: Basic bot blocking works on every plan. Velocity-based scraper detection and datacenter blocks are on Pro ($49/mo). ### FAQ **Will scraper blocking affect Google indexing my products?** No. Verified search engines are always allowed and cannot be blocked. Verification checks the crawler's actual network, so only impostors get caught. **Can scrapers just switch to residential proxies?** Some try. Residential proxies defeat datacenter blocks but not velocity detection or headless markers, and Cordon's live proxy data flags known residential proxy exits too. Layered detection is the point: each evasion move costs the scraper more. **Do scrapers give up once they are blocked?** Usually, yes. Scraping runs cost money, and a run that keeps returning block screens instead of product data is worthless. Once the operator notices the results dried up, the traffic typically tapers off on its own. **How fast will I see results?** The live visitor log shows blocks in real time. Most stores with a scraping problem see the first catches within hours of enabling the Anti-scraper preset. --- ## Stop VPN and proxy fraud before checkout Card testers, serial refund abusers, and discount-code farmers do not shop from their home IP. They rotate through VPNs, residential proxies, and Tor so every attempt looks like a new visitor from a new country, and your fraud pattern never becomes visible. Shopify's built-in fraud analysis flags suspicious orders after they exist. By then you are already managing chargebacks, restocking fees, and a payment processor watching your dispute rate. - **Live detection, not 2018 lists**: Residential proxies look like home connections to static IP lists. Cordon scores every visit against live commercial VPN, proxy, and Tor data that updates continuously. - **A threshold you control**: Not every VPN user is a fraudster. A tunable fraud-score threshold blocks high-risk anonymizers while ordinary privacy users keep shopping. - **Private Relay stays welcome**: iCloud Private Relay users are real Apple customers, not threats. Cordon allowlists Private Relay by default so iPhone shoppers are never caught in the net. - **Prevention, not cleanup**: Blocking happens at the visit, before a cart or an order exists. No chargeback to fight, no order to cancel, no processor risk-score damage. Plans: VPN, proxy, and Tor detection is on Growth ($19/mo) and up. Country and IP rules, which catch cruder fraud, work on every plan including Free. ### FAQ **Will I lose sales from real customers who use VPNs?** The fraud-score threshold exists for exactly this. Commercial VPN exits with clean reputations score lower than residential proxies and Tor, and you choose where to draw the line. iCloud Private Relay is allowlisted by default. **Why block at the visit instead of reviewing orders?** A blocked visit costs you nothing. A fraudulent order costs the chargeback fee, the inventory, staff time, and your standing with the payment processor, even when you win the dispute. **Does this replace Shopify's fraud analysis?** No, it complements it. Shopify scores orders that happen; Cordon prevents the riskiest traffic from placing orders at all. Together they cover before and after. **Can I see what was blocked and why?** Yes. The live visitor log shows every decision with the country, network, and rule that fired, with IPs hashed so the log stays GDPR-safe. --- ## Block traffic from any country, in one click You do not ship to a region, but it keeps sending you chargebacks, scraper traffic, or thousands of sessions that will never convert and only pollute your analytics. Shopify Markets controls where you sell, but it does not stop anyone from visiting. The usual workarounds are worse than the problem: theme-level Liquid hacks that break on the next update, or snippets matching a hardcoded IP list that any rotating proxy walks straight through. - **200+ countries, flag picker**: Tick the countries you want blocked. The rule is live in seconds, and matching visitors get your block screen instead of a store they can browse. - **Presets for the common cases**: Block China, Anti-scraper, and Strict mode apply sensible rule bundles in one click. Adjust anything afterwards. - **Exceptions that work**: Allowlist a specific customer, partner, or office IP inside a blocked country. Allow rules always win over block rules. - **Your block screen, your words**: Blocked visitors see a customizable page in your voice, not a generic error. Tell them why, or say nothing. Plans: Country blocking works on every plan, including Free. Higher tiers add VPN detection to catch visitors evading your country block through a proxy. ### FAQ **Will blocking a country hurt my Google rankings?** No. Verified search engine crawlers are always allowed regardless of your country rules. Googlebot crawls mostly from the US, but even non-US crawlers pass because verification is by network, not location. **Can visitors bypass a country block with a VPN?** With a plain country blocker, yes. That is why Cordon pairs country rules with VPN and proxy detection on Growth and up: the evasion route gets blocked too. **Does Shopify have built-in country blocking?** No. Shopify Markets controls where you sell and ship, but any visitor from anywhere can still browse your store. Visitor-level blocking requires an app. **What do blocked visitors see?** A block screen you can customize with your own message and styling. You decide how much to explain. --- # Comparisons ## Cordon vs Blockify Blockify is one of the most established country and IP blocking apps on the Shopify App Store, with a large install base and years of history. If you are evaluating it, you are probably also weighing Cordon. This page compares the two honestly, criterion by criterion. The short version: both apps block countries and IPs competently. The differences show up in how each detects disguised traffic (VPNs, residential proxies, scrapers), where the blocking decision runs, and how visitor data is stored. Descriptions of Blockify below are based on its public App Store listing as of July 2026. | Criterion | Cordon | Blockify | | --- | --- | --- | | VPN / proxy detection data | Live commercial detection data refreshed continuously; catches residential proxies and Tor exits, with a tunable fraud-score threshold | IP-list based approach typical of established blockers; public listing does not describe live per-request commercial proxy scoring | | How the block is enforced | Detection decision in under 50ms through a theme app extension, with no injected script tags. The block screen re-asserts itself if it is tampered with, so a blocked visitor cannot browse or check out, and it fails open if the service is ever unreachable | Blocking applied in the storefront after the page starts loading, the common pattern for this app category | | Storefront performance | Tiny storefront footprint, no injected script tags, built to keep Lighthouse scores intact | Adds storefront JavaScript; the weight and Lighthouse impact depend on configuration | | SEO safety | Verified search engines and good bots (Google, Bing, GPTBot, ClaudeBot, PerplexityBot, Ahrefs) are always allowed and cannot be blocked; spoofed crawlers from the wrong network are caught | Public listing does not describe network-verified crawler allowlisting; user-agent based allowlists can be spoofed either way | | Privacy / GDPR | IPs are SHA-256 hashed with a daily-rotating salt; raw IPs never sit in the visitor log; DPA available | Visitor logs in this category typically store raw or lightly masked IP addresses; check the vendor's DPA before relying on it | | Scraper-specific detection | Headless markers, request-velocity detection, spoofed-crawler checks, and datacenter ASN blocks | Focused on country, IP, and VPN blocking; scraper-specific behavioral detection is not the product's core pitch | | Failure behavior | Fails open: if the service hiccups, real customers shop normally | Failure behavior is not documented on the public listing | If you only need to block a handful of countries and IPs, both apps do the job and Blockify's track record is a legitimate point in its favor. If your actual problem is disguised traffic (residential proxies at checkout, scrapers cloning your catalog, fake Googlebots) the detection layer matters more than the rule editor. That is the problem Cordon was built around: live proxy data instead of static lists, velocity and headless detection, network-verified crawlers, and hashed IPs so the log itself is GDPR-safe. --- ## Cordon vs Blocky Blocky is an established fraud-prevention and country-blocking app for Shopify. Like Cordon, it promises to keep unwanted visitors away from your storefront. This page walks through the practical differences so you can pick based on the problem you actually have. Descriptions of Blocky below are based on its public App Store listing as of July 2026. Where the listing is silent, we say so rather than guessing. | Criterion | Cordon | Blocky | | --- | --- | --- | | VPN / proxy detection data | Live commercial detection data refreshed continuously; catches residential proxies and Tor exits, with a tunable fraud-score threshold | Rule and list based blocking; the public listing does not describe live commercial proxy scoring per request | | How the block is enforced | Detection decision in under 50ms through a theme app extension, with no injected script tags. The block screen re-asserts itself if it is tampered with, so a blocked visitor cannot browse or check out, and it fails open if the service is ever unreachable | Storefront-level blocking, applied while the page loads, as is standard in this category | | Storefront performance | Tiny storefront footprint, no injected script tags, built to keep Lighthouse scores intact | Adds storefront JavaScript; measure your Lighthouse scores before and after installing any blocker | | SEO safety | Verified search engines and good bots (Google, Bing, GPTBot, ClaudeBot, PerplexityBot, Ahrefs) are always allowed and cannot be blocked; spoofed crawlers from the wrong network are caught | Crawler handling is not prominently documented; verify how it treats Googlebot before enabling aggressive rules | | Privacy / GDPR | IPs are SHA-256 hashed with a daily-rotating salt; raw IPs never sit in the visitor log; DPA available | Check the vendor's data processing terms for how visitor IPs are stored and for how long | | Scraper-specific detection | Headless markers, request-velocity detection, spoofed-crawler checks, and datacenter ASN blocks | Oriented toward fraud and country blocking rather than behavioral scraper detection | | Failure behavior | Fails open: if the service hiccups, real customers shop normally | Failure behavior is not documented on the public listing | Blocky is a reasonable pick for simple geographic and IP-based blocking, and its fraud framing resonates with merchants who mostly fight chargebacks from known regions. Cordon's case is stronger when the threat adapts: proxy pools that rotate IPs, scrapers running headless browsers, spoofed crawlers. Those need live detection data and behavioral checks, plus the guarantee that Google is verified at the network level and always allowed. --- ## Cordon vs Securify Securify bundles store protection features for Shopify: country blocking, VPN blocking, and content-protection tools like disabling right-click. Cordon overlaps on the blocking side but takes a different position on what actually protects a store. Descriptions of Securify below are based on its public App Store listing as of July 2026. | Criterion | Cordon | Securify | | --- | --- | --- | | Content protection approach | Detects scrapers by network and behaviour: datacenter ASNs, request velocity, spoofed crawlers, then blocks the visit so a repeat run stops paying off. Right-click tricks are not a security layer | Includes browser-side deterrents like right-click and text-selection blocking, which stop casual copying but not automated scrapers | | VPN / proxy detection data | Live commercial detection data refreshed continuously; catches residential proxies and Tor exits, with a tunable fraud-score threshold | VPN and country blocking via list-based rules, per the public listing | | How the block is enforced | Detection decision in under 50ms through a theme app extension, with no injected script tags. The block screen re-asserts itself if it is tampered with, so a blocked visitor cannot browse or check out, and it fails open if the service is ever unreachable | Browser-side JavaScript blocking after the page begins to load | | SEO safety | Verified search engines and good bots (Google, Bing, GPTBot, ClaudeBot, PerplexityBot, Ahrefs) are always allowed and cannot be blocked; spoofed crawlers from the wrong network are caught | Verify crawler handling before enabling aggressive settings; user-agent allowlists alone are spoofable | | Privacy / GDPR | IPs are SHA-256 hashed with a daily-rotating salt; raw IPs never sit in the visitor log; DPA available | Check the vendor's terms for IP storage practices | | Failure behavior | Fails open: if the service hiccups, real customers shop normally | Failure behavior is not documented on the public listing | If you want right-click disabled because it deters casual copy-paste, Securify's bundle approach delivers that, and no network-level blocker will. But be clear about what each layer stops. A scraper running python-requests never right-clicks; it fetches your HTML directly, and only network-level detection stops it. If catalog theft and proxy fraud are the real problem, the detection layer is the product, and that is where Cordon concentrates: live proxy data, velocity checks, headless markers, ASN blocks, and verified crawlers. --- # Blog posts (full text) # Dozens of Tiny Failed Orders? You Are Being Card Tested Published 2026-08-12 by Bas Lefeber. Canonical: https://usecordon.com/blog/card-testing-attack-shopify > **TL;DR:** A burst of small declined orders is card testing: someone is running stolen card numbers through your checkout to find the live ones. It costs you authorisation fees, wrecks your decline ratio, and can put your payment account under review. Fix it in this order: add friction at checkout, cut off the networks the attempts arrive from, and remove the cheap product they are testing against. [See what kind of traffic is reaching your store right now](/scan), free and without installing anything. ## What you are looking at You open your admin and there are forty orders overnight, all for €1.50, almost all declined, most with email addresses that look like keyboard mashing. Maybe two went through. That is not a bug and it is not a bad batch of customers. Someone has a list of stolen card numbers and needs to know which ones are still live. Testing them against a real checkout is how they find out, and your store is the test bench. The ones that succeed get sold on or spent somewhere bigger. You are left with the fees. ## Why it is worth acting on today The failed payments feel harmless because no money left your account. Three things say otherwise. **You pay for the attempts.** Most processors charge per authorisation whether it succeeds or not. A few thousand attempts overnight is a real line on your bill for zero revenue. **Your decline ratio is being watched.** Payment processors monitor the share of your transactions that fail. A sharp spike looks like a compromised merchant account, and the response can be a review, a reserve, or a hold on your payouts. This is the expensive part, and it lands weeks after the attack when you have forgotten the cause. **The successful ones become chargebacks.** Every card that worked belongs to a real person who will eventually notice. That is a chargeback with a fee attached, and enough of them affect your standing too. ## Confirm it first Before changing anything, check the pattern. Card testing has a distinctive shape: - **Small amounts**, usually your cheapest product or a single item repeatedly. - **A tight window.** Dozens or hundreds of attempts over minutes or hours, not spread across a day. - **Many different card numbers**, often with sequential-looking details. - **A high decline rate**, frequently above 80%. - **Junk contact details.** Random-looking email addresses, or one address with `+1`, `+2`, `+3` variants. - **Billing addresses that do not match the cards**, or the same address across many different names. If instead you have a handful of declines spread over a week from plausible-looking customers, that is ordinary payment friction, not an attack. Leave it alone. ## Fix it in this order ### 1. Add friction at checkout, today This is the fastest lever and the one with the clearest effect. In your Shopify admin, turn on the checkout protections available to you: enable reCAPTCHA on your checkout and contact forms, and require CVV and postal code verification if your gateway supports it. Automated testing scripts are cheap and volume-based; anything that costs the attacker time per attempt makes your store not worth the trouble. If you use Shopify Payments, review the fraud analysis settings and consider auto-cancelling high-risk orders while the attack is running. ### 2. Remove the test product Card testers need something cheap to buy. If you have a €1 sample, a low-value accessory or a digital item priced near zero, that is almost certainly what they are hitting. Unpublish it for a few days, or raise its price. This sounds crude and it works immediately, because the script is pointed at a specific product URL. ### 3. Cut off where the attempts come from Look at the orders and find what they share. In most attacks the attempts arrive from a small number of networks, often hosting providers or VPN exit points rather than home broadband, and frequently from a country you do not sell to. Three things worth blocking, in increasing order of usefulness: - **Countries you do not ship to.** Simple, and it removes a slice of the noise. - **The specific networks.** Blocking by ASN takes out an entire hosting provider's address range in one rule, which is far more durable than chasing individual IPs. If the attempts come from a datacenter, the traffic is automated by definition, because nobody shops from a server rack. - **VPN and proxy traffic at checkout.** Card testers rarely use their own connection. This is the part an app like [Cordon](https://apps.shopify.com/cordon) handles: country, IP, ASN and VPN rules, applied to visitors rather than to orders. Shopify's own fraud tools act on the order once it exists. Blocking acts a step earlier, on the traffic that produces it. Rules take a couple of minutes to set up and there is a free plan, which matters when you are trying to stop something that is happening right now. One warning, because it is the mistake that costs more than the attack: do not block iCloud Private Relay or mobile carrier networks in the process. Private Relay ships enabled on modern iPhones and looks like a proxy to naive detection, so a blunt "block all proxies" rule turns away a large slice of genuine mobile shoppers. Cordon treats those as ordinary customers by default, and whatever tool you use, check that it does too. ### 4. Watch for the second wave Attackers come back, often from a different network. Keep an eye on your orders for a week, and check that the rules you added are catching rather than sitting idle. ## What blocking will not do Being straight about the limits, because the opposite gets sold a lot. Blocking visitor traffic reduces the attempts that reach your checkout. It does not replace your gateway's own fraud controls, and it cannot undo a chargeback that has already started. A determined attacker with fresh residential IP addresses every few minutes is genuinely hard to stop with rules alone, which is why the checkout friction in step one matters more than the blocking in step three. Nor is a blocking app a substitute for a conversation with your processor. If your decline ratio has spiked, tell them what happened before they notice it themselves. Processors are considerably more relaxed about an attack you reported than one they discovered. ## The quiet version of this problem Card testing is loud. You notice it because your inbox fills with order notifications. The same infrastructure runs quieter jobs against Shopify stores every day: price scrapers pulling your catalogue, bots probing for discount codes, automated traffic inflating your session count so your conversion rate reads lower than it is. Those do not send you notifications, which is why most merchants never find them. If the card testing was your first sign that something automated had found your store, it is worth knowing what else is arriving. [Our free store scan](/scan) reads only public pages, takes about fifteen seconds, and shows you what your store hands over to anyone who asks. No install, no account. ## Related reading - [VPN and proxy checkout fraud on Shopify](/blog/vpn-proxy-checkout-fraud-shopify) - [Reduce chargebacks by blocking fraud traffic](/blog/reduce-chargebacks-shopify-block-fraud-traffic) - [Stop discount code abuse](/blog/stop-discount-code-abuse-shopify) - [Shopify store security checklist](/blog/shopify-store-security-checklist) --- # Is ChatGPT Scraping My Shopify Store? How to Tell, and What to Do Published 2026-08-12 by Bas Lefeber. Canonical: https://usecordon.com/blog/is-chatgpt-scraping-my-shopify-store > **TL;DR:** Yes, AI crawlers are visiting Shopify stores, and their share of traffic is climbing. But they are not one thing: training crawlers, search indexers and shopper-triggered agents deserve different answers, and anything can claim their name in a user agent. Verify before you block, and be careful of blunt rules that catch Google too. [See which crawlers your store currently allows](/scan). ## The short answer Probably, and so are several others. OpenAI operates a few distinct crawlers. Anthropic runs ClaudeBot. Perplexity runs PerplexityBot. Google runs Google-Extended alongside Googlebot. Between them they are visiting a large share of the public web, and Shopify stores are not excluded. The more useful question is not whether they are visiting, but which one, and why. Those answers point in different directions. ## They are not all doing the same job Lumping them together is where most merchants go wrong. There are three kinds and they deserve separate decisions. **Training crawlers** collect content to train future models. `GPTBot` is the well-known one. There is no direct traffic back to you from this, so blocking it is a reasonable choice if you would rather your product descriptions and photography not become training data. It is a values call more than a commercial one. **Search indexers** build the index behind AI search results. `OAI-SearchBot` and `PerplexityBot` are examples. These behave like classic search crawlers: they take your content and, in exchange, can surface you in answers. Blocking them is closer to blocking Bing than to blocking a scraper. **Shopper-triggered agents** fetch a page because a person asked a question right now. `ChatGPT-User` is the clearest example. This is not scraping in any meaningful sense; it is a customer sending something to look at your store on their behalf. Blocking these removes you from purchase conversations your customers are already having. For most Shopify merchants the sensible position is: consider blocking the first category, keep the second, and definitely keep the third. ## The part almost nobody checks A user agent is a label the visitor writes about itself. Nothing stops anything from claiming to be GPTBot, and plenty of scrapers do exactly that, because a header that gets waved through is the cheapest disguise available. So "I can see GPTBot in my logs" does not tell you that OpenAI visited. It tells you something said it was OpenAI. The real crawlers publish the network ranges they operate from, which makes the claim checkable. A request claiming to be GPTBot from OpenAI's own network is very likely genuine. The same claim arriving from a low-cost hosting provider in a country you have never sold to is an impostor using a respected name as a skeleton key. This distinction matters more than the block-or-allow decision, because the traffic pretending to be a crawler is the traffic actually worth stopping. It is also the group causing most of the volume when a store gets hammered. [Cordon](https://apps.shopify.com/cordon) verifies crawler identity rather than trusting the label: a claimed crawler whose network does not match the operator is treated as an impostor, while verified crawlers are always allowed and cannot be blocked by a rule you write. That last part is deliberate, because accidentally deindexing yourself is a far more expensive mistake than any scraping. ## What to actually do ### 1. Start with robots.txt For the named, well-behaved crawlers, `robots.txt` is the right first layer. The major AI crawlers publish their user agent names specifically so you can express a preference, and they generally respect it. Be clear-eyed about what it is: a note asking politely. It works on the crawlers that choose to cooperate, and does nothing to anything impersonating them. That is fine. It is the cheapest layer and it handles the honest majority. Shopify gives every store a default `robots.txt` that names no bots at all, so unless you have edited yours, you are currently asking nobody to stay away. ### 2. Decide per category, not in one sweep Write the rule for training crawlers if you want it. Leave the search indexers and the shopper-triggered agents alone unless you have a specific reason. The instinct to "block AI" as one action is understandable and usually costs more than it saves. Being absent from AI-assisted shopping answers is a real cost, and it is a growing one. ### 3. Handle the impostors separately This is the part robots.txt cannot do, because impostors ignore it by definition. Recognising them means checking the claimed identity against the network the request came from, and treating a mismatch as what it is. ### 4. Know the ceiling Being straight about this, because the alternative gets sold a lot. Cordon, and every other blocking app on the Shopify App Store, runs as JavaScript in the visitor's browser. A crawler that fetches raw HTML without running JavaScript is not reached by any of them. What these apps do handle is traffic that actually loads your pages, which is where the volume sits and where the bandwidth and analytics damage happens. If you want to stop a raw fetch of a specific file, that is a `robots.txt` and Shopify-settings job, not an app job. Anyone telling you their app blocks it is describing something that cannot work. ## Where this is heading AI-assisted shopping is growing quickly enough that "should I block AI crawlers" is turning into "am I visible in AI answers". Those pull in opposite directions, and the answer for most merchants is not at either extreme. The stores that will do well are the ones that stay readable to the systems shoppers are actually using, while cutting off the traffic that takes without sending anyone back. Telling those apart requires verifying identity rather than reading labels. [Our free scan](/scan) shows which crawlers your store currently invites, what your `robots.txt` actually says compared to Shopify's default, and what your product data hands over to anything that asks. It reads only public pages and takes about fifteen seconds, with no install. ## Related reading - [Should you block AI crawlers on Shopify?](/blog/should-you-block-ai-crawlers-shopify) - [Do bot blockers hurt SEO?](/blog/do-bot-blockers-hurt-seo) - [Stop competitors scraping your Shopify prices](/blog/stop-competitors-scraping-shopify-prices) - [Shopify bot traffic: how to spot and stop it](/blog/shopify-bot-traffic-how-to-spot-and-stop) --- # Someone Copied Your Product Listings. Here Is How They Did It Published 2026-08-12 by Bas Lefeber. Canonical: https://usecordon.com/blog/someone-copied-my-shopify-product-listings > **TL;DR:** Your listings were almost certainly collected automatically, not by hand. Every Shopify store publishes a one-request product feed, and even with it closed the product pages carry machine-readable data. You can raise the cost and cut off the bots that browse your pages, but you cannot make a public storefront private. For the copy that already exists, a takedown request usually beats any technical fix. [See exactly what your store hands over right now](/scan). ## The uncomfortable part first Finding your own product photos and descriptions on someone else's listing feels personal. It usually is not. It is almost always automated, it took seconds, and whoever did it probably did the same to fifty other stores that morning. Knowing that matters, because it changes what actually helps. ## How it was done There are three routes, and they get harder in order. ### 1. The one-request download Every Shopify store publishes a file at `yourstore.com/products.json`. It contains product names, descriptions, prices, SKUs, variants and stock levels, and it downloads in a single request with no password and no account. This is the route most copycats use, because it requires no skill at all. It is also the reason a competitor can watch your prices daily without ever appearing in your analytics as a visitor. Shopify serves that file, not your theme. That matters for what comes later. ### 2. Reading your product pages If the feed is closed, the next step is reading product pages directly. Shopify themes embed structured product data in every page so Google can show rich results, which means the same data a shopper sees is available in a clean, machine-readable form on every page. This is slower for the copycat: it means thousands of page visits instead of one request. That is the version you can actually do something about, because those visits arrive at your store and can be recognised. ### 3. By hand Rare, slow, and generally only worth it for a handful of high-value listings. If only two or three of your products were copied, this may be what happened, and no technical measure will have prevented it. ## What you can realistically stop Here is the honest split, because this is where most advice oversells. **You cannot make your storefront private.** Everything a customer can see is, by definition, available to anyone who looks. Any tool promising to prevent copying entirely is selling you something that does not exist. **You cannot close `/products.json` with an app.** Shopify serves that file itself, and it is fetched without ever loading your store, so an app running in the visitor's browser never sees the request. That includes ours. Any Shopify app claiming to block it is describing something it cannot do. You can disable that feed yourself through your theme and Shopify's settings, which is worth doing. **You can stop the page-by-page collection.** This is the real target. Rebuilding a catalogue from product pages means thousands of visits, and those visits look nothing like shopping: they arrive from hosting networks rather than home broadband, walk your catalogue in order, do not dip overnight, and never add anything to a cart. That pattern is recognisable and blockable. **You can make it expensive.** Most copycats are opportunists working at volume. Closing the easy route and blocking the datacenter traffic moves you off the list of easy targets, which is usually enough. ## What to do, in order ### 1. Deal with the copy that already exists Technical measures do nothing about a listing that is already live. Your product photography and original descriptions are your copyright, and marketplaces have takedown processes built for this. Amazon, eBay, Etsy and the rest all have reporting routes for intellectual property infringement, and they generally work. Gather evidence first: screenshots of both listings side by side, and the dates you published yours. Do this before you file, and before the copy changes. This is the step most merchants skip while they research blocking apps, and it is the one that actually removes the copy. ### 2. Close the one-request feed Disabling the `/products.json` feed removes the laziest collection method. It is a change on your side, in your theme and store settings, not something an app does for you. Do not expect it to end the problem. Our own scan finds that when the feed is closed, prices can still be rebuilt from product pages in a couple of seconds. It raises the cost, which is worth doing, but it is a speed bump rather than a wall. ### 3. Block the automated browsing This is where a blocking app earns its place. What you want to stop is the traffic that reads your pages in bulk: - **Datacenter and hosting networks.** Nobody shops from a server rack. Blocking by ASN removes an entire provider's address range in one rule, which is far more durable than chasing individual IP addresses that change constantly. - **Request velocity.** One visitor requesting pages faster than any human browses is not browsing. - **Fake crawlers.** Collectors often claim to be Googlebot to get waved through. A real Googlebot request comes from Google's own network and can be verified; one that claims the name from a hosting provider's address cannot. The critical thing here is not blocking the real search engines by accident. That is the most common way this goes wrong, and it costs far more than the copying did. [Cordon](https://apps.shopify.com/cordon) always allows verified search crawlers and cannot be configured to block them, so a broad ASN rule cannot quietly deindex you. Whatever you use, check it does the same. ### 4. Make your listings harder to reuse Worth doing regardless, and it costs nothing: - Put your brand in your photography, so a copied image advertises you. - Write descriptions with your brand voice and specifics in them, so a lifted description reads oddly on someone else's store and is easier to prove as yours. - Register your trademark if you have not. Marketplace takedowns move considerably faster with one. ## Find out whether it is still happening The marketplace listing tells you that you were copied. It does not tell you whether collection is ongoing, which is what decides how much effort this deserves. The signal is in your own traffic. Continuous collection shows up as repeated visits from hosting networks, one source walking every product page in sequence, and a traffic pattern that stays flat overnight when human traffic does not. [Our free store scan](/scan) shows you the other half of the picture: what your store currently hands over to anyone who asks, including your own product names and prices pulled live while you watch. It reads only public pages, takes about fifteen seconds, and needs no install or account. It will also tell you plainly which parts of this an app can fix and which it cannot. ## Related reading - [Stop competitors scraping your Shopify prices](/blog/stop-competitors-scraping-shopify-prices) - [How to disable the Shopify products.json feed](/blog/shopify-products-json-disable) - [Stop scrapers stealing your product catalog](/blog/stop-scrapers-stealing-shopify-product-catalog) - [What is an ASN, and why block one?](/blog/what-is-an-asn-block-bad-bots) --- # Can You Disable products.json on Shopify? The Honest Answer Published 2026-08-06 by Bas Lefeber. Canonical: https://usecordon.com/blog/shopify-products-json-disable > **TL;DR:** Every Shopify store publishes its entire product list at `/products.json`: titles, descriptions, images, SKUs, stock levels and live prices, with no password. You cannot turn it off unless you are on Shopify Plus, because Shopify serves the file, not your theme. No app can close it either, whatever the App Store listing says. What you can control is the repeat crawling that follows, which is where the actual cost lives. [Check what your store exposes in about fifteen seconds](/scan). Open a new tab and type your store address followed by `/products.json`. Most Shopify owners have never done this. What comes back is your entire published catalog as machine-readable data: every product, every variant, every price, no login and no rate limit. This is not a bug and it is not a leak. It is documented Shopify behaviour that powers plenty of legitimate integrations. But almost nobody who runs a store knows it is on, and the question that follows is always the same one: can I switch it off? This post gives the honest answer, which is mostly no, and then covers what is actually worth doing instead. ## What /products.json returns The endpoint returns your published products as JSON, thirty at a time by default and up to 250 per page with `?limit=250`. Paging through it takes a few seconds even on a large catalog. For each product you get: - **Title, handle, full description HTML, vendor, product type and tags** - **Every image URL**, at full resolution - **Every variant**, with `price`, `compare_at_price`, `sku`, `barcode`, `weight`, `option` values and `available` That last field is the one merchants tend to react to. `available` and, on many themes, the inventory quantity, tell an outsider what is selling. Combined with a crawl every few hours, someone can watch your stock move and work out your sales velocity per SKU without ever placing an order. What it does **not** expose is worth stating just as clearly, because this gets exaggerated online. There are no customers, no orders, no email addresses, no draft or unpublished products, no cost prices, no margins and nothing from your admin. Your customer data is not involved. This is a commercial exposure, not a breach. ## Why you cannot turn it off Here is the part that surprises people, and the reason so many forum threads on this go nowhere. **`/products.json` is served by Shopify, not by your theme.** When a request comes in for that path, Shopify's own infrastructure answers it directly. Your theme's Liquid never runs. Your app embeds never load. Anything you can edit in your theme editor sits downstream of a response that has already been sent. Three consequences follow, and they are all worth knowing before you spend money on this: 1. **There is no setting in your admin.** Not under Preferences, not under Sales channels. On Basic, Grow and Advanced there is no supported way to disable the endpoint. 2. **No app can block it.** This is the important one. An app that promises to hide your product feed is either mistaken or misleading you. Every Shopify app that touches your storefront does so through a theme app extension, which is JavaScript running in a visitor's browser. A script that requests `/products.json` never loads your theme, never runs any JavaScript, and never encounters the app at all. That includes ours: **Cordon cannot close this endpoint, and we will not tell you otherwise.** 3. **Shopify Plus is the exception.** Plus merchants have access to custom rules at the CDN layer and can restrict or rate-limit the path there, above where the theme lives. If you are on Plus and this genuinely matters to your business, that is the conversation to have with your merchant success manager. ### What about robots.txt? Since Shopify allows editing `robots.txt.liquid`, this comes up constantly as a suggested fix. It is not one. Robots.txt is a voluntary request. Googlebot honours it, Bingbot honours it, and the well-behaved commercial crawlers mostly honour it. A scraper built to collect your prices does not, and reading your robots.txt is a reasonable way for one to learn which paths you consider valuable. Adding a `Disallow` line changes nothing about what the server returns. It is still worth editing for the crawlers that *do* obey it, which we cover in [should you block AI crawlers on Shopify](/blog/should-you-block-ai-crawlers-shopify). Just do not file it under "problem solved". ## So what actually matters The single anonymous request is not what costs you money. Someone downloading your catalog once is roughly equivalent to them browsing your store with a notepad. Annoying, harmless, unstoppable. What costs you money is the **repetition**, and repetition is a completely different technical problem, because it is visible. - A competitor's repricing engine polling your feed every fifteen minutes so it can sit one euro under you, forever. We covered the mechanics in [how to stop competitors scraping your Shopify prices](/blog/stop-competitors-scraping-shopify-prices). - A counterfeit operation walking your product pages to lift images and descriptions onto a marketplace listing. That is [catalog theft](/blog/stop-scrapers-stealing-shopify-product-catalog), and it needs far more than one request. - Bulk crawlers that inflate your session numbers, wreck your conversion rate in analytics, and on a busy day compete with real shoppers for server time. All three share a property the one-off download does not have: **they come back**. Something that comes back thousands of times leaves a pattern, and a pattern can be recognised and refused. One of our merchants, a jewellery store, turned detection on and found that a single operation running from rented servers in Singapore accounted for **77% of all traffic to their store**, 82,064 requests against their product pages. The owner had no idea. Nothing in the Shopify admin surfaces that, because as far as Shopify is concerned those were all just visits. ## What is worth doing instead In rough order of effort against payoff: **1. Look at your feed once, so you know what is in it.** Check for anything genuinely sensitive that has crept into a product description or tag: internal SKU logic, supplier names, unreleased product names sitting on a published-but-unlinked product. Draft products are safe. Published-but-hidden ones are not: if it is published, it is in the feed, whether or not it appears in a collection. **2. Unpublish rather than hide.** If a product should not be public, set it to unpublished rather than removing it from navigation. Anything published is in the feed regardless of whether a shopper could find it by clicking. **3. Edit robots.txt for the crawlers that listen.** Ten minute job, real if modest benefit, no illusions about what it does. **4. Watch the networks your traffic comes from.** Real shoppers arrive from home broadband and mobile carriers. Automated collection arrives from hosting providers: AWS, Alibaba Cloud, Tencent, Hetzner, OVH, and a long tail of VPS resellers. A single hosting network accounting for a large share of your traffic is the clearest signal there is, and it is the unit worth acting on. See [what an ASN block is](/blog/what-is-an-asn-block-bad-bots). **5. Refuse the repeat visitors, not the first one.** Blocking by network, by country where you do not ship, and by behaviour turns a copycat's fifteen-minute refresh into an expensive problem for them. A determined operation can move to residential proxies and browse at human pace, which costs them real money and slows them from minutes to days. That gap is usually enough for a promotion to run before it gets matched. **6. Keep your sitemap.** It lists every product URL you own, which feels like the same problem, but Google needs it and removing it costs you far more than it saves. The answer is controlling who walks the map, not burning the map. ## Check your own store You can inspect the feed yourself in a browser tab, and you should. If you want the fuller picture in one go, our [free store scan](/scan) checks what your feed returns, counts the product pages published in your sitemap, reads your robots.txt, and tells you whether anything is currently filtering your visitors. It takes about fifteen seconds, needs no signup, and tells you plainly which findings are fixable and which are not. [Cordon](https://apps.shopify.com/cordon) handles the part that is: the repeat crawling, the hosting networks, the proxies and the bots that come back to your store day after day. It cannot close `/products.json`, and now you know why nothing else can either. --- # Shopify Traffic But No Sales? Check Who Is Actually Visiting Published 2026-08-06 by Bas Lefeber. Canonical: https://usecordon.com/blog/shopify-traffic-but-no-sales > **TL;DR:** If sessions are healthy and orders are not, work through the ordinary causes first, because most of the time it is the offer, the audience, the shipping cost or the mobile experience. But if your sessions climbed without your marketing changing, some of that "traffic" may not be people. Bots land in your session count, never buy, and quietly drag your conversion rate down, which sends you optimising a product page that was fine all along. [Check what is actually reaching your store, free, in about fifteen seconds](/scan). This is one of the most common things a store owner searches, and most of the answers you find are the same checklist of conversion tips. Those tips are usually right. So let us do them properly first, and then cover the thing almost nobody checks. ## Start with the boring explanations Be honest with yourself about these before blaming anything technical. In most stores, one of them is the answer. **The traffic is the wrong audience.** Cheap clicks are cheap for a reason. Interest-based social traffic browses, search traffic buys. If your sessions jumped after you started a broad awareness campaign, you bought attention, not intent. **The offer is not competitive.** Open an incognito window, search for your main product, and buy it from whoever comes up first. If a rival is cheaper, ships faster, or simply looks more trustworthy, you have your answer and no amount of button colour will fix it. **Shipping cost is a surprise.** The single most common abandonment reason, year after year. If the first time someone sees the delivery charge is at checkout, expect to lose a large share of them right there. **Mobile is slow or awkward.** Most storefront traffic is mobile. Load your own store on 4G, not office wifi. Anything over about three seconds bleeds customers, and Shopify's own speed report understates what a real phone on a real network experiences. **Trust is missing.** No reviews, no clear returns policy, no contact details, a generic theme with stock photos. Shoppers read these signals in seconds. **You are looking at too small a sample.** At a 2% conversion rate, 200 sessions is expected to produce four orders. Zero orders out of 200 is not a crisis, it is normal variance. Do not redesign anything on a week of data. If one of those fits, fix it and stop reading. If you have been through all six and the numbers still make no sense, keep going. ## The thing almost nobody checks Your conversion rate is a fraction. Orders on top, sessions underneath. Every conversation about conversion rate optimisation focuses on the top of that fraction. Almost nobody audits the bottom. **Not all sessions are people.** Shopify filters some known crawlers, but plenty of automated traffic still lands in your session count: price-monitoring bots, catalog scrapers, SEO tools, AI crawlers, security scanners, and the growing category of scrapers that drive a real browser engine specifically so they look like a person. That last group is the problem, because a real browser engine loads your JavaScript, fires your analytics, and gets counted exactly like a shopper. Those sessions will never buy. They sit in the denominator forever, and the effect is not small. One of our merchants, a jewellery store, is the clearest example we have. When we looked at their logs, **77% of all traffic to their store came from a single source**: one operation running off rented servers in Singapore, which had made 82,064 requests to their product pages, around the clock, with no overnight dip. The interesting part is not the scraping. It is what their dashboard looked like while it happened. Shopify Analytics reports **country**, not network. So the whole thing appeared as ordinary traffic from Singapore, and their reported conversion rate was understated by roughly threefold. Every decision made off that number, about ad spend, about the product page, about whether the store was working, was made against a figure that was wrong. ## How to tell whether your traffic is human You do not need a tool to start. Open your analytics and look for these. 1. **Does the traffic sleep?** Real shoppers follow a daily rhythm, busy in the evening, quiet at 4am. A flat line across 24 hours is a machine. This is the single strongest signal and it takes ten seconds to check. 2. **Did one country appear without a campaign?** A sudden block of sessions from a country you do not ship to, market in, or have customers in, with no campaign behind it. 3. **Is time on page near zero?** Automated clients grab the page and leave. Sessions clustered near zero seconds are not reading anything. 4. **Are add-to-carts missing entirely?** Real traffic produces a trickle of carts even when it does not convert. Thousands of sessions with almost no cart activity is a strong tell. 5. **Are the same few product URLs hit repeatedly?** Price monitoring targets your best sellers on a schedule. Look for the same handful of pages, from the same source, at a suspiciously regular interval. 6. **What network are they on?** This is the definitive one, and the one Shopify does not show you. Real shoppers connect from home broadband and mobile carriers: Comcast, Vodafone, Jio, Orange. Automated traffic connects from hosting providers: AWS, Alibaba Cloud, Tencent, Hetzner, OVH. Nobody browses for boots from a rented server. Point six is why this is hard to diagnose in Shopify alone. The admin shows you country and device. The network is where the answer lives, and you need something reading each request to see it. Our guide on [spotting and stopping bot traffic](/blog/shopify-bot-traffic-how-to-spot-and-stop) goes deeper, and [what an ASN block is](/blog/what-is-an-asn-block-bad-bots) explains why the network number is the right thing to act on. ## Check your store in fifteen seconds Before you install anything, you can see part of the picture from the outside. Our [free store scan](/scan) shows you what your store hands to anyone who asks: whether your full product list downloads in one request, how many product pages are published, and whether anything is currently checking who walks in. No signup, and it tells you plainly which findings are worth acting on and which are not. That gives you the exposure side. The traffic side needs measurement over time, which is what [Cordon](https://apps.shopify.com/cordon) does once it is running: every visit, the country, the network behind it, and whether it was a person or a machine. ## What to expect if you clean it up Set expectations properly, because this gets oversold. **Blocking bots does not create orders.** Not one. Anyone promising a conversion lift from a blocking app is selling you something. What changes is that the number becomes true. That still matters more than it sounds: - **Your conversion rate becomes real**, so you stop rebuilding a product page that was converting fine to actual humans all along. - **Your ad decisions improve.** If bot traffic is concentrated on particular landing pages, it makes some campaigns look worse than they are and others better. - **Your costs drop** wherever you pay per visitor, which includes plenty of Shopify apps. - **Your competitors stop getting a live feed of your prices**, which is a separate problem the same traffic often represents. See [how to stop competitors scraping your Shopify prices](/blog/stop-competitors-scraping-shopify-prices). And to be straight about the likely outcome: for most stores with traffic and no sales, this is **not** the main cause. The offer, the audience and the shipping cost usually are. But it takes fifteen seconds to rule out, and when it is the cause, it is invisible in every report Shopify gives you, which is exactly why it goes unnoticed for months. [Run the free scan](/scan) and rule it out. --- # 65% of One Store's Traffic Was a Single Scraper Published 2026-08-04 by Bas Lefeber. Canonical: https://usecordon.com/blog/shopify-scraper-traffic-case-study > **TL;DR:** A jewelry store on Shopify took 33,700 visits in its first 22 hours with Cordon installed. 21,840 of them, about 65%, came from a single datacenter network running at a flat 1,200 to 1,500 requests an hour, day and night. The merchant had no way to see this, because Shopify Analytics reports country and not network. The bandwidth was the least of the damage: every number she was making decisions on was contaminated. Here is the full breakdown and how to check your own store. Curious what your own store hands over? [The free scan](/scan) pulls your live product data in front of you in about fifteen seconds. Most articles about bot traffic argue from principle. This one is a single store's logs over 22 hours, with the numbers as they were recorded. The store is a jewelry brand on Shopify and is not named here at their request. Everything else is exactly as it happened. ## The numbers Cordon was installed on a Saturday evening. This is what the first 22 hours looked like. | Measure | Value | | --- | --- | | Total visits, first 22 hours | 33,700 | | From AS45102 (Alibaba Cloud, geolocating to Singapore) | 21,840 | | Share of all traffic from that one network | ~65% | | Request rate from that network | 1,200 to 1,500 per hour | | Pattern | Flat across all 24 hours, no overnight drop | | Blocked by Cordon | ~22,300 | Behind the leader there was a tail from HostRoyale, M247, Vultr and EGIHosting. Every one of those is a hosting provider. Nobody shops for jewelry from a rented server. ## The pattern is the proof A single large number is not evidence of automation on its own. A viral post or a press mention can produce a traffic spike from one region. What makes this unambiguous is the shape. Human traffic breathes. It rises when your main markets wake up, peaks in the evening, and falls to a trickle overnight. Even a global audience produces a visible rhythm, because the world does not shop uniformly around the clock. This traffic did not breathe. It ran at 1,200 to 1,500 requests an hour at 04:00 and at 14:00, through the night, without gaps. That is not an audience. That is a scheduled job, and once you have seen the flat line you never mistake it for anything else. **This is the single most useful thing to check in your own logs.** Before you look at countries, user agents, or anything else, look at the hourly distribution. If it is flat, you are looking at automation, and the only remaining question is which network it comes from. ## Why the merchant could not see any of this Here is the part that matters most, and it is not really about scraping. Shopify Analytics reports sessions and countries. It does not report the network a request came from. So those 21,840 requests appeared in her dashboard as ordinary traffic from Singapore, mixed in with real people. There was no anomaly to notice, no warning, nothing out of place. The traffic looked like growth. The country column is the trap. A request from an Alibaba Cloud server in Singapore and a request from a person in Singapore both report as Singapore. A request from an AWS instance in Ohio and a request from a shopper in Ohio both report as the United States. Country tells you where a packet claims to come from. It tells you nothing about whether a human is attached to it. What separates them is the **ASN**, the autonomous system number, which identifies the network operator. AS45102 is a cloud hosting network. AS7922 is Comcast. The first carries servers, the second carries people. That distinction is available on every single request, and it is not surfaced anywhere in the Shopify admin. If you want one takeaway from this post: **country is a weak signal and network is a strong one.** ## What it actually cost her The bandwidth is the boring part. Shopify absorbs the hosting and the store did not go down. The real cost was that every number she was working from was wrong. **Her conversion rate was understated by roughly a factor of three.** Conversion is orders divided by sessions. With 65% of sessions belonging to a bot that never buys anything, the denominator was inflated and the rate she saw was a fraction of her true rate. A merchant looking at that number could reasonably conclude her product pages were failing and start redesigning something that was working fine. **Her channel reporting was contaminated.** Traffic attributed to a region she does not sell into much, at volume, distorts any read on which markets are worth investing in. **Her growth signal was fake.** Traffic went up. Nothing about the business had changed. This is why bot traffic is worth caring about even when your store stays up. It is not a performance problem. It is a measurement problem, and measurement problems cause bad decisions quietly for months. ## Why ASN blocking and not IP blocking The instinct when you find a bad IP is to block that IP. Against this kind of source, that is a losing game. A scraper running on rented infrastructure can change IP address whenever it wants. Blocking addresses one at a time is a list you maintain forever and never finish, and every hour you spend on it the scraper spends nothing. You are the only one paying. The ASN is the network it rents from. One rule at that level ends the entire source at once, and it keeps working when the individual addresses rotate. It is the difference between swatting individual wasps and closing the window. The caveat that matters: **a datacenter list has to be curated, not automatic.** Hosting networks carry servers. But CDN networks like Cloudflare, Fastly and Akamai carry iCloud Private Relay traffic, which means real iPhone shoppers exit through them. A naive "block all non-residential networks" rule turns away genuine customers, which is the most expensive mistake available in this category. Cordon's datacenter list deliberately excludes CDN networks for exactly this reason. ## How to check your own store You do not need to buy anything to do the first two steps. 1. **Look at the hourly shape of your traffic.** Any analytics tool will show you this. If your traffic is as busy at 04:00 as at 14:00, something automated is running. 2. **Look for round-the-clock consistency.** Real audiences have weekends, holidays, and quiet Tuesdays. Automation does not. 3. **Get the ASN.** This is the step Shopify does not give you. You need a tool that resolves each visitor IP to its network operator and shows you the breakdown. [Cordon](https://apps.shopify.com/cordon)'s free plan does this, and seeing your own numbers is the point of it. Most merchants have never looked at their traffic this way. 4. **Block at the network, not the address**, once you know what you are looking at. ## The ending, told straight This part does not flatter us, and leaving it out would make the rest less honest. While the store was on a paid plan, Cordon blocked around 22,300 of those requests. It worked exactly as intended. Nineteen hours later she moved to the free plan. The free plan does not include datacenter and proxy detection, so the blocking switched off and the block count went to zero from 15:00 onward. The scraper carried on at the same rate, unchallenged. That is a failure of communication, not of detection. She had no way to weigh what she was giving up, because the value was invisible by exactly the same mechanism that made the original problem invisible: nothing showed her the ASN breakdown at the moment she was deciding. It is also worth saying that the plan she left was more than she needed. At her volume, Growth at $19 restores proxy and datacenter detection and its limit covers this traffic comfortably. Recommending the more expensive plan would have been the easier sentence to write and the wrong one. The lesson we took from it: showing a merchant their own traffic honestly is not a marketing exercise, it is the product. If you cannot see what is hitting your store, you cannot make a good decision about it, and neither the problem nor the fix will ever feel real. ## Further reading - [How to stop scrapers stealing your Shopify product catalog](/blog/stop-scrapers-stealing-shopify-product-catalog) - [What is an ASN, and how does blocking one stop bad bots?](/blog/what-is-an-asn-block-bad-bots) - [How to spot and stop Shopify bot traffic](/blog/shopify-bot-traffic-how-to-spot-and-stop) - [How to stop competitors scraping your Shopify prices](/blog/stop-competitors-scraping-shopify-prices) --- # Does Shopify Block Bots and Countries by Default? (2026) Published 2026-07-21 by Bas Lefeber. Canonical: https://usecordon.com/blog/does-shopify-block-bots-and-countries > **TL;DR:** Shopify secures its platform (DDoS defense, PCI-compliant checkout, SSL) but does not block bots, scrapers, VPNs, proxies, Tor, or countries at the visitor level for your individual store. That traffic reaches your storefront unless you add a filtering app. Platform security and traffic filtering are two different jobs, and Shopify only does the first. [Cordon](https://apps.shopify.com/cordon) does the second, with a free plan for country and bot blocking. Before installing anything, most merchants ask a reasonable question: does Shopify already handle this? It is worth a precise answer, because the marketing around both Shopify and blocking apps tends to blur the line. Here is exactly what Shopify blocks on its own and what it leaves to you. ## What Shopify does protect Shopify is a secure platform, and it is not fair to imply otherwise. Out of the box you get: - **Platform-level DDoS protection.** Shopify defends its infrastructure against large-scale volumetric attacks. If a botnet tries to take the platform down, that is Shopify's problem to absorb, and they do. - **PCI DSS Level 1 compliant checkout.** Card data is handled in Shopify's hosted, certified checkout. You are not storing card numbers, and the payment surface is Shopify's responsibility. - **SSL on every store.** All traffic is encrypted end to end. - **Basic edge filtering of abusive infrastructure.** Shopify drops some obviously malicious traffic at its network edge before it reaches any store. - **Order-level fraud analysis** on qualifying plans, which scores placed orders for risk. This is real protection, and it is why "is Shopify secure" has a genuinely reassuring answer. The platform is secure. But platform security is not the same as controlling who reaches your specific store. ## What Shopify does not block Here is the part that surprises people. None of the following is handled by Shopify at your store's visitor level: | Traffic type | Blocked by Shopify natively? | What it does to your store | |---|---|---| | Scrapers and price monitors | No | Copy your catalog and pricing | | Checkout and drop bots | No | Snipe limited inventory | | Fake-account and form-spam bots | No | Bloat your list, hurt deliverability | | VPN and proxy traffic | No | Hide fraud behind anonymized IPs | | Tor exit nodes | No | Maximum-anonymity abuse | | Specific countries | No (Markets is not a block) | Browse, cart, and scrape freely | | Individual bad IPs | No | Return repeatedly | Every row here reaches your storefront by default. Shopify's edge filtering catches crude, platform-wide abuse, not the store-specific traffic that costs an individual merchant money: the competitor scraping your prices, the bot creating fake accounts, the card tester behind a VPN, the visitor from a country you never ship to. ## Why the "Markets is not a block" point matters The single most common misconception is that Shopify Markets blocks countries. It does not. Markets controls where you *sell*: which countries appear as markets, which currencies you support, where you ship, and which shipping addresses checkout will accept. A visitor from a country you excluded from Markets can still load every page, read every product, download every image, add to cart, and pull your entire catalog through `/products.json`. Markets is a selling configuration, not a traffic filter. We unpack this fully in [how to block a country on Shopify](/blog/how-to-block-a-country-on-shopify). The same shape applies to fraud analysis and VPNs. Fraud analysis scores an order *after* it exists. It does not stop an anonymized visitor from reaching checkout. If you want the anonymized visit stopped before the order, that is a [VPN and proxy blocking](/blog/how-to-block-vpn-on-shopify) job, and Shopify does not do it. ## Platform security versus traffic filtering The clearest way to hold both ideas at once: - **Platform security (Shopify's job):** keeping the platform up, keeping checkout PCI-compliant, encrypting traffic, absorbing DDoS. Shopify does this well and you do not need an app for it. - **Traffic filtering (your job):** deciding which visitors reach *your* store. Bots, scrapers, anonymized traffic, unwanted countries, repeat-offender IPs. Shopify leaves this to you, and it is what a filtering app exists to do. Confusing the two is what leads merchants to either over-trust ("Shopify handles security, so I am covered") or over-worry ("is my store even safe?"). The store is safe. The traffic is unfiltered. ## What to add, and when You do not need a traffic filter on day one of a store with no traffic. You need it when you start seeing the problems: a competitor cloning your catalog, bots inflating your ad clicks, chargebacks from mismatched-country orders, fake signups flooding your email tool, a limited drop getting sniped. When any of those start, an app that filters at the visit level is the fix. Cordon does exactly that. It blocks bots, scrapers, VPNs, proxies, Tor, specific countries, and individual IPs on the visit itself, in under 50 milliseconds, installed as a theme app extension so there is no script tag and no Lighthouse hit. And it always allows verified search engines, so filtering aggressively never touches your SEO. For the full picture of what belongs at each layer of store protection, see the [Shopify security checklist](/blog/shopify-store-security-checklist). ## Frequently asked questions ### Does Shopify block bots automatically? Shopify protects its platform from large-scale attacks like DDoS and filters some abusive infrastructure at its network edge. It does not block scrapers, price monitors, catalog bots, checkout bots, or fake-account bots at the visitor level for your individual store. That traffic reaches your storefront unless you add a blocker. ### Can Shopify block a country by default? No. Shopify Markets controls where you sell and ship, and checkout can reject shipping addresses you do not serve, but nothing in Shopify stops a visitor from any country from browsing your store, adding to cart, or scraping your catalog. Visitor-level country blocking requires an app or your own edge infrastructure. ### Does Shopify detect VPN or proxy traffic? No. Shopify has no setting that identifies whether a visitor's IP is a VPN, proxy, or Tor exit. Shopify fraud analysis scores an order after it is placed, but it does not block anonymized visits before they reach checkout. ### Is Shopify secure without any extra apps? The platform itself is secure. Shopify is PCI DSS Level 1 certified, hosts checkout, provides SSL on every store, and defends its own infrastructure. What it does not do is filter unwanted visitor traffic to your specific store. Platform security and traffic filtering are different jobs, and Shopify only does the first. ### What do I need to add to block unwanted traffic? A traffic-filtering app like Cordon. It blocks bots, scrapers, VPNs, proxies, Tor, specific countries, and individual IPs at the visit level, while always allowing verified search engines like Googlebot. The free plan covers country and bot blocking, and paid plans add VPN, proxy, and Tor detection. ## Wrapping up Shopify keeps the platform secure and the checkout compliant. It does not decide who reaches your store, and it does not block bots, scrapers, VPNs, or countries at the visitor level. That job is yours, and it is what a filtering app is for. If you have started seeing traffic you would rather not serve, [try Cordon on the Shopify App Store](https://apps.shopify.com/cordon). The free plan covers country and bot blocking, every paid plan has a 7-day free trial, and the [pricing page](/pricing) has the full breakdown. --- # Geo Restrict Your Shopify Store to Specific Countries Published 2026-07-20 by Bas Lefeber. Canonical: https://usecordon.com/blog/geo-restrict-shopify-store-to-countries > **TL;DR:** If you sell to only one country or a short list of markets, allowlist those countries and block the rest. This is the inverse of a blocklist: instead of naming the few countries you keep out, you name the few you let in and everyone else hits the block screen. Verified search engines like Google stay allowed regardless, so SEO is safe. [Cordon](https://apps.shopify.com/cordon) does this in under 50 milliseconds. Most country-blocking guides assume you sell globally and want to keep a few bad regions out. That is a blocklist, and we covered it in [how to block a country on Shopify](/blog/how-to-block-a-country-on-shopify). This guide is the opposite. If you ship to only Germany, or only the Nordics, or only the US and Canada, then the other 190-plus countries are not customers. They are noise. This is how you flip the default and let only your markets through. ## Blocklist vs allowlist: pick the right default The two approaches solve different problems, and choosing the wrong one makes your rules brittle. A **blocklist** starts from "everyone is allowed" and names the exceptions to block. It fits a store that sells worldwide and wants to keep out two or three fraud hotspots. The list stays short because you are excluding a handful of countries. An **allowlist** starts from "everyone is blocked" and names the exceptions to allow. It fits a store that serves one country or a small cluster. Here the allowlist stays short because you are including a handful of countries, and the block covers everything you did not name. The rule of thumb: **list whichever set is smaller.** If you keep out 3 countries, blocklist. If you serve 3 countries, allowlist. Trying to blocklist 190 countries one flag at a time is a mistake, and you will miss some. Allowlisting the 3 you serve is exact and takes a minute. | | Blocklist (block a few) | Allowlist (allow a few) | |---|---|---| | Default for unlisted countries | Allowed | Blocked | | Best when you sell | Globally, minus bad regions | To one country or a short list | | What you name in the rules | The countries to keep out | The countries you serve | | List stays short because | Few bad countries | Few served countries | | Risk of missing a country | High (190-plus to name) | Low (you name what you serve) | | Verified search engines | Always allowed | Always allowed | | Guide | [Block a country](/blog/how-to-block-a-country-on-shopify) | This post | ## Why merchants allowlist countries If you have run a single-market store for a year and looked at your logs, the case for allowlisting writes itself. Every visitor from a country you will never ship to is one of these: - **Fraud attempts.** Stolen cards get tested against stores that will process any region. If you only ship to one country, a checkout attempt from three time zones away with a mismatched billing address is a red flag, not a sale. - **Scrapers and price bots.** A large share of catalog scraping comes from datacenter networks in a predictable set of regions. If you serve one market, none of that traffic is a customer, so there is no reason to serve it your product data. See [stop competitors scraping your prices](/blog/stop-competitors-scraping-shopify-prices). - **Support tickets from people who can never buy.** Every "why can't I check out" email from a country you do not ship to is time spent on a non-customer. - **Chargebacks.** Orders from regions you cannot fulfill turn into disputes. Keeping the traffic out keeps the disputes out. More on that in [reduce chargebacks by blocking fraud traffic](/blog/reduce-chargebacks-shopify-block-fraud-traffic). - **Skewed analytics.** Sessions, bounce rates, and conversion numbers are all polluted by traffic that was never going to convert. Blocking does not clean up your Shopify reports, because Shopify counts the pageview before any app runs. What it gives you is a visitor log that separates the two, so you can finally see what your numbers look like with the non-customers taken out. Allowlisting is not about disliking other countries. It is about only serving the market you actually sell to. ## Why Shopify Markets does not do this This trips up most merchants, so let's be precise. **Shopify Markets controls where you sell.** It sets which countries appear in your market settings, which currencies and prices show, and where you ship. If a country is not in a market, a customer there cannot complete checkout with a local shipping address. **Shopify Markets does not stop anyone from visiting.** A visitor from an excluded country can still load every page, read every description, download every image, add to cart, and pull your entire catalog through `/products.json`. Markets is a selling configuration, not a traffic filter. Shopify's own [help docs](https://help.shopify.com) cover markets, duties, and shipping zones, but visitor-level restriction is out of scope for the platform. So if your goal is "only people in the country I serve should be able to browse my store," Markets alone does not get you there. You restrict at the traffic level, which is what an allowlist does. ## How allowlist mode works in Cordon The mechanism is one rule you already understand: **allow rules always win over block rules.** In allowlist mode you turn that into a policy: 1. Add **allow rules** for the countries you serve. 2. Set the **default action to block**, so anything not explicitly allowed is stopped. Now only your named countries pass. Everyone else hits the block screen. Because allow rules win, you can still layer specific IP allow entries on top for known exceptions (more on that below). The point that saves your SEO: **verified search engines are always allowed, even in allowlist mode, and cannot be blocked.** Crawler verification runs before your country allowlist is evaluated. A request claiming to be Googlebot is checked against Google's real network at the rDNS level. If it verifies, it is allowed no matter what your country rules say. So Googlebot crawling from a US datacenter still reaches a store that only allows Germany. The same holds for Bing, and for the good bots that feed AI search (GPTBot, ClaudeBot, PerplexityBot) and SEO tools like Ahrefs. A *fake* Googlebot from a non-Google network fails verification and gets blocked like any other unlisted visitor. We covered this in depth in [do bot blockers hurt SEO?](/blog/do-bot-blockers-hurt-seo). For everyone who is blocked, the **block screen is customizable.** Instead of a raw error, show a polite message explaining that you currently ship only to your markets, with a link or a redirect if you want to send them somewhere useful. ## Set up allowlist mode in Cordon Here is the full flow. 1. **Install Cordon** from the [Shopify App Store](https://apps.shopify.com/cordon). It installs as a theme app extension, so no code edits and no script tags. 2. **Open the country rules** in the embedded admin and use the one-click flag picker. 3. **Add allow rules for the countries you serve.** Click the flag for each market you actually sell to. If you ship only to Germany, that is one flag. 4. **Set the default action to block.** This is what makes it an allowlist. Everything you did not name is now blocked. 5. **Customize the block screen** with a short message explaining you ship only to your listed regions, so blocked visitors understand rather than assuming your store is broken. 6. **Add IP allowlist exceptions** for known people outside your served countries: a supplier, an agency, a founder who travels. IP allow rules win over the country default. 7. **Save.** Rules are live immediately. Open the live visitor log to watch decisions in real time. It shows country, ASN, and the exact rule that fired, with IPs SHA-256 hashed under a daily-rotating salt so the log is GDPR-safe. Country allowlisting works on every plan, including the Free plan. See the [feature list](/features) for the full rule set. ## Be honest about the edge cases Allowlisting by country is a blunt instrument by design, and it has known trade-offs. Do not deploy it without understanding them. **Travelers and expats from your country get blocked.** An allowlist blocks by where the visitor is right now, not who they are. A German customer on holiday in Spain appears as Spain and gets blocked from your Germany-only store. If you know that person, add their IP to the allowlist and it overrides the country rule wherever they connect from. For unknown travelers, the block screen message matters: make it clear what is happening rather than looking broken. **VPN users appear in the wrong country.** Someone in your allowed country routing through a VPN endpoint abroad looks foreign and gets blocked. The reverse is the real risk: a visitor abroad routing through a VPN endpoint *inside* your allowed country looks local and slips through the allowlist. That bypass is exactly what VPN, proxy, and Tor detection closes. On the Growth plan and up, Cordon flags those connections so a faked location does not pass your allowlist. See [VPN and proxy checkout fraud](/blog/vpn-proxy-checkout-fraud-shopify) for how that detection works. **Known exceptions belong on the IP allowlist.** The pattern is: country allowlist for the broad rule, IP allow entries for the specific humans who need through anyway. Because allow rules always win, one IP entry beats the country default cleanly, no matter how strict the rest of your policy is. ## Blocklist and allowlist can coexist You do not have to pick one forever. A common setup is an allowlist for the broad geography plus targeted blocks inside it. For example, allow the US and Canada, then still block specific datacenter ASNs or single fraud IPs you have seen inside those countries. Allow rules win, block rules catch the rest, and the default action handles everyone unlisted. It is one rule set, evaluated in a fixed order, so the behavior is predictable rather than a pile of conflicting toggles. ## Frequently asked questions ### What is the difference between blocklisting and allowlisting countries? A blocklist names a few bad countries to keep out and lets everyone else in, which fits stores that sell globally. An allowlist names the few countries you serve and blocks everyone else, which fits stores that ship to only one or a handful of markets. Allowlisting is simpler and safer when your served list is short because you never have to name all 190-plus countries to exclude. ### Does Shopify Markets restrict who can visit my store by country? No. Shopify Markets controls where you sell, which currencies show, and where you ship, but it does not stop anyone from any country from browsing your store, adding to cart, or scraping your catalog. Restricting who can visit requires an app or your own edge infrastructure in front of the store. ### Will allowlisting only a few countries hurt my SEO? No. Verified search engines like Googlebot and Bingbot are always allowed regardless of your country rules, even in allowlist mode. Googlebot crawling from a US datacenter still reaches a store that only allows Germany, because crawler verification runs before your country allowlist is checked. ### What happens to a customer from my target country who is traveling abroad? An allowlist blocks by where the visitor is right now, not who they are, so a customer from your allowed country browsing from a different country will be blocked. If you know that person, add their IP to the allowlist and it overrides the country rule so they get through wherever they are. ### Can someone use a VPN to fake being in my allowed country? Yes. A VPN endpoint inside your allowed country makes a visitor appear local, which is the standard way to slip past a country allowlist. VPN, proxy, and Tor detection on the Growth plan and up catches those connections so a faked location does not pass. ## Wrapping up If you sell to one country or a short list of markets, allowlisting is the cleaner default: name what you serve, block the rest, and let verified search engines through untouched. It takes a minute to set up and it survives theme updates because it runs at the traffic level, not in your theme. [Try Cordon on the Shopify App Store](https://apps.shopify.com/cordon). Country allowlisting is on the Free plan, and every paid plan has a 7-day free trial. Full details are on the [pricing page](/pricing) and in [block traffic by country](/use-cases/block-traffic-by-country). --- # How to Stop Bot Clicks and Fake Traffic on Your Shopify Ads Published 2026-07-20 by Bas Lefeber. Canonical: https://usecordon.com/blog/stop-bot-clicks-shopify-ads > **TL;DR:** A large share of paid ad clicks are never real shoppers. Bots, click farms, and competitors' monitoring tools click your Meta and Google ads, you pay for every click, and the traffic bounces without buying. [Cordon](https://apps.shopify.com/cordon) blocks bots, datacenter networks, and high-risk proxies on arrival, so the junk session ends at a block screen instead of wandering your funnel and feeding your pixel garbage. Real shoppers on mobile and home connections pass straight through. [Scan your store free](/scan) to see whether the traffic reaching your landing pages looks like people. If you run Meta or Google ads to a Shopify store, some of what you are paying for is not human. Invalid traffic (bots, automated clickers, click farms, and monitoring tools) clicks paid ads, and every click costs you whether or not a person was behind it. This post explains how to tell real traffic from invalid traffic, why the ad platforms do not fully protect you, and how to block the junk at your own store. ## Where fake ad clicks come from "Bot clicks" is a catch-all for several distinct sources, and they show up in different ways: - **Automated click bots.** Scripts that click ads at scale, sometimes to drain a competitor's budget, sometimes as part of ad-fraud schemes that profit from the clicks. They run from datacenters and proxy pools. - **Click farms.** Real devices operated in bulk to generate clicks. Harder to spot than pure bots, but they still cluster on shared networks and behave nothing like a shopper. - **Competitor monitoring.** Tools that repeatedly load your ads and landing pages to track your promotions and creative. Fixed-interval, datacenter-sourced, and never converting. The same behavior we cover in [stopping competitor price scraping](/blog/stop-competitors-scraping-shopify-prices). - **Scrapers following ad links.** Crawlers that harvest landing pages and offers, arriving through the same ad click you paid for. All of them share one property: they cost you money on the click and give you nothing on the other side. ## How to tell if bots are clicking your ads You do not need a tool to form a strong suspicion. Look for a gap between traffic and behavior: | Signal | What real shoppers do | What invalid traffic does | |---|---|---| | Session duration | Seconds to minutes, varied | Under 2 seconds, uniform | | Add-to-cart rate | Some fraction convert | Near zero | | Network | Mobile carriers, home ISPs | Datacenter ASNs, proxies | | Geography | Your target regions | Regions you do not target | | Bounce rate | Mixed | Close to 100 percent | | Timing | Spread across the day | Bursts at fixed intervals | If your click volume is healthy but add-to-carts are flat, and a chunk of the sessions come from datacenter networks or a country you never targeted, you are paying for bots. The [bot traffic guide](/blog/shopify-bot-traffic-how-to-spot-and-stop) goes deeper on reading these signals in your analytics. ## Why Meta and Google do not fully protect you The ad platforms do filter some invalid traffic, and they occasionally credit it back. But their filtering has two structural gaps you cannot close from inside their dashboards: 1. **It is imperfect and delayed.** Sophisticated bots and click farms slip through, and any credit arrives long after the spend, if it arrives at all. 2. **It does not clean your store-side data.** Even when a platform later flags a click as invalid, that bot already loaded your landing page, fired your pixel, and may have entered a retargeting audience. Your conversion data and lookalike audiences are now polluted, which teaches the algorithm to chase more of the same junk. You cannot fix either from the ad account. You fix them at the store, by ending the invalid session as soon as it arrives. ## Why blocking at the store helps your ad performance This is the part merchants underestimate. Blocking bot traffic is not only about the wasted click cost. It is about the data quality that drives your campaigns: - **Cleaner pixel signal past the first hit.** Be precise about what a storefront blocker can and cannot do here. The click is already paid for, and the landing page loads, so the initial pageview still fires. What stops is everything after it: no product views, no add-to-carts, no checkout starts from that session, because the visitor is looking at a block screen instead of your store. Those deeper events are the ones the ad platforms optimize hardest on. - **Cleaner retargeting.** Audiences built on "viewed product" or "added to cart" stop filling up with traffic that was never going to buy, so you stop paying to chase it. - **Truer metrics.** Once the junk sessions stop generating funnel events, your real landing-page conversion rate becomes visible and you can judge creative and offers on it. Worth being clear about the ceiling: no Shopify app can refund the click or stop the first pageview, because Shopify serves the page and does not let an app sit in front of that request. What a blocker changes is what the bot gets to do next. ## How to block fake ad traffic with Cordon 1. **Install Cordon** from the [Shopify App Store](https://apps.shopify.com/cordon) and enable the app embed in your theme. It is a theme app extension, so no script tags and no code edits. 2. **Turn on bot and datacenter blocking.** This is on the free plan and catches confirmed automation and traffic from hosting networks like AWS, Google Cloud, and Alibaba, where no real shopper browses from. 3. **Add proxy and Tor detection if your junk traffic is anonymized.** Click bots often route through residential proxies to look like real users. The [Growth plan](/pricing) adds VPN, proxy, and Tor detection at $19 per month. 4. **Block regions you never advertise to** if a burst of clicks comes from a country outside your targeting. Country rules are on the free plan. 5. **Watch the live visitor log during a campaign.** You will see the blocked bot sessions with the reason, which also tells you what type of invalid traffic you are getting. IPs are SHA-256 hashed with a daily-rotating salt. 6. **Compare landing-page conversion before and after.** With the junk removed, the real rate is what remains. Cordon blocks confirmed automation and network-level signals, not ordinary shoppers, and it fails open, so if detection ever hiccups your paid traffic still reaches the store. That last point matters when real ad spend is on the line. ## Will this block Googlebot or hurt my SEO? No. Verified search engine crawlers are always allowed, checked against their real networks before any bot rule runs. Blocking invalid ad traffic and staying fully indexable are independent. Details are in [do bot blockers hurt SEO?](/blog/do-bot-blockers-hurt-seo) ## Frequently asked questions ### How do I know if bots are clicking my Shopify ads? The tell is a gap between traffic and behavior. High click volume with near-zero add-to-carts, sessions under two seconds, a spike in visits from datacenter networks or a region you do not target, and a bounce rate close to 100 percent all point to invalid traffic rather than real shoppers. If your clicks are healthy but nobody adds to cart, you are likely paying for bots. ### Does blocking bot clicks get me refunds from Meta or Google? Sometimes, but do not count on it. The ad platforms filter some invalid traffic and occasionally credit it, but their filtering is imperfect and slow. Blocking the traffic at your store means you stop paying for the wasted landing-page sessions and keep your pixel and retargeting data clean, regardless of what the platform refunds. ### Will blocking bot traffic hurt my ad performance or pixel? It improves both. Bot sessions pollute your conversion data and retargeting audiences, which teaches the ad algorithm to chase junk. Removing them gives the platform cleaner signals to optimize on. Cordon blocks the visit on load, so a bot session stops at the block screen instead of generating product views, add-to-carts, and checkout starts. The first pageview still fires; everything the platforms optimize on hardest does not. ### Can this block real customers who click my ads? Not if it is tuned correctly. Cordon blocks confirmed automation, datacenter networks, and high-risk proxies, not ordinary shoppers on mobile or home connections. It also fails open, so if detection ever hiccups your ad traffic still reaches the store. ### Which Cordon plan should I use for ad-click protection? Bot and datacenter blocking is on the free plan, which covers most invalid ad traffic. If your junk runs through VPNs and residential proxies, the Growth plan at $19 per month adds proxy and Tor detection. Every paid plan has a 7-day free trial. ## Wrapping up Every click on your ad costs money, and a real share of those clicks are bots, click farms, and monitoring tools that will never buy. The ad platforms will not fully protect you, and they cannot clean your store-side data. Blocking invalid traffic at the store stops the wasted spend and gives your pixel real signals to learn from. [Try Cordon on the Shopify App Store](https://apps.shopify.com/cordon). Bot and datacenter blocking is free, proxy detection is on every paid plan with a 7-day free trial, and full details are on the [pricing page](/pricing). --- # How to Block Tor Traffic on Shopify (2026) Published 2026-07-19 by Bas Lefeber. Canonical: https://usecordon.com/blog/how-to-block-tor-traffic-shopify > **TL;DR:** Shopify cannot block Tor on its own. Tor exit nodes are a small share of real shopping traffic but a large share of card testing and abuse, and unlike consumer VPNs, almost nobody browses a normal store over Tor by accident. That makes Tor one of the few networks you can safely block with a blanket rule. [Cordon](https://apps.shopify.com/cordon) treats Tor as high-risk by default and blocks it on page load, while still verifying and allowing Googlebot. Tor is the anonymity network built to make a visitor untraceable. Some people use it for legitimate privacy. On an ecommerce store, the traffic that arrives over Tor skews heavily toward fraud, because it is the strongest way to hide who and where you are. This guide explains why Tor shows up in your logs, why it is safe to block, and how to do it on Shopify in 2026. ## Why Tor traffic hits your store You did not do anything to attract it. Tor traffic finds stores because: - **Card testing wants maximum anonymity.** A fraudster testing stolen card numbers wants zero traceability, and Tor provides more of it than a VPN. When card testing runs over Tor, each attempt can come from a different exit node. - **Banned users come back invisible.** Someone you blocked for refund abuse or chargebacks can return over Tor with no way to tie them to the old identity. - **Scrapers and probes hide origin.** Automated tools that probe your endpoints or scrape your catalog sometimes route through Tor to avoid a simple IP block. The common thread: people use Tor on a store when they specifically do not want you to know who they are. On a storefront selling physical goods, that is rarely a good customer. ## Why Tor is safe to block (when a VPN is not) This is the key point that separates Tor from VPN blocking. Blocking every VPN is risky because millions of ordinary customers use consumer VPNs and iCloud Private Relay. Tor is different in two ways: 1. **The exit nodes are published.** Tor's exit node list is public and updated continuously, so a good blocker knows with high confidence when a request comes from Tor. There is very little guesswork and almost no false positives. 2. **Almost nobody shops over Tor by accident.** Tor is slow and deliberate. People do not casually browse a boot store over Tor the way they leave a VPN running. The real-customer cost of blocking it is close to zero for most stores. That combination, high confidence plus low collateral damage, is why Tor is one of the few networks you can block with a blanket rule and not worry about it. For VPNs you want a [risk threshold](/blog/how-to-block-vpn-on-shopify); for Tor, an outright block is usually the right call. ## What Shopify does about Tor (nothing) Shopify has no Tor setting. It does not evaluate whether a visitor arrived over Tor, a VPN, or a plain home connection. Shopify fraud analysis may raise the risk score on an order that a Tor visitor eventually places, but that happens after the order exists, once the authorization has already hit your processor. Nothing on the platform stops the Tor visit from reaching your storefront and checkout. To block it before that point you need an app that recognizes Tor exit nodes in real time. ## How to block Tor on Shopify with Cordon Tor blocking is part of the same anonymized-traffic detection as VPN and proxy blocking, so if you already block one, adding Tor is a toggle. 1. **Install Cordon** from the [Shopify App Store](https://apps.shopify.com/cordon) and enable the app embed in your theme. It is a theme app extension, so no script tags and no theme code edits. 2. **Upgrade to Growth or above** if needed. Tor, VPN, and proxy detection starts on [Growth](/pricing) at $19 per month, with a 7-day free trial. 3. **Enable proxy and Tor blocking**, or apply the Anti-scraper preset, which switches on the anonymized-traffic signals including Tor. 4. **Customize the block screen** so a blocked visitor sees your message rather than a raw error. 5. **Allowlist any exceptions.** This is rare for Tor, but if you have a specific reason to let a known address through, allowlist entries win over every rule. 6. **Check the live visitor log.** Blocked Tor visits show up with the reason, so you can confirm the rule is doing what you expect. IPs are SHA-256 hashed with a daily-rotating salt. ## Will this affect SEO or Googlebot? No. Cordon verifies crawlers against their real networks before any Tor rule runs, so Googlebot, Bingbot, and the crawlers that feed AI search are always allowed. Google does not crawl over Tor, so blocking Tor and staying fully indexable are not in tension. If you want the detail on how crawler verification protects rankings, see [do bot blockers hurt SEO?](/blog/do-bot-blockers-hurt-seo) ## Tor is one layer, not the whole fence Blocking Tor closes the most anonymous route into your store, but a determined fraudster who finds Tor blocked will try a VPN or a residential proxy next. That is why Tor blocking sits alongside [VPN and proxy detection](/blog/vpn-proxy-checkout-fraud-shopify), [country rules](/blog/how-to-block-a-country-on-shopify), and [bot detection](/blog/shopify-bot-traffic-how-to-spot-and-stop) in one policy rather than being treated as a complete solution on its own. The [feature list](/features) shows how the signals combine. ## Frequently asked questions ### Is it safe to block all Tor traffic on a store? For most stores, yes. Tor is a tiny fraction of real shopping traffic and a large fraction of card testing and abuse. Unlike a VPN, almost nobody browses a normal storefront over Tor by accident, and the exit-node list is published, so false positives are rare. Blocking it outright rarely costs a real sale, which is why Tor is one of the few networks safe to block with a blanket rule. ### How is blocking Tor different from blocking a VPN? Tor exit nodes are published and identifiable, so they can be blocked with high confidence and little collateral damage. Consumer VPNs are used by plenty of ordinary customers, so blocking them needs a risk threshold to avoid losing real shoppers. That is why Cordon treats Tor as high-risk by default while scoring VPN traffic more carefully. ### Can I block Tor without blocking Googlebot? Yes. Cordon verifies crawlers against their real networks before any Tor or proxy rule runs, so Googlebot, Bingbot, and other verified crawlers are always allowed. Google does not crawl over Tor, so there is no conflict between blocking Tor and staying fully indexable. ### Does Shopify block Tor by default? No. Shopify has no setting that detects or blocks Tor exit nodes. Shopify fraud analysis may flag a resulting order after it is placed, but nothing on the platform stops a Tor visit from reaching your storefront or checkout in the first place. ### Which Cordon plan includes Tor blocking? Tor detection is included alongside VPN and proxy blocking on the Growth plan at $19 per month for 100k visitors, and on every plan above it. Every paid plan has a 7-day free trial. ## Wrapping up Tor is the clearest case in traffic filtering: high-confidence detection, almost no real customers to lose, and a heavy fraud skew. Shopify cannot block it, so the fix is an app that recognizes Tor exit nodes and blocks the visit. [Try Cordon on the Shopify App Store](https://apps.shopify.com/cordon). Tor, VPN, and proxy blocking are on every paid plan with a 7-day free trial, and the free plan covers country and bot blocking. See the [pricing page](/pricing) for details. --- # Shopify Store Security: A 2026 Checklist Published 2026-07-19 by Bas Lefeber. Canonical: https://usecordon.com/blog/shopify-store-security-checklist > **TL;DR:** Shopify secures the platform: infrastructure, hosted checkout, and PCI compliance. You are responsible for everything you control: your admin account, staff permissions, the apps you install, the customer data you hold, and the traffic you let reach your store. This is a practical 2026 checklist across all of those layers, with an honest note on where each responsibility actually sits. [The free scan](/scan) covers the externally visible half of this checklist automatically, with no install. Merchants ask "is Shopify secure" and the honest answer is "the parts Shopify runs are, and the parts you run are up to you." Shopify handles the hard infrastructure and payment security. It cannot choose a strong password for you, decide which apps to trust, or judge who should reach your storefront. This checklist covers the layers a merchant actually controls, in the order they matter. ## The division of responsibility Before the checklist, get the mental model right. Security on Shopify is shared. Shopify owns the platform; you own your side of it. | Layer | What it covers | Who owns it | | --- | --- | --- | | Infrastructure | Servers, network, uptime, platform patching | Shopify | | Checkout and PCI | Hosted checkout, card data handling, PCI DSS Level 1 | Shopify | | Account and access | Passwords, two-factor auth, who can log in | You | | Staff permissions | What each staff and collaborator can see and do | You | | App hygiene | Which apps are installed and what they can access | You | | Data and privacy | What customer data you hold and how you handle it | You | | The perimeter | Who reaches your storefront (bots, fraud, abuse) | You | Shopify documents its platform-side commitments in [Shopify's help center](https://help.shopify.com). Everything in the "You" rows is what the rest of this post is about. ## 1. Account and access This is the layer attackers hit first, because it is the cheapest. A stolen or reused password with no second factor is how most store takeovers start. - **Use a strong, unique password** for your Shopify admin. Unique matters as much as strong: a password reused from a site that later gets breached is a working key to your store. A password manager makes this practical. - **Turn on two-factor authentication** on the admin, and require it for every staff member. Prefer an authenticator app or a hardware security key over SMS, since SMS can be intercepted through SIM swapping. - **Review who has access regularly.** People leave, agencies finish projects, freelancers move on. Each of those is a live door until you close it. Two-factor authentication on every account is the single highest-value item on this entire list. If you do nothing else today, do that. ## 2. Staff permissions and collaborators Not everyone who works on your store needs full admin. Least privilege means each person gets exactly the access their job requires and nothing more. 1. **Give each staff member only the permissions their role needs.** A fulfillment person does not need to edit payment settings. A content editor does not need customer export. 2. **Remove ex-staff immediately.** When someone leaves, delete their account the same day. A dormant account with admin rights is a liability that produces no benefit. 3. **Audit collaborator access.** Agencies and Shopify Partners request collaborator access to work on your store. Review the list periodically and revoke access for anyone whose work is finished. 4. **Prefer named accounts over shared logins.** Shared credentials remove accountability and cannot be revoked for one person without disrupting everyone. Give each person their own account. The point is not distrust. It is that fewer people with high access means fewer accounts an attacker can target and fewer ways a mistake becomes a breach. ## 3. App hygiene Every app you install with admin access can read or change data according to its scopes. That makes each app part of your attack surface. A well-run store keeps that surface small. - **Audit your installed apps.** Open your app list and ask, for each one, "do I still use this, and does it need the access it has?" Stores accumulate apps from abandoned experiments that keep their permissions long after anyone opens them. - **Remove apps you no longer use.** An unused app is pure risk: no benefit, full access. Uninstalling it revokes its scopes. - **Prefer apps that request minimal permissions.** When you install something, look at what it asks for. An app that requests broad access it clearly does not need is a flag. Good apps practice scope minimization and ask only for what they use. - **Watch for apps that inject script tags** into your storefront, since those run on your customers' browsers. Modern, well-built apps use theme app extensions instead, which are sandboxed and reviewable. The principle: every integration is a trust decision. Fewer, better-scoped apps is a more secure store than a pile of half-used ones. ## 4. Checkout and payment This is the layer where Shopify does the heavy lifting, and you should let it. Shopify hosts and secures checkout and is PCI DSS Level 1 compliant, which means card data is handled on Shopify's infrastructure and never touches yours. You do not build or secure the payment page. What remains yours is the fraud decisions around orders: - **Use Shopify's built-in fraud analysis.** It scores orders for risk signals like billing and shipping mismatches and flags high-risk orders for review before you fulfill. - **Enable 3-D Secure where available.** It adds an authentication step on the payment and can shift liability on authenticated transactions, at the cost of some checkout friction. - **Review high-risk orders before fulfilling.** The flags exist to be acted on. A flagged order shipped without a glance is the flag wasted. Fraud analysis acts after an order exists, which is why it pairs well with visit-level prevention. The full timing argument is in [our chargebacks post](/blog/reduce-chargebacks-shopify-block-fraud-traffic). ## 5. Data and privacy You hold customer data (names, addresses, emails, order history, and for EU visitors, IP addresses count as personal data). Holding it is a responsibility, not just an asset. - **Know what you hold and where it goes.** List the customer data your store collects and which apps and vendors receive it. You cannot protect data you have not mapped. - **Have a privacy policy**, and for EU customers, a data processing agreement (DPA) with the vendors that process personal data on your behalf. This is a legal requirement under GDPR, not a nicety. - **Minimize retention.** Data you do not keep cannot leak. Delete what you no longer need, and prefer vendors that hash or truncate sensitive fields rather than storing them raw. Privacy and security overlap here: the less sensitive data you retain, and the fewer places it sits, the smaller the damage from any single breach. ## 6. The perimeter: who reaches your store at all This is the layer most security checklists skip, and it sits before all the others. Every layer above assumes traffic has already arrived. The perimeter is about deciding who reaches your storefront in the first place. The traffic hitting a Shopify store is not all customers. A large share is automated: bots probing forms, scrapers copying your catalog and prices, headless clients testing stolen credentials, and fraud traffic hiding behind VPNs, proxies, and datacenter networks. None of that is a shopper, and filtering it before it reaches your store reduces automated abuse, reconnaissance, and the noise your other defenses have to sift through. This is where Cordon fits, and it fits as one layer among several. It filters traffic at the visit: blocking by country, IP or CIDR range, whole ASN, VPN/proxy/Tor, bots and scrapers, and datacenter networks like AWS, Alibaba, Tencent, and Huawei Cloud. Verified search engines are always allowed, allow rules always win over block rules, and the decision runs in under 50 milliseconds and fails open on any outage so it never blocks real customers during a hiccup. Specific patterns have their own guides: [content scraping](/use-cases/stop-content-scraping), [VPN and proxy checkout fraud](/use-cases/block-vpn-checkout-fraud), and [blocking abusive countries](/use-cases/block-traffic-by-country). Be clear about what this layer is and is not. It filters traffic. It does not manage your passwords, your two-factor auth, your staff permissions, or your app scopes. Traffic filtering is the perimeter, not the whole castle. It reduces the volume of automated abuse reaching your store; it does not replace any of the five layers above it. ## The full checklist at a glance | Layer | What to do | Owner | | --- | --- | --- | | Account and access | Strong unique passwords, 2FA on every account, review access | You | | Staff permissions | Least privilege, remove ex-staff, audit collaborators | You | | App hygiene | Audit apps, remove unused, prefer minimal scopes | You | | Checkout and payment | Use fraud analysis, enable 3-D Secure, review flags | Shopify hosts, you decide | | Data and privacy | Map data, privacy policy and DPA, minimize retention | You | | Perimeter (traffic) | Filter bots, scrapers, proxy fraud, abusive networks | You | | Infrastructure and PCI | Nothing: Shopify runs this | Shopify | Work top to bottom. The account and access layer stops the most common takeover for the least effort. The perimeter layer is the one most merchants have never set up at all. ## Frequently asked questions ### Is Shopify secure? Yes, at the platform level. Shopify is PCI DSS Level 1 compliant, hosts and secures checkout, and runs the infrastructure. What Shopify cannot secure for you is your admin account, your staff permissions, the apps you install, and the traffic you allow in. Those are the merchant's responsibility. ### What is the single most important Shopify security step? Turn on two-factor authentication for your admin account and every staff account, using an authenticator app or security key rather than SMS. A stolen admin password with no second factor is the most common way a store gets taken over. ### Do installed apps affect my store's security? Yes. Every app you grant admin access to can read or change whatever its scopes allow, so each one is attack surface. Audit your installed apps, remove ones you no longer use, and prefer apps that request only the permissions they actually need. ### Does Shopify handle PCI compliance for me? For payments processed through Shopify's hosted checkout, yes. Shopify is PCI DSS Level 1 compliant and card data is handled on its infrastructure, not yours. You are still responsible for the rest of your security: accounts, apps, staff access, and data handling. ### Where does traffic filtering fit in a security checklist? It is the perimeter layer that most checklists skip: deciding who reaches your storefront at all. Filtering bots, scrapers, proxy fraud, and abusive networks reduces automated abuse and reconnaissance. It is one layer among several, not a replacement for account, app, and checkout security. --- Most of this checklist costs nothing but attention: turn on 2FA, prune your apps, tighten staff access, review flagged orders. If the perimeter layer is the gap in your setup, [Cordon](https://apps.shopify.com/cordon) handles traffic filtering as one part of a fuller security posture. It is a theme app extension, decides in under 50 milliseconds, and has a 7-day free trial on paid plans. Start with the free plan and the [feature list](/features) if you want to see what the traffic layer actually filters. --- # Stop Fake Account Signups and Form Spam on Shopify Published 2026-07-19 by Bas Lefeber. Canonical: https://usecordon.com/blog/stop-fake-account-signups-form-spam-shopify > **TL;DR:** Fake account signups and newsletter spam are not a form problem, they are a traffic problem. Nearly all of it is automated bulk running from datacenters and proxies at machine speed, carrying headless or scripted-client fingerprints. Block that traffic before it reaches the form and most of the volume disappears without adding a captcha in front of real customers. A targeted attacker on residential IPs at human pace can still slip a few through, so treat this as removing the bulk, not achieving zero. You wake up to fifty new customer accounts overnight, all with junk email addresses, none with an order. Your contact form is full of gibberish. Your newsletter list gained hundreds of subscribers you did not earn. This post explains what is actually happening, why captcha alone does not fix it, and how blocking the traffic before it hits the form removes most of the problem. ## The symptoms, and what they mean The pattern is consistent across stores: - A flood of new customer accounts with junk or randomized email addresses, created in bursts, none of which place an order. - Newsletter and contact forms filling with spam submissions faster than any human types. - Your email tool's list polluted with fake and malformed addresses that never open anything. - Sudden spikes in account creation activity with zero matching sales. None of this is a real audience discovering your store. It is automated software submitting your forms. The tell is the shape of the traffic: it arrives in bursts, at machine speed, from network origins no real shopper uses. ## Why bots target your signup and newsletter forms There is no single motive, but the common ones all run at scale. **Testing stolen email lists.** A bot has a list of email and password pairs from some unrelated breach. It submits them to signup or login forms across thousands of sites to see which ones are valid and reused. Your form is a free validity checker. **Seeding spam.** Contact and newsletter forms that echo submitted content, or that trigger a confirmation email, get abused to relay spam or to send confirmation emails to victims (your store becomes the unwitting sender). **Abusing welcome discounts.** If signing up grants a first-order discount code, a bot farms codes by creating accounts in bulk, then resells or reuses them. Some of this is broad, untargeted internet spam that sprays every form it can find. Some of it targets your store specifically, usually when you run a discount or a drop. The broad kind is easier to stop because it does not adapt to you. ## What Shopify and your email tool already give you Shopify applies some spam protection on its own forms, and it can show a captcha challenge on certain flows. Your email platform has its own filtering and sometimes double opt-in. These help, and you should have them on. Details are in [Shopify's own help documentation](https://help.shopify.com). They are not complete, for two honest reasons. Captcha adds friction: every real customer pays a small tax to prove they are human, and abandonment goes up. And advanced bots now solve captchas cheaply through solver services, so captcha filters the lazy bots and waves the funded ones through. Double opt-in keeps fake addresses off your active list but does nothing about the volume of junk submissions hitting your forms in the first place. Captcha is a challenge at the form. The complementary approach is to remove the traffic before it ever reaches the form. ## The traffic-level angle Here is the useful fact: most form-spam bots share a profile. They run from datacenters (rented cloud servers) or hide behind proxies. They hit forms at a speed no human hand can match. And they present headless or scripted-client fingerprints, because they are automation, not a real browser driven by a person. Each of those is detectable at the visit, before the form loads. If you filter on those signals, you remove the automated bulk without asking a single real customer to solve anything. The customer never sees a challenge because they were never suspect. The bot never reaches the form because it was blocked at the door. ## The detection layers applied to signups Four layers do most of the work against form spam. Each catches a different part of the automated population. | Layer | What it catches | Why it applies to signups | | --- | --- | --- | | Headless markers | Browsers driven by automation frameworks, not a person | Bulk signup bots are scripted browsers or raw HTTP clients, not humans clicking | | Request velocity | Submissions arriving faster than a human could type | Form farming cycles through submissions far faster than any real signup flow | | Datacenter ASN blocks | Visitors from AWS, Alibaba, Tencent, Huawei Cloud and similar hosts | Nobody signs up for a newsletter from a rented server; that is a script | | VPN / proxy detection | Traffic hiding its real origin behind anonymizing networks | Bulk abusers rotate proxies to dodge per-IP limits and to mask their source | **Headless markers** identify browsers that are being driven by software rather than a person. Real signup traffic comes from real browsers with a human behind them. Automation frameworks leave detectable traces. **Request velocity** catches the pattern of automation itself. A person filling a signup form does it once, slowly. A farming script does it hundreds of times a minute. Velocity detection flags that independent of where the traffic originates, which matters because sophisticated bots rotate IPs to defeat per-address limits. **Datacenter ASN blocks** cover entire hosting providers with one rule. A visitor arriving from a cloud provider's address range is not a shopper, it is a server. Blocking by ASN removes the whole range at once. The [ASN explainer](/blog/what-is-an-asn-block-bad-bots) covers how this works. **VPN and proxy detection** catches abusers who route through anonymizing networks precisely to hide and to rotate. Applied with a risk threshold, it blocks high-risk proxy exits while letting low-risk privacy services through. Cordon applies all four on the visit itself, decides in under 50 milliseconds, and fails open if the detection service is ever unavailable, so a hiccup never blocks a real signup. Verified search engines like Google and Bing are always allowed and cannot be blocked, verification being network-level via reverse DNS, so this never touches indexing. ## The deliverability cost is the expensive part Fake signups are not just clutter. They cost money in two ways that compound. First, your sender reputation. When your list fills with fake, malformed, and trap addresses, your emails to them bounce or draw spam complaints. Mailbox providers watch your bounce and complaint rates. High rates lower your sender reputation, and once that drops, your legitimate emails to real customers start landing in the spam folder. You paid to build an audience and then quietly lost the ability to reach it. Second, direct cost. Most email platforms price per contact or per subscriber. Every fake address on your list is a line item you pay for every month, sending to people who do not exist. A list padded with bot signups inflates your bill while lowering your engagement metrics, which many platforms also use to throttle your sending. Blocking the bots at the visit protects both: fewer fake addresses enter the list, so your reputation and your bill both stay clean. ## Clean up and prevent: a step-by-step 1. **Audit recent signups.** Look at accounts created in the last few weeks. Cluster by creation time and email pattern. Bursts of similar or randomized addresses with no orders are your bot population. Note when the spikes happened; they often line up with a promotion or drop. 2. **Enable bot and headless detection.** Turn on bot detection (free plan) so headless and scripted clients are stopped before the form. Cordon targets confirmed automation, not loose heuristics, so real browsers pass. 3. **Turn on datacenter blocking.** No real customer signs up from a cloud server. Datacenter network blocking (AWS, Alibaba, Tencent, Huawei Cloud) on the Pro plan removes that whole population. The Anti-scraper preset bundles the common hosting ranges. 4. **Add VPN and proxy blocking if abuse persists.** For stores hit by proxy-rotating farmers, VPN and proxy detection (Growth, [$19 per month](/pricing)) closes the rotation trick. Use the risk threshold so privacy services like iCloud Private Relay still pass. 5. **Keep verified good bots allowed.** Do nothing here; Cordon allows verified search engines and good bots by default and they cannot be blocked. Your indexing and previews stay intact. 6. **Watch the visitor log for a week.** Cordon's live log shows country, ASN, and which rule fired for each blocked visit (IPs are SHA-256 hashed with a daily-rotating salt, so it is GDPR-safe). Confirm the blocks look like automation, not customers, and adjust with allow rules if needed. Allow rules always win over block rules. ## What this will not do Plainly: this removes the automated bulk, which for most stores is the overwhelming majority of fake signups and form spam. It does not stop a determined, targeted attacker who runs from residential IP addresses, one submission at a time, at human pace, in a real browser. That traffic looks like a customer because it is deliberately built to. For that residual, double opt-in on your email tool and manual review of suspicious accounts are the right tools. The goal is not zero. It is cutting the flood down to a trickle you can actually manage, without putting a captcha in front of every real customer who wants to sign up. ## Frequently asked questions ### Why is my Shopify store getting fake account signups? Almost all of them are bots. They harvest signup and newsletter forms to test stolen email lists, seed spam, or farm welcome discount codes. Most run from datacenters or proxies at machine speed, which is what makes them identifiable and blockable before they reach the form. ### Does captcha stop form spam on Shopify? Captcha helps against basic bots and Shopify applies some spam protection on its own forms, but it adds friction for real customers and advanced bots now solve captchas cheaply. Blocking automated traffic at the visit removes the bulk without asking every shopper to prove they are human. ### How do fake signups hurt my email deliverability? Fake accounts fill your list with junk and trap addresses. Sending to them raises bounce rates and spam complaints, which lowers your sender reputation, so your real emails start landing in spam. Many email tools also price per contact, so fake addresses cost you money directly. ### Can Cordon block bot signups without blocking real customers? Yes, for the automated bulk. It targets confirmed automation signals (headless markers, request velocity, datacenter ASNs, high-risk proxies) and always lets verified search engines and allowlisted visitors through. A determined attacker on residential IPs at human pace can still get a few through. ### Which Cordon plan do I need to stop form spam? Bot detection is on the free plan. VPN and proxy blocking starts on Growth at $19 per month, and datacenter network blocking (AWS, Alibaba, Tencent, Huawei Cloud) starts on Pro at $49 per month. Every paid plan has a 7-day free trial. --- If your signups spike without matching orders and the accounts share a pattern (junk addresses, datacenter ASNs, bursts at machine speed), the fix is to stop that traffic before it reaches the form. [Cordon on the Shopify App Store](https://apps.shopify.com/cordon) installs as a theme app extension, decides in under 50 milliseconds, and has a 7-day free trial on every paid plan. See the [full feature list](/features) or the [bot traffic guide](/blog/shopify-bot-traffic-how-to-spot-and-stop) for the detection detail. --- # Disable Right-Click and Protect Images on Shopify Published 2026-07-18 by Bas Lefeber. Canonical: https://usecordon.com/blog/disable-right-click-protect-images-shopify > **TL;DR:** Disabling right-click on Shopify stops a curious human from saving one image and nothing more. Scrapers never right-click: they fetch your image URLs and product JSON directly over HTTP, so the block never touches them. Casual deterrent is a browser trick; stopping competitors cloning your catalog is a network problem that needs scraper detection. [Cordon](https://apps.shopify.com/cordon) handles the network side. "How do I disable right-click on Shopify" is one of the most searched merchant questions, and it usually comes from a real fear: a competitor cloning your product photos. The honest answer is that right-click blocking does almost nothing about that fear. This post explains exactly what it does, who it stops, and what you actually need if the real worry is copycats lifting your catalog wholesale. ## What right-click blocking actually does Right-click blocking is a small piece of JavaScript that runs in the visitor's browser. It listens for the context-menu event (the menu that appears when you right-click) and cancels it. Fancier versions also block drag-and-drop saving and the keyboard shortcuts for copy and save. Some Shopify themes ship it as a toggle, and several "content protection" apps bundle it. That is the whole mechanism. It changes what one specific human interaction does inside one browser session. It does not encrypt, hide, or remove anything. Your images are still served at their normal URLs, and the browser still downloaded every one of them to render the page. ## Why it is mostly theater The problem is that right-click is only one of many ways to get an image, and it is the only one this trick blocks. - **View source and dev tools.** Every image URL is right there in the page HTML and the network tab. Two clicks in developer tools and the file is open in a new tab. - **Screenshots.** The operating system's screenshot tool does not care what JavaScript says. - **Disable JavaScript.** Turn JS off and the context-menu block never loads, but the images still do. - **The images are already downloaded.** By the time you see the page, your browser has fetched and cached every image. It is sitting on disk. And here is the part that matters most for the real fear. **Automated scrapers never right-click.** A scraper is a script, not a person with a mouse. It requests your product page or your `/products.json` feed over HTTP, reads the image URLs out of the response, and downloads the files directly. There is no context menu in that flow. The right-click block is JavaScript that only runs when a human interacts with a rendered page, and the scraper is neither human nor rendering the page. The defense and the threat never meet. ## Who each approach actually stops It helps to be blunt about which visitor each tool touches. | | Right-click blocking (browser) | Network-level scraper blocking | |---|---|---| | Casual human saving one image | Deters (they can still screenshot) | Not the target | | Human using dev tools or view-source | Does nothing | Not the target | | python-requests or curl hitting /products.json | Does nothing (no browser runs the JS) | Blocked on velocity and datacenter ASN | | Scrapy crawling your whole catalog | Does nothing | Blocked on velocity, UA, and ASN | | Headless Chrome / Puppeteer clone bot | Does nothing | Blocked on headless markers and velocity | | Competitor cloning your catalog wholesale | Does nothing | This is exactly what it stops | The pattern is clear. Right-click blocking sits entirely in the "casual human" column. Everything that steals catalogs and images at scale lives in the rows below it, and none of those rows are affected by a context-menu trick. ## So who steals images at scale, and how The real threat is not a shopper with a mouse. It is tooling. **python-requests or curl** hitting `/products.json` in a loop is the simplest version. No browser, no JavaScript, just HTTP requests pulling your catalog including image URLs. **Scrapy**, the industrial scraping framework, handles pagination and rotation and can crawl your whole sitemap in minutes. **Headless browsers** like Puppeteer and Selenium drive a real Chrome with no visible window, used when a target already blocks the simpler tools. All of it typically runs from datacenter networks: AWS, Alibaba Cloud, Tencent, Huawei Cloud, and the long tail of VPS providers. The output feeds copycat stores: your photos, your descriptions, your catalog, reposted under a different brand running ads against your keywords. We cover the full mechanics in [stop scrapers stealing your Shopify product catalog](/blog/stop-scrapers-stealing-shopify-product-catalog) and on our [stop content scraping](/use-cases/stop-content-scraping) page. ## What actually stops it: network-level scraper blocking Because the threat is a script fetching URLs, the defense has to live at the network, not in the browser. Four layers do the work: - **User-agent fingerprinting** catches lazy scripts, default library user agents, and malformed headers. - **Headless-browser markers** catch Puppeteer and Selenium even when they spoof a normal browser user agent, because headless Chrome leaves detectable traces. - **Request-velocity detection** catches anything loading pages far faster than a human, regardless of what network it runs on or what user agent it claims. - **Datacenter and ASN blocking** removes the cloud servers these tools run on. Blocking a whole [ASN](/blog/what-is-an-asn-block-bad-bots) takes one rule and real shoppers are almost never on those networks. Cordon runs all four, ships an **Anti-scraper preset** that turns them on together, and makes each decision in under 50 milliseconds. Verified search engines (Google, Bing) and good bots (GPTBot, ClaudeBot, PerplexityBot, Ahrefs) are verified at the network level and always allowed, so none of this touches your SEO. If that is a concern, we wrote [do bot blockers hurt SEO](/blog/do-bot-blockers-hurt-seo) on exactly that. ## A layered image-protection checklist If protecting your images matters, stack the cheap deterrents on top of the real defense. Do them in this order: 1. **Watermark high-value product images.** A subtle brand mark makes a stolen image traceable and less useful on a copycat store. This is the only measure that survives after an image has been taken. 2. **Add a right-click deterrent, and test it.** Free, quick, and it does stop the most casual copying. Watch your analytics after turning it on, because it also blocks right-click-to-open-in-new-tab and can annoy genuine shoppers. If conversion dips, turn it off. 3. **Turn on network-level scraper blocking.** This is the layer that actually stops competitors and copycats cloning your catalog and images in bulk. Everything above it is a deterrent; this is the defense. 4. **Watch your visitor log.** Confirm which networks are hitting your image and JSON endpoints, and [block the ASNs](/blog/what-is-an-asn-block-bad-bots) that turn out to be scrapers. The log shows country, ASN, and the rule that fired, with IPs hashed for GDPR. The honest framing: if your goal is stopping a casual visitor from saving one image, a right-click blocker is fine and free. If your goal is stopping competitors from cloning your images and catalog wholesale, that is a network problem, not a browser problem, and it needs scraper detection. ## A note on bundled tools Several content-protection apps lead with right-click blocking as if it were the main event. It is not. If an app's headline feature is disabling the context menu, understand that you are buying a casual-human deterrent, not scraper protection. Securify, for example, bundles right-click tools alongside its blocking features, and we compare where that leaves you against real network-level detection in our [Cordon vs Securify comparison](/compare/cordon-vs-securify). For the wider field, see our [best Shopify bot blocker apps](/compare/best-shopify-bot-blocker-apps) roundup. ## Frequently asked questions ### How do I disable right-click on Shopify? A small JavaScript snippet disables the browser context menu and sometimes drag-and-save. Some apps and themes include it as a toggle. It deters a casual human from saving one image and does nothing against automated scrapers. ### Does disabling right-click actually protect my images? Barely. Anyone can view source, open dev tools, take a screenshot, or disable JavaScript to get the image. Scrapers never right-click at all: they fetch your image URLs and product JSON directly over HTTP, so the block never applies to them. ### Who does right-click blocking actually stop? A curious human who would have saved one image by right-clicking, sometimes. It does not stop competitors, copycats, or any automated tool cloning your catalog, because those never use the context menu. ### What actually stops competitors stealing my images at scale? Image theft at scale is a network problem, not a browser problem. Scraper detection using user-agent fingerprinting, headless-browser markers, request-velocity limits, and datacenter ASN blocking stops the tools that fetch your images in bulk. ### Should I still turn on right-click blocking? It is fine as a free, low-cost deterrent against casual copying, but test it first because it can annoy real users who right-click to open links in new tabs. Do not treat it as real protection against catalog cloning. --- Right-click blocking is a deterrent. If the real worry is competitors cloning your images and catalog, [Cordon](https://apps.shopify.com/cordon) does the network-level part: user-agent fingerprinting, headless markers, velocity limits, and datacenter ASN blocking, all decided in under 50 milliseconds with verified search engines always allowed. See [features](/features) for the full detection stack and [pricing](/pricing) to start free. --- # How to Block VPN on Shopify (2026 Guide) Published 2026-07-18 by Bas Lefeber. Canonical: https://usecordon.com/blog/how-to-block-vpn-on-shopify > **TL;DR:** Shopify has no built-in VPN block. To block VPN, proxy, and Tor traffic you need an app like [Cordon](https://apps.shopify.com/cordon) that queries live proxy detection data and blocks the visit on page load. The one thing that matters is a risk threshold: block high-risk rotating proxies and Tor, but let low-risk privacy services like iCloud Private Relay through so you do not block millions of ordinary iPhone shoppers. "How to block VPN on Shopify" is one of the most searched questions merchants ask once fraud or abuse starts, and the honest answer is that Shopify itself cannot do it. This guide covers why merchants want it, what Shopify offers (nothing, at the visit level), the realistic options in 2026, and the one setting that separates a useful VPN block from one that drives away real customers. ## Why merchants want to block VPN traffic A VPN or proxy hides where a visitor really is. That is fine for privacy, and most VPN users are honest. The problem is the minority who use anonymized connections to do things they could not do from their real IP: - **Card testing and stolen-card checkout.** A fraudster's real IP would sit in a different country than the card's billing address, so they route through a VPN to hide the mismatch. See the full pattern in [Shopify VPN fraud](/blog/vpn-proxy-checkout-fraud-shopify). - **Evading a country block.** If you [block a country](/blog/how-to-block-a-country-on-shopify), the standard bypass is a VPN endpoint in a country you allow. VPN detection closes that side door. - **Discount and refund abuse.** Discount-code farmers create dozens of accounts behind rotating IPs so per-IP limits never trigger. Banned refund abusers come back through a fresh VPN exit. - **Drop sniping.** Limited releases get hit by bots checking out through pools of thousands of residential proxies, so each purchase looks like a different household. None of this needs you to block every VPN user forever. It needs the ability to switch anonymized traffic off when it turns into a problem. ## What Shopify offers natively (nothing, at the visit level) This is short because there is not much to say. Shopify has no setting anywhere in the admin that detects a VPN, a proxy, or Tor. Shopify fraud analysis scores an order *after* it is placed, which is useful as a safety net but does not stop the anonymized visit from reaching checkout in the first place. Shopify Markets controls where you sell and ship, not who can browse. Nothing on the platform looks at whether an IP is anonymized. So if your goal is "traffic hiding behind a VPN should not be able to check out," you have to add a layer. There are two realistic ways. ## Your options compared | Option | Detects residential proxies | Stops browsing and checkout | Spares Private Relay users | Setup effort | |---|---|---|---|---| | Static IP blocklist / old app | No, misses them | Sometimes | No, blocks all relays | Medium | | Live detection app (Cordon) | Yes | Yes | Yes, via risk threshold | Minutes | | Cloudflare rules (headless only) | Partly | Yes, at the network layer | Manual | High | ### Option 1: static IP blocklists (the legacy approach) Most older blocking apps ship a downloaded list of known VPN and datacenter IP ranges. That worked when anonymizing meant renting a server on a fixed IP. It fails against modern residential proxies, which route through real home connections that look like normal customers on any static list. It also tends to block every relay it does recognize, including iCloud Private Relay, so you lose real iPhone customers. A stale list is worse than nothing because it gives you false confidence while missing the traffic that actually costs you money. ### Option 2: a live detection app (the right answer for a themed store) Cordon queries live commercial proxy detection data per visitor and caches the decision, so it catches residential proxies that static lists miss and makes the block decision on the first page load. The decision runs in under 50 milliseconds, and it is installed as a theme app extension, so there are no script tags and no Lighthouse hit. This is the correct primary mechanism for any store on a standard Shopify theme. ### Option 3: Cloudflare rules (headless stores only) If you run a headless storefront (Hydrogen or a custom front end) behind Cloudflare, you can write proxy-blocking rules at the CDN. This is powerful but out of reach for the vast majority of merchants, who do not control the proxy in front of their store. Even headless merchants usually still want the app layer for the visitor log, the risk threshold, and the block screen. ## The setting that matters most: block risk, not relays Here is the mistake that gives VPN blocking a bad name. iCloud Private Relay is switched on by default for a large share of iPhone users. It is technically a relay. A blocker that blocks "all relays" blocks those shoppers, and you never find out why your mobile conversion rate dropped. Cordon blocks on a fraud score, not on the mere fact that an IP is a relay. Low-risk privacy services (Private Relay, reputable consumer VPNs used by ordinary people) score below the threshold and pass through. High-risk exits, rotating residential proxies, and Tor score above it and get the block screen. That is the whole difference between blocking anonymized fraud and blocking everyone who cares about privacy. ## Block VPN traffic with Cordon in under 3 minutes 1. **Install Cordon** from the [Shopify App Store](https://apps.shopify.com/cordon) and enable the app embed in your theme. No code edits, no script tags. 2. **Upgrade to Growth or above** if you are on the free plan. VPN, proxy, and Tor detection starts on [Growth](/pricing) at $19 per month, with a 7-day free trial. 3. **Toggle on VPN and proxy blocking**, or start from the Anti-scraper preset, which switches on the anonymized-traffic signals for you. 4. **Leave the risk threshold at the default** unless you have a specific reason to change it. The default is tuned to pass iCloud Private Relay and block high-risk proxies. 5. **Allowlist known customers** who legitimately shop through a VPN (a wholesale buyer on a corporate network, for example). Allowlist entries win over every rule. 6. **Watch the live visitor log** for a day or two to see what got caught and why. IPs are SHA-256 hashed with a daily-rotating salt, so the log stays GDPR-safe. A pattern worth copying: leave VPN blocking off during normal trading and switch it on the moment a fraud or discount-abuse wave starts. It is one toggle, so you can react in seconds. ## Will this block Google? No. Crawler verification runs before any VPN or proxy rule. A request claiming to be Googlebot is checked against Google's real network, and verified crawlers are always allowed, unconditionally. There is no VPN setting that can touch them. A *fake* Googlebot spoofing the user agent from a proxy network fails verification and gets blocked, which is exactly what you want. We covered the mechanics in [do bot blockers hurt SEO?](/blog/do-bot-blockers-hurt-seo) ## Frequently asked questions ### Can Shopify block VPN users natively? No. Shopify has no setting that detects or blocks VPN, proxy, or Tor traffic. It does not evaluate whether a visitor's IP is anonymized at all. Blocking VPN traffic requires an app that queries live proxy detection data, or your own edge infrastructure if you run a headless store. ### Will blocking VPNs also block iPhone customers on Private Relay? Not if the blocker scores risk instead of blocking every relay. Cordon applies a fraud-score threshold, so low-risk privacy services like iCloud Private Relay pass through while high-risk rotating proxies and Tor exits are blocked. Blanket blocking of every relay is the legacy approach, and it does block iPhone shoppers, which is why VPN blocking got a bad reputation. ### Should I leave VPN blocking on all the time? Most merchants do not. Legitimate customers use VPNs too, so a common pattern is to leave it off during normal trading, switch it on when a fraud or abuse wave starts, and switch it off once the attack burns out. In Cordon it is a per-store toggle, so you can react in seconds. ### Why can't a static IP blocklist catch VPNs? Because residential proxies route traffic through real home internet connections that look like ordinary customers on any static list. A downloaded list of known VPN ranges misses them completely and may only recognize an exit for a few hours before the pool rotates it. Detection needs live commercial data that scores how an IP is behaving right now. ### Which Cordon plan includes VPN blocking? VPN, proxy, and Tor detection is included on the Growth plan at $19 per month for 100k visitors, and on every plan above it. The free plan covers country and bot blocking. Every paid plan has a 7-day free trial, so you can enable VPN blocking during a fraud wave and evaluate it on your own traffic. ## Wrapping up Shopify cannot see a VPN, so it cannot block one. The fix is a layer that queries live detection data, decides in under 50 milliseconds, and, most importantly, blocks on risk so your iPhone customers on Private Relay keep shopping. If that is what you need, [try Cordon on the Shopify App Store](https://apps.shopify.com/cordon). The free plan covers country and bot blocking, and VPN, proxy, and Tor detection is on every paid plan with a 7-day free trial. Full details are on the [pricing page](/pricing). --- # How to Stop Competitors Scraping Your Shopify Prices Published 2026-07-18 by Bas Lefeber. Canonical: https://usecordon.com/blog/stop-competitors-scraping-shopify-prices > **TL;DR:** Competitors and price-intelligence vendors run bots that poll your product pages and `/products.json` on a fixed schedule to undercut you automatically. Robots.txt does nothing and hiding prices kills conversion. Request-velocity detection, datacenter blocking, and ASN blocking catch the automated pollers and slow a determined competitor from minutes to days, which is often enough to protect a promotion. [Cordon](https://apps.shopify.com/cordon) runs all three. See it for yourself: [the free scan](/scan) pulls your own prices exactly the way a competitor would, in about fifteen seconds. If your promotions get matched within minutes of going live, or a rival is always priced one euro under you across your whole catalog, you are probably being scraped. This is not catalog theft (copying your images and descriptions wholesale). This is narrower and more mechanical: automated monitoring of your prices, on a timer, so a repricing engine can react. This post explains how it works, how to spot it in your own logs, and what actually slows it down. ## How competitor price scraping works Price monitoring is a small, well-defined job, which is what makes it so easy to automate. **A bot polls your prices on a schedule.** Either the competitor or a price-intelligence vendor they pay runs a crawler that requests your product pages and, more often, your `/products.json` endpoint. That endpoint returns a clean JSON feed of every product with its variants and current prices, no login required, so the bot does not even have to parse your HTML. The crawl runs on a fixed interval: hourly, every fifteen minutes, sometimes every few minutes on high-value SKUs. **A repricing tool consumes the feed.** The scraped prices flow into a repricing engine that compares them against the competitor's own catalog and sets their price just below yours. The whole loop is automated. No human watches your store. A price you set at 09:00 can be undercut by 09:05. **The infrastructure is predictable.** These crawlers run on servers, not phones. That means datacenter networks: AWS, Alibaba Cloud, Tencent, Huawei Cloud, and a long tail of VPS providers. Price-intelligence vendors often run from their own known network ranges. Real shoppers never browse from an AWS IP. ## Why it hurts Price scraping is not a vanity problem. It attacks margin directly. - **A race to the bottom.** If a rival auto-matches you one cent under, every price cut you make is instantly matched. You train each other downward and the only winner is the customer, at the expense of both margins. - **Your pricing strategy becomes public.** Bundle logic, psychological pricing, regional differences, and planned markdowns are all visible to anyone polling your feed. Your strategy is only as private as your `/products.json`. - **Promotions get neutralised before they work.** A flash sale is supposed to pull demand toward you for a window. If a competitor's bot sees the new price within minutes and matches it, the promotion never gets its head start. The discount cost you margin and bought you nothing. ## How to catch price scrapers in your visitor log A [live visitor log](/features) is the fastest way to confirm you are being scraped rather than guessing. Cordon's log shows country, ASN, and the rule that fired for every request, with IPs hashed for GDPR. Here is what to look for, in order: 1. **Sort by network (ASN) and count hits.** One ASN generating a large share of your traffic, especially a hosting or cloud ASN, is the strongest single signal. Shoppers arrive from hundreds of residential and mobile networks. A scraper arrives from one datacenter. 2. **Check the interval.** Line up timestamps from the same network against the same product URLs. A fixed cadence (every 15 minutes, every hour, on the dot) is a machine. Humans do not browse on a metronome. 3. **Look at the requested paths.** Repeated hits to `/products.json`, `/collections/*/products.json`, or the same handful of high-value product URLs, with nothing else (no cart, no checkout, no images loaded), is monitoring, not shopping. 4. **Read the session duration.** Near-zero dwell time means the client grabbed the data and left. A real shopper reads, scrolls, and lingers. 5. **Match the ASN to a known vendor or cloud.** If the ASN belongs to a price-intelligence company or a cloud provider you have no business relationship with, you have found your scraper. See our guide on [spotting and stopping bot traffic](/blog/shopify-bot-traffic-how-to-spot-and-stop) for the wider version of this workflow, and [what an ASN block is](/blog/what-is-an-asn-block-bad-bots) for why the network number is the right unit to act on. ## What does not work Two popular ideas fail, for reasons worth stating plainly. **Robots.txt.** It is a text file that asks crawlers to stay out of certain paths. Googlebot honors it. A commercial price scraper reads it, at most, as a map of what you consider valuable. There is no enforcement. The server serves the price whether the client obeyed the file or not. **Hiding prices behind a login.** This does stop the anonymous scraper, and it also stops every real shopper who has not created an account, which is most of them. You would trade a margin problem for a conversion catastrophe. Price gating is a B2B wholesale pattern, not a defense for a consumer store. ## What actually works The goal is not a perfect wall. It is to make monitoring expensive and slow enough that your pricing decisions get a head start. Three layers do that. | Layer | What it catches | What it misses | |---|---|---| | Request-velocity detection | Fixed-interval polling and any client loading pages far faster than a human | A scraper deliberately slowed to a human pace | | Datacenter network blocking | Bots running on AWS, Alibaba, Tencent, Huawei Cloud, and other hosting networks | Bots routed through residential proxies | | ASN blocking (specific vendor networks) | Known price-intelligence vendor networks, blocked whole with one rule | Vendors who rotate to networks you have not blocked yet | **Request-velocity detection** watches how fast a client pulls pages. A monitoring bot on a fifteen-minute timer, or one that grabs your whole catalog in seconds, does not move like a person. This layer catches the polling pattern regardless of the user agent it claims. **Datacenter and ASN blocking** removes the servers these tools run on. Most scraping originates from cloud IP ranges, and Cordon's datacenter blocking (Pro plan and up) targets exactly those networks: AWS, Alibaba, Tencent, Huawei Cloud, and similar. If you identify a specific price-intelligence vendor by ASN in your log, you can [block that whole ASN](/blog/what-is-an-asn-block-bad-bots) with a single rule. Real shoppers browse from residential and mobile networks, so the collateral damage is close to zero. Cordon ships an **Anti-scraper preset** that turns these layers on together, and every decision is made in under 50 milliseconds, so your storefront speed is untouched. Verified search engines like Google and Bing are always allowed and cannot be blocked, so this does not touch your SEO. If that worries you, we wrote up [whether bot blockers hurt SEO](/blog/do-bot-blockers-hurt-seo) separately. ## The honest limit A competitor who genuinely wants your prices can still get them. They can route through residential proxy networks so their requests look like home connections, and they can throttle their bot to a slow, human-like pace so velocity detection does not trip. That defeats the network and speed layers. But it costs them. Residential proxy bandwidth is not free, and slowing the bot from every-few-minutes to once-a-day is the whole point. A promotion that used to get matched in five minutes now gets a full day to run before the rival even sees it. For most stores, buying your pricing decisions a head start of hours or days is the actual win, not an impossible perfect block. This is the same trade-off we describe in [stopping scrapers stealing your catalog](/blog/stop-scrapers-stealing-shopify-product-catalog): raise the cost, slow the attacker, protect the window that matters. ## Frequently asked questions ### How do competitors scrape my Shopify prices? Competitors or their price-intelligence vendors run bots that poll your product pages and the `/products.json` endpoint on a fixed schedule, sometimes every few minutes. A repricing tool then reads that feed and sets their price just below yours automatically. ### Can I stop price scraping without hiding my prices? Yes. Hiding prices behind a login kills conversion for real shoppers, so that is the wrong tool. Request-velocity detection, datacenter blocking, and ASN blocking stop the automated pollers while leaving your public prices visible to actual customers and search engines. ### How do I tell if a bot is scraping my prices? Look in your visitor log for the same network hitting the same product URLs on a fixed interval, traffic from hosting or datacenter ASNs instead of home networks, near-zero session duration, and repeated hits to JSON endpoints like `/products.json`. ### Does robots.txt stop price scrapers? No. Robots.txt is a polite request that commercial scrapers ignore. Stopping a price-monitoring bot requires detecting and refusing the requests, not asking it nicely to stay away. ### Can a determined competitor still watch my prices? Yes, if they pay for residential proxies and browse at a human pace. That costs them real money and slows them from minutes to days, which is usually enough for a flash promotion to run before it gets matched. --- If competitors are matching your prices faster than your promotions can work, [Cordon](https://apps.shopify.com/cordon) gives you the visitor log to prove it and the velocity, datacenter, and ASN blocking to slow it down. It installs as a theme app extension with no script tags, makes its decision in under 50 milliseconds, and starts on a free plan. See [pricing](/pricing) for where datacenter blocking begins. --- # How to Block Checkout Bots on Shopify Drops Published 2026-07-17 by Bas Lefeber. Canonical: https://usecordon.com/blog/block-checkout-bots-shopify-drops > **TL;DR:** Checkout bots win drops with rented datacenter servers, product monitors polling every few seconds, and proxy pools that make one operator look like hundreds of buyers. Shopify's strongest native bot protections at checkout are a Plus feature, so most merchants have little platform-level control. A traffic-level blocker works earlier in the funnel: block datacenter ASNs, and catch polling velocity and headless browsers. That removes the casual bot majority before checkout even loads. If you run limited releases, you have watched this happen: the drop goes live, inventory reads zero within a minute, and the orders belong to a handful of operators, not the community you built the release for. This post explains how checkout bots actually work, what Shopify covers natively, and what you can enforce yourself at the traffic level before the next drop. ## What a botted drop looks like The damage from a botted drop is bigger than lost sales, because the sales were not lost. The units sold. Everything else broke: - **Inventory is gone in seconds**, often before real customers finish typing a shipping address. - **Real fans get nothing.** The people who follow your releases, joined the email list, and set alarms walk away empty-handed, again. - **The support inbox melts.** "Was the drop real?" "Did you hold stock back?" "Why do bots always win?" Every botted release generates a wave of tickets and public accusations. - **Resellers flip your product at markup**, and your brand absorbs the resentment for a price you never set. The customer's relationship shifts from your store to an aftermarket you do not control. One botted drop is annoying. A pattern of them trains your actual customers to stop showing up. ## How checkout bots work Knowing the machinery matters, because each component is a thing you can detect. A drop bot is not one program; it is a pipeline. | Component | What it does | Detectable signal | | --- | --- | --- | | Product monitor | Polls endpoints like /products.json every few seconds to spot the drop the instant it is live | Request velocity far above human browsing | | Automation engine | Headless browser or raw HTTP requests that add to cart and fill checkout without rendering a page | Headless markers, or no JavaScript execution at all | | Datacenter servers | Rented compute (often hosted close to Shopify's own infrastructure) for minimum latency | Hosting-provider ASN instead of a consumer ISP | | Proxy pool | Thousands of rotating IPs so one operator looks like many independent buyers | Proxy and VPN detection, shared network fingerprints | | Spoofed identity | User agents claiming to be a normal browser, or even Googlebot, to slip past naive filters | Network-level verification the spoof cannot pass | Two things follow from this table. First, speed is the bot's whole advantage, which is why they pay for datacenter hosting instead of running from home. Second, every speed optimization leaves a network-level fingerprint. The same infrastructure shows up when [scrapers clone your product catalog](/blog/stop-scrapers-stealing-shopify-product-catalog), because monitors and scrapers are often the same tools. ## What Shopify provides natively Shopify is not blind to this. The platform applies rate limiting and standard throttling to abusive request patterns, and Shopify has built platform-level bot protections for checkout. The accurate but uncomfortable detail: most of the anti-bot capability at checkout itself is a Shopify Plus feature. Plus merchants can enable stronger protections on the checkout surface; merchants on standard plans mostly cannot, and checkout is not a surface apps are allowed to modify directly. That is not a criticism of the platform. Checkout is the most sensitive path in commerce and Shopify guards who can touch it (the developer docs at [shopify.dev](https://shopify.dev) describe how constrained that surface is). But it means a standard-plan merchant running hyped releases has close to no native control over bots at the moment of purchase. Whatever you do has to happen earlier. ## What a traffic-level blocker adds before checkout The good news: earlier is a better place to fight. A bot that never reaches your product page never races your customers at checkout. This is where a traffic-level blocker like Cordon operates, and each layer maps to a component from the table above. **Datacenter ASN blocking kills the servers.** Bots rent speed from hosting providers, and hosting providers own identifiable network ranges. Blocking datacenter networks like AWS, Alibaba, Tencent, and Huawei Cloud (Cordon Pro, $49/mo and up) removes the entire hosting advantage in one rule. If you have never blocked by network before, [here is how ASN blocking works](/blog/what-is-an-asn-block-bad-bots). You can also block any specific ASN you see misbehaving, on any paid plan. **Request-velocity detection catches the monitors.** A human checks a product page a few times an hour. A monitor polls it every few seconds for days. Velocity detection flags that cadence regardless of how well the bot disguises its user agent. **Headless markers catch browser automation.** Automation frameworks driving headless browsers leave fingerprints that real browsers do not. Cordon's bot detection combines user-agent fingerprinting with those headless markers and blocks only confirmed automation, so in-app browsers and unusual real devices pass. More on separating bot traffic from human traffic in [our guide to spotting bot traffic on Shopify](/blog/shopify-bot-traffic-how-to-spot-and-stop). **Spoofed-crawler detection closes the Googlebot costume trick.** Some bots present themselves as Googlebot, betting that no merchant dares block Google. Cordon verifies search engines at the network level with reverse DNS, so real Google and Bing crawlers are always allowed (they cannot be blocked at all), and impostors claiming the name from a proxy IP fail verification and get treated as the bots they are. **Raw HTTP bots are the honest limit, for every app.** The fastest bots skip the browser entirely and speak raw HTTP. Any detection that depends on a script loading in a page cannot see them, and on a standard Shopify storefront no app can intercept a request before Shopify serves it: Shopify does not allow proxying the domain, so there is no network edge for an app to enforce at. Any vendor implying otherwise is describing something the platform does not permit. If raw HTTP bots are the bulk of your problem, report the network ranges to Shopify support; the platform is the only layer that can refuse those requests. What blocking does achieve is making the run worthless for every bot that renders your pages, which is most of them, and [scrapers move on when they stop getting results](/use-cases/stop-content-scraping). All of this runs in the request path at sub-50ms per decision and fails open if anything is down, so a detection outage can never take your drop down with it. ## Prepare your next drop: a checklist Do this in the days before the release, not the morning of. 1. **Enable the Anti-scraper preset several days early.** Cordon ships quick presets (Block China, Anti-scraper, Strict mode); Anti-scraper turns on the velocity and automation layers. Enabling early means monitors watching your store get identified before drop day, and you have time to review what got flagged. 2. **Turn on datacenter blocking (Pro and up).** This is the single highest-value rule for a drop. Legitimate buyers do not shop from an AWS instance. 3. **Allowlist your own tools.** Your fulfillment software, agency monitors, uptime checks, and any launch tooling may run from datacenter IPs. Add them as allow rules; allow rules always win over block rules, so aggressive blocking stays safe. 4. **Watch the visitor log during the drop.** Cordon's live visitor log shows country, ASN, and the rule that fired for every visitor (IPs are SHA-256 hashed with a daily-rotating salt, so the log is GDPR-safe). If one network keeps appearing at the perimeter, block that ASN on the spot. 5. **Review after the drop.** Check which rules fired most, tighten what leaked through, and keep the configuration for next time. Drop defense compounds: the second protected release is smoother than the first. Plan details for each layer are on the [pricing page](/pricing). ## Honest limits: this is an arms race Top-tier bots exist that run full real browsers on clean residential proxies, solve challenges, type at human speed, and randomize their behavior. Against a well-funded operator using those, network-level detection alone will not catch every attempt, and any vendor claiming 100 percent is selling something. Two things are still true. First, that tier is expensive to run, so it targets high-resale releases; raising the cost per checkout shrinks how many operators bother with your store. Second, the majority of bot pressure on most drops is not that tier. It is rented scripts on datacenter IPs with default settings, and that majority is exactly what the layers above remove. The realistic goal is not zero bots. It is a drop where most of the inventory lands with humans. ## Frequently asked questions ### Can regular Shopify stores block checkout bots without Shopify Plus? Yes, at the traffic level. Most of Shopify's own anti-bot capability at checkout is a Plus feature, but any store can block the infrastructure bots run on before they reach checkout: datacenter networks, headless browsers, proxy services, and high-velocity request patterns. ### How do sneaker bots buy out a drop so fast? They monitor product endpoints like /products.json every few seconds, run from rented datacenter servers close to Shopify's infrastructure for low latency, and check out through pools of proxies so each purchase looks like a different buyer. The whole path is automated, so they finish in seconds. ### Will blocking datacenter traffic hurt Google crawling or SEO? No. Cordon always allows verified search engines like Google and Bing, and verification is network-level using reverse DNS, so they cannot be blocked even by a strict configuration. Bots pretending to be Googlebot fail that verification and get caught. ### Can any Shopify app block bots that never run JavaScript? Not on a standard Shopify storefront. Shopify does not allow apps or CDNs to sit in front of the request, so every app's detection runs in the page and a client that never executes JavaScript never triggers it. If raw HTTP bots are your main problem, report the network ranges to Shopify support; the platform edge is the only place they can be stopped. What an app can do is make the run worthless for every bot that does render pages. ### Will a bot blocker stop every sneaker bot? No. Top-tier bots on residential proxies mimicking human behavior are an arms race, and no vendor honestly claims 100 percent. Layered detection removes the casual majority and raises the cost of the rest, which is what shifts inventory back to real customers. --- If your last release was gone before real customers loaded the page, set up the perimeter before the next one. [Cordon is on the Shopify App Store](https://apps.shopify.com/cordon) with a 7-day free trial on paid plans, which is enough time to run a protected drop and watch in the visitor log who got stopped at the door. --- # Reduce Chargebacks on Shopify by Blocking Fraud Traffic Published 2026-07-17 by Bas Lefeber. Canonical: https://usecordon.com/blog/reduce-chargebacks-shopify-block-fraud-traffic > **TL;DR:** Every tool merchants usually reach for against chargebacks acts after the order exists, and by then the cheapest outcomes are gone. Blocking the riskiest traffic at the visit (VPNs and residential proxies at checkout, datacenter IPs, card-tester request velocity) means the fraudulent order is never created: no product loss, no chargeback fee, no dispute-rate damage. It will not stop friendly fraud, and nothing that blocks traffic honestly claims it will. A chargeback is not one cost. It is a stack of costs, and most of them are locked in the moment the fraudulent order is created. This post walks through what a dispute actually costs, which fraud patterns turn into disputes, and why the timing of your defense matters more than the sophistication of it. ## What a chargeback actually costs When a cardholder disputes an order, you lose more than the sale. | Cost | What happens | | --- | --- | | The product | Physical goods already shipped to a mule or forwarder are not coming back | | The shipping | Pick, pack, and carrier costs are paid on an order that reverses | | The chargeback fee | Your processor charges a fixed fee per dispute, typically whether you win or lose | | Staff time | Gathering evidence, writing the response, tracking the outcome | | Dispute-rate damage | Card networks track your dispute ratio; sustained disputes trigger monitoring programs, higher reserves, or account termination | The last row is the one merchants underestimate. Card networks run dispute monitoring programs with thresholds, and your processor watches your ratio. A store with a climbing dispute rate lands in a high-risk bucket where everything costs more, and in the worst case loses processing entirely. Winning an individual dispute does not undo this: it still counts against your ratio. The real question is not "how do I win more disputes" but "how do I make fewer disputes exist." ## The fraud patterns that become chargebacks Three patterns produce most disputes, and they are not equally preventable. **Card testing.** A fraudster buys a list of stolen card numbers and needs to know which ones still work. The test is your checkout: rapid, small orders, cycling through numbers until some authorize. Every successful test is a future dispute when the cardholder notices the charge. Every failed test still costs you an authorization fee. Card testers automate this, which means the traffic has a signature: scripted requests, high velocity, and network origins no real shopper uses. **Stolen-card purchases.** The quiet version. One larger order placed with a live stolen card, shipped to a freight forwarder or a reshipping mule. The fraudster hides their real location behind a VPN or residential proxy because an IP that contradicts the card's billing country is the oldest fraud signal in payments. The dispute arrives weeks later, after the goods are long gone. The full anatomy is in [our post on VPN and proxy checkout fraud](/blog/vpn-proxy-checkout-fraud-shopify). **Friendly fraud.** A real customer, on their real connection, disputes a real purchase. Maybe they did not recognize the statement descriptor, maybe a family member ordered, maybe they are gaming the system. Traffic blocking cannot touch this, because there is nothing abnormal about the visit. Be suspicious of any tool that claims otherwise. Friendly fraud is fought with clear descriptors, delivery confirmation, and good dispute responses, not with an IP filter. The honest summary: the first two patterns arrive through traffic you can identify before checkout. The third does not. ## The timing problem: everything acts after the order exists Look at when each common defense fires. Shopify's built-in fraud analysis scores an order after it is placed. Manual review happens after the order is placed. Post-order fraud apps, chargeback guarantee services, and dispute-response tools all operate on orders that already exist. The documentation at [help.shopify.com](https://help.shopify.com) describes fraud analysis accurately: it flags high-risk orders for review, and it is genuinely useful. But by the time it fires, the authorization has already hit your processor, the inventory is on hold, and automated fulfillment may already be moving the order. At that point the cheap outcomes are gone. You can cancel and refund (eating the review time), fulfill and hope, or fight the eventual dispute, which counts against your ratio even if you win. Blocking at the visit inverts the timeline. If the card tester's script or the proxy-masked buyer is stopped on the page they land on, there is no cart, no authorization, no order, and nothing to dispute. The visit still counts as a session in your Shopify reports, because Shopify records the pageview before any app runs, but everything expensive that would have followed it does not happen. This is the entire argument for prevention: not that it catches more fraud than post-order tools, but that it catches fraud at the point where stopping it costs nothing. ## What "riskiest traffic" means concretely Visit-level blocking only works if you can define risky traffic tightly enough to avoid blocking customers. Three definitions carry most of the weight: **Anonymized networks at checkout.** Real buyers rarely hide their network to buy socks. VPNs, residential proxies, and Tor are how stolen-card fraud disconnects the visitor's IP from the card's billing country. The key is a risk threshold, not a blanket ban: low-risk privacy services like iCloud Private Relay should pass, high-risk rotating proxy exits should not. This is exactly what the [VPN checkout fraud use case](/use-cases/block-vpn-checkout-fraud) is built for. **Datacenter IPs.** Nobody shops from a rented server. A visitor arriving from an AWS, Alibaba, Tencent, or Huawei Cloud address is a script. Blocking by ASN covers an entire hosting provider with one rule; the [ASN explainer](/blog/what-is-an-asn-block-bad-bots) explains how. **Card-tester velocity.** Card testing scripts cycle attempts far faster than a human browses. Request-velocity detection catches the pattern of automation itself, independent of where the traffic comes from, which matters because sophisticated testers rotate through proxy pools precisely to defeat per-IP rules. Cordon applies all three on the visit itself, with a decision in under 50 milliseconds, and fails open if the detection service is ever unavailable, so a hiccup never blocks real customers. ## The layered defense No single layer covers everything. Each layer exists because of what the previous one cannot see. | Layer | When it acts | What it covers | What it misses | | --- | --- | --- | --- | | Traffic blocking (Cordon) | At the visit | Card testing, proxy-masked stolen cards, datacenter scripts | Fraud from clean residential connections | | Shopify fraud analysis | At the order | Billing mismatches, risk signals on orders that got through | The costs already incurred by the order existing | | 3-D Secure | At payment | Shifts liability on authenticated transactions where applicable | Transactions outside its scope, checkout friction tradeoffs | | Dispute tools | After the dispute | Evidence gathering, response quality, win rate | The dispute-rate damage already done | Each layer is cheaper per incident than the one below it because it acts earlier. Prevention does not replace the other layers; it shrinks what reaches them. ## A practical setup checklist 1. **Check your dispute history for patterns.** Export recent disputed orders and look at the IP country versus billing country, and the time between account creation and purchase. Clusters tell you which rules to write first. 2. **Block anonymized traffic with a risk threshold.** Turn on VPN, proxy, and Tor blocking (Cordon Growth, [$19 per month](/pricing)). Confirm the threshold spares low-risk services like Private Relay. 3. **Block datacenter networks.** Nobody legitimate checks out from a cloud server. Datacenter blocking covers AWS, Alibaba, Tencent, and Huawei Cloud on the Pro plan. 4. **Leave bot and scraper detection on.** Request-velocity detection catches card-testing scripts that rotate IPs. Cordon's detection targets confirmed automation signals, not loose heuristics. 5. **Allowlist what you know.** Your office IP, your agency, known customers who use a VPN. Allow rules always win over block rules in Cordon, so an allowlist entry can never be collateral damage. 6. **Watch the visitor log for a week.** Cordon's live log shows country, ASN, and which rule fired for each blocked visit (IPs are SHA-256 hashed with a daily-rotating salt). Verify blocks look like fraud, not customers. 7. **Keep Shopify fraud analysis in the loop.** It is your safety net for fraud that arrives on clean connections. Review flagged orders before fulfillment. ## What this will not do Plainly: traffic blocking reduces the chargebacks that begin with identifiable risky traffic. That is card testing and proxy-masked stolen-card fraud, which for many stores is the bulk of hard fraud. It does not stop friendly fraud. It does not stop a fraudster with a stolen card and a clean residential connection in the card's own country, which is why fraud analysis and 3-D Secure still exist. Any vendor selling "zero chargebacks" through IP blocking is selling something that does not exist. What it does deliver is the cheapest possible outcome for the fraud it can see: the order never exists, so neither does the fee, the loss, or the mark against your dispute ratio. ## Frequently asked questions ### Can blocking fraud traffic stop all chargebacks on Shopify? No. It cuts the chargebacks that start with anonymized or automated traffic, mainly card testing and stolen-card purchases placed behind VPNs, proxies, or datacenter IPs. It does nothing against friendly fraud, where a real customer disputes a real purchase. ### What is card testing and why does it cause chargebacks? Card testing is when a fraudster runs rapid small orders through your checkout to find which stolen card numbers still authorize. Each successful test becomes a dispute when the cardholder notices, and each failed one still costs an authorization fee. ### Does Shopify's built-in fraud analysis prevent chargebacks? It helps, but it scores orders after they exist, so the authorization, the inventory hold, and the processor signal have already happened. It works best as a second layer behind visit-level blocking, not as the only defense. ### Will blocking VPNs and proxies block real customers too? Not if the blocker uses a risk threshold. Cordon lets low-risk privacy services like iCloud Private Relay through and blocks only high-risk exits like rotating residential proxies and Tor. Allow rules always win, so known customers can be allowlisted. ### Which Cordon plan do I need to reduce chargebacks? VPN, proxy, and Tor blocking starts on the Growth plan at $19 per month. Datacenter network blocking (AWS, Alibaba, Tencent, Huawei Cloud) starts on Pro at $49 per month. Every paid plan has a 7-day free trial. --- If your dispute ratio is creeping up and the disputed orders share a pattern (mismatched IP countries, datacenter ASNs, bursts of small orders), the cheapest fix is to stop that traffic before it becomes orders. [Cordon on the Shopify App Store](https://apps.shopify.com/cordon) installs as a theme app extension, decides in under 50 milliseconds, and has a 7-day free trial on every paid plan. --- # Should You Block AI Crawlers on Your Shopify Store? Published 2026-07-17 by Bas Lefeber. Canonical: https://usecordon.com/blog/should-you-block-ai-crawlers-shopify > **TL;DR:** For merchants, the right move in 2026 is to allow verified AI crawlers and block their impersonators. Shoppers ask ChatGPT, Claude, and Perplexity what to buy, and those assistants can only recommend stores their crawlers have read: blocking GPTBot removes you from answers your competitors will appear in. The real threat is scrapers wearing AI crawler names as camouflage, and the fix is network-level verification, not blocking by name. [The free scan](/scan) shows which crawlers your store currently invites, and how your robots.txt compares to Shopify's default. Publishers spent the last few years blocking AI crawlers, and plenty of Shopify merchants have copied the pattern without asking whether it fits commerce. It mostly does not. This post lays out why the publisher logic fails for stores, what the actual threat is, and how to keep the real crawlers in while keeping the fakes out. ## AI assistants are the new product discovery A growing share of shoppers now starts with a question instead of a search box: "what's a good waterproof hiking boot under 150 euros," typed into ChatGPT or Perplexity. The assistant answers with specific products from specific stores, often with links. Those recommendations do not come from nowhere. They come from what the assistant's crawlers have read. GPTBot and OAI-SearchBot (OpenAI), ClaudeBot (Anthropic), and PerplexityBot are, for product discovery, what Googlebot was for the last twenty years of search. If they have never read your product pages, your store effectively does not exist in that answer. There is no ads budget that fixes absence from the index. This is the same structural argument as classic SEO, which is why the reasoning in [do bot blockers hurt SEO](/blog/do-bot-blockers-hurt-seo) transfers almost unchanged: the crawlers that feed discovery channels are the last traffic you want to block, and a blocker that cannot tell them apart from bad bots is a liability. ## The instinct to block, and where it comes from The block-AI-crawlers reflex comes from publishing. News sites and content platforms blocked GPTBot in waves, arguing that AI companies were training on their work without licensing it. Whatever you think of that fight, the underlying logic is coherent for a publisher: their product is the content. If an AI reads the article and summarizes it to a user, that summary substitutes for the visit. The reader never arrives, the pageview never happens, the ad is never shown. Reading is consumption. Merchants saw big names blocking AI crawlers and copied the robots.txt lines, or installed blockers that treat every non-human visitor as hostile. The pattern transferred. The logic did not. ## Why the publisher logic does not transfer to commerce A merchant's product is not the product page. It is the boots in the box. An AI reading your catalog cannot substitute for buying from you; it can only describe you, and describing you to a shopper with intent is called distribution. | | Publisher | Merchant | | --- | --- | --- | | The product | The content itself | A physical item | | AI reads your pages | Substitution: the summary replaces the visit | Distribution: the catalog reaches a shopper | | Best case from crawling | Nothing (reader already served) | Your product recommended, with a link | | Cost of blocking | Protects the asset | Removes you from answers competitors appear in | | Rational default | Block or license | Allow verified crawlers | When a shopper asks an assistant what to buy, some set of stores will be in the answer. Blocking AI crawlers does not make the question go away. It just guarantees the answer is built from your competitors' catalogs instead of yours. There is a narrow exception: if your product pages contain genuinely proprietary content that is itself the value (paid research, licensed imagery under strict terms), you have a publisher-shaped problem for those pages. That describes very few stores. ## The real threat: scrapers in AI crawler costumes None of this means merchants have nothing to worry about. The legitimate worry is that a user agent is just a text string. Any scraper can send `GPTBot` in its headers, and many do, precisely because merchants have learned to wave that name through. The price scraper harvesting your catalog for a competitor, the bot farming your inventory data, the [content thief cloning your product pages](/blog/stop-scrapers-stealing-shopify-product-catalog): all of them benefit from looking like a crawler you want to allow. Blocking by name fails in both directions at once. You block the real GPTBot and lose the recommendation, or you allow everything named GPTBot and wave the scrapers through with it. ## The answer: verify networks, not names Real AI crawlers are verifiable. OpenAI, Anthropic, Perplexity, Google, and Microsoft all crawl from published network ranges, and reverse DNS confirms whether a visitor claiming to be one of them actually comes from the operator's infrastructure. A "GPTBot" arriving from a random hosting ASN is not GPTBot. It is a scraper in costume, and it should be blocked like one. (If ASNs are new to you, the [ASN explainer](/blog/what-is-an-asn-block-bad-bots) covers how network-level identity works.) This is how Cordon handles it: - **Verified good bots are always allowed.** GPTBot, ClaudeBot, PerplexityBot, Googlebot, Bingbot, and legitimate SEO crawlers like Ahrefs pass verification and cannot be blocked, even by your own rules. You cannot accidentally remove yourself from AI answers or search with an overly broad country or ASN rule. - **Verification is network-level.** Cordon checks reverse DNS, not the user agent string, so the name alone earns nothing. - **Impostors get caught.** Spoofed-crawler detection flags visitors wearing a good bot's name from the wrong network and blocks them, alongside headless-browser markers and request-velocity detection for the scrapers that do not bother with a costume. The [full detection breakdown](/features) lists every signal. The result is the only defensible policy: the real GPTBot always gets in, the fake one never does, and you did not have to maintain a robots.txt guess about which is which. For stores where scraping is the primary concern, the [content scraping use case](/use-cases/stop-content-scraping) goes deeper, including the anti-scraping decoy mode on the Plus plan that feeds impostors garbage data instead of a block screen. ## What AI crawlers respect Two conventions worth knowing: **robots.txt.** The major AI crawlers generally respect robots.txt directives, and each operator documents its user agent tokens. This is also why robots.txt is not a security control: it is a request that polite crawlers honor and scrapers ignore. Use it to express policy (for example, disallowing crawl of cart and checkout paths), not to enforce it. Enforcement is what network-level blocking is for. **llms.txt.** A newer convention: a plain-text file at `/llms.txt` giving language models a clean, structured summary of what your site is and where the important pages are. Adoption is early and no assistant guarantees it reads the file, but it costs an hour and it is the closest thing to telling AI systems directly what you want them to know about your store. ## Make your store AI-readable Allowing crawlers in is step zero. What they find when they arrive decides whether you get recommended. A short checklist: 1. **Write product descriptions with facts, not fragments.** Assistants quote complete sentences with concrete attributes (materials, dimensions, weight, compatibility). "Premium quality" gives a model nothing to recommend you for. 2. **Ship structured data.** Product schema with price, availability, and review markup is machine-readable by design. Most Shopify themes emit the basics; verify yours does and that the values match the page. 3. **Keep pricing information consistent.** One clear price per variant, currency stated, no prices that only render after JavaScript-heavy interactions a crawler may not execute. 4. **Give your about page real facts.** Founded when, based where, ships to which countries, returns policy in plain language. Assistants weigh whether a store looks legitimate before recommending it. 5. **Add llms.txt.** A short summary of the store, top collections, shipping regions, and links to key pages. 6. **Confirm your blocker is not sabotaging you.** Check your visitor log for verified crawlers being served block screens. In Cordon this cannot happen by construction, but if you run another blocker or hand-rolled rules, audit them. Shopify's own guidance on storefront access lives at [help.shopify.com](https://help.shopify.com). ## Frequently asked questions ### Should I block GPTBot on my Shopify store? For most merchants, no. GPTBot is how ChatGPT learns your catalog exists, and assistants can only recommend stores their crawlers have read. Blocking it removes you from AI shopping answers while your competitors stay in them. ### Can a scraper pretend to be an AI crawler? Yes, trivially. The user agent is just a text string anyone can send, so a price scraper can call itself GPTBot. Real AI crawlers come from published, verifiable networks, which is why verification has to happen at the network level, not by name. ### Why do publishers block AI crawlers if merchants should not? A publisher's product is the content itself, so an AI reading it can substitute for the visit. A merchant's product is a physical thing. An AI reading your catalog is distribution, not substitution: the recommendation is the goal. ### What is llms.txt? A convention for placing a plain-text summary of your site at /llms.txt so language models can read a clean, structured overview. It is young and not universally honored, but it is cheap to add and signals what you want AI systems to know. ### Does Cordon ever block real AI crawlers by mistake? No. Verified good bots like GPTBot, ClaudeBot, PerplexityBot, Googlebot, and Bingbot are always allowed and cannot be blocked, even by your own rules. Verification is network-level, so an impostor sending the same name from a hosting ASN still gets caught. --- If you want the real AI crawlers reading your catalog and the fake ones on a block screen, that is Cordon's default behavior out of the box: verified good bots always allowed, spoofed crawlers detected at the network level, decisions in under 50 milliseconds. [Try Cordon on the Shopify App Store](https://apps.shopify.com/cordon) with a 7-day free trial on paid plans. --- # How to Block an IP Address on Shopify (2026 Guide) Published 2026-07-16 by Bas Lefeber. Canonical: https://usecordon.com/blog/how-to-block-an-ip-address-on-shopify > **TL;DR:** Shopify has no built-in way to block an IP address from visiting your store, on any plan. Native tools can cancel orders and restrict known customer accounts at checkout, but the visitor can still browse freely. To actually block an IP you need an app that checks every visit against live rules; with Cordon you can block single IPs, CIDR ranges, and whole networks, with allow rules always taking priority. Someone keeps hammering your store from the same address. Maybe it is a harassing visitor, a serial refunder, a competitor pulling your prices every hour, or repeated fraud attempts that all trace back to one IP. The obvious fix is "just block the IP." This guide covers how to do that on Shopify, what Shopify itself can and cannot do, and, just as important, when an IP block is the wrong tool. ## Why merchants want to block a single IP The request usually comes from one of four situations: - **A harassing visitor.** Someone abusing your contact forms, spamming chat, or placing fake orders repeatedly. - **Repeated fraud from one address.** Multiple stolen-card attempts or chargebacks that all originate from the same IP. - **A competitor scraping you.** Your prices or product copy showing up elsewhere hours after you change them, with a server address appearing in your logs at machine-like intervals. - **A serial refunder or policy abuser.** A "customer" who games returns, discount codes, or free-shipping thresholds again and again under new email addresses. In each case you know exactly who the problem is at the network level. That is the scenario IP blocking was made for. ## The hard truth: Shopify has no built-in IP blocking Search Shopify's admin for an IP blocklist and you will not find one. There is no visitor-level IP blocking on any Shopify plan, including Plus. What Shopify can do natively: - **Cancel and refund orders**, and flag them as fraudulent so Shopify's own fraud analysis learns from them. - **Restrict a known customer account** so a specific logged-in customer cannot complete checkout. - **Shopify Plus checkout controls**, such as validation rules that reject orders matching certain conditions at checkout time. Notice what all three have in common: they act at the order or account stage. None of them stop the visitor from browsing. The scraper still loads every product page. The harasser still uses your contact form. The fraudster still probes your checkout with the next stolen card. Native tools clean up after the visit; they do not prevent it. Shopify's own documentation at [help.shopify.com](https://help.shopify.com) is upfront that traffic filtering is app territory. ## Workarounds people try, and why they fail Before installing an app, most merchants try one of these. Here is how each holds up: | Workaround | The idea | Why it fails | | --- | --- | --- | | Theme Liquid hacks | Read a request header in `theme.liquid` and render a blank page for a bad IP | Liquid has no reliable access to the visitor's real IP, pages are cached so the wrong visitor can get the blocked version, and the hack silently disappears on the next theme update | | Hiding content with JavaScript | Detect the IP client-side and hide the page | The full HTML already arrived at the browser. A scraper reads the source directly and never runs your hiding script. Nothing was blocked, only decorated | | Password-protecting the store | Lock everyone out | Blocks all your customers along with the one bad actor. Not a fix, a shutdown | | Blocking at checkout only | Cancel their orders as they come in | The browsing, scraping, and form abuse continue untouched, and each fraud attempt still costs you time | The pattern: anything you hand-roll inside the theme breaks the moment your theme changes, and it matches a hardcoded list rather than checking anything live. Blocking has to be a rule the store evaluates on every visit, not a snippet you maintain. ## How IP blocking works properly An app like Cordon integrates through a theme app extension (no script tag injection) and checks each visitor as the page loads. The decision takes under 50 milliseconds, and a blocked visitor cannot browse your store or reach checkout. If the detection service is ever unreachable it fails open, so your store never goes down because of your blocker. Three levels of IP rule, from narrow to wide: 1. **Single IP.** `203.0.113.7` blocks exactly one address. Right for one known troublemaker on a stable connection. 2. **CIDR range.** `198.51.100.0/24` blocks all 256 addresses in that block with one rule. Right when abuse comes from a small pool, like one office or one server cluster. 3. **ASN (whole network).** Blocks every IP announced by one network operator, such as a hosting provider your scraper rents servers from. IPs inside a network rotate; the network itself does not. We cover this in depth in [what an ASN is and why blocking one stops thousands of bots](/blog/what-is-an-asn-block-bad-bots). Two properties matter as much as the rules themselves: - **Allow rules always win.** If you allowlist your own office IP or a wholesale customer's address, no block rule, range, or ASN rule can ever catch them. This makes wide rules safe to use. - **Blocked visitors see a block screen you control**, not a broken page. You choose the message. Cordon layers this with [country blocking](/blog/how-to-block-a-country-on-shopify), VPN and proxy detection for [checkout fraud](/use-cases/block-vpn-checkout-fraud), and bot detection, so IP rules are one tool in the set rather than your only defense. ## Block an IP with Cordon, step by step 1. Install [Cordon from the Shopify App Store](https://apps.shopify.com/cordon) and enable the app embed in your theme (the app walks you through it, no code edits). 2. Find the IP you want to block. Cordon's live visitor log shows each visit with its country, network (ASN), and which rule fired, with IPs stored as SHA-256 hashes for GDPR safety. If the address came from an abuse report or a fraud notice, you already have it. 3. Open **Rules**, add a block rule, and enter the single IP or a CIDR range like `198.51.100.0/24`. 4. Check the ASN shown for that visitor before saving. If it is a mobile carrier, stop and read the CGNAT warning below. If it is a hosting provider, consider blocking the ASN instead of the IP. 5. Add allow rules for addresses that must never be blocked: your office, your VA, key wholesale customers. Allow rules take priority over everything. 6. Save. The rule is enforced on the next visit, before any page renders. ## The honest limits of IP blocking IP blocking is precise, and that precision is also its weakness. An IP address identifies a connection, not a person, and connections change. - **VPNs hand out fresh IPs in seconds.** A blocked adversary reconnects and comes back from a different address, often a different country. If they do this, you are no longer fighting an IP, you are fighting a behavior, and you need VPN/proxy detection rather than a longer blocklist. - **Cloud servers rotate addresses on demand.** A scraper on AWS can cycle addresses faster than you can add rules. Block the network (the ASN), not the addresses. - **CGNAT: never block a mobile carrier range casually.** Mobile carriers put thousands of subscribers behind one shared public IP using carrier-grade NAT. Block that one address and you may have blocked thousands of real people, including customers mid-checkout, to stop one bad actor who will simply toggle airplane mode and get a new address anyway. Always check the ASN first: if it belongs to a mobile or residential ISP, prefer a narrower response (restrict the customer account, tighten fraud rules) over an IP block. A practical escalation ladder: | Situation | Right tool | | --- | --- | | One known troublemaker, stable home or office connection | Single IP block | | Abuse from one office or one server cluster | CIDR range block | | Scraper rotating IPs inside one hosting provider | ASN block | | Traffic from cloud networks in general (AWS, Alibaba, Tencent, Huawei Cloud) | Datacenter blocking (Cordon Pro and up) | | Adversary hopping VPNs and networks | VPN/proxy/Tor detection plus behavior-based bot detection | IP rules are the scalpel. Keep them for the cases where you genuinely know the address, and let network-level and behavior-based detection handle everything that moves. See [the full feature list](/features) for how the layers fit together. ## Frequently asked questions ### Can Shopify block an IP address without an app? No. Shopify has no built-in visitor-level IP blocking on any plan. You can cancel orders, restrict a known customer account from checkout, and on Shopify Plus add checkout validation rules, but none of these stop a visitor from browsing your store. Blocking an IP from browsing your store requires an app. ### Can I block a whole range of IP addresses on Shopify? Yes, with an app that supports CIDR notation. A rule like `198.51.100.0/24` blocks all 256 addresses in that range at once. For traffic that rotates across an entire provider, blocking the ASN (the network operator itself) is more durable than any list of ranges. ### Will blocking an IP address stop a determined scraper? On its own, no. IPs are cheap and a scraper on a VPN or cloud provider gets a fresh address in seconds. IP rules work best against a specific known troublemaker on a stable address. Against rotating traffic, escalate to ASN or datacenter blocking and behavior-based bot detection. ### Is it safe to block an IP that belongs to a mobile carrier? Be very careful. Mobile carriers use carrier-grade NAT (CGNAT), which means one public IP address can be shared by thousands of real people at the same time. Blocking a single troublemaker on mobile data can block every other customer behind that same address. Check the ASN before you block. ### Does blocking IP addresses hurt my SEO? Not with a properly built blocker. Cordon verifies search engine crawlers like Googlebot and Bingbot at the network level and always allows them, no matter what block rules you create. A crawler faking Googlebot's user agent fails that verification and gets caught. --- If you have a specific IP causing trouble right now, you can have a block rule live in a few minutes. [Install Cordon from the Shopify App Store](https://apps.shopify.com/cordon), block the address, allowlist the people who matter, and check the visitor log tomorrow to confirm it worked. The free plan covers the basics, and [paid plans](/pricing) start at $9/mo with a 7-day trial. --- # Shopify Bot Traffic: How to Spot It and Stop It Published 2026-07-16 by Bas Lefeber. Canonical: https://usecordon.com/blog/shopify-bot-traffic-how-to-spot-and-stop > **TL;DR:** Bot traffic on Shopify shows up as a traffic spike with no matching sales, sessions from countries you never sell to, near-zero visit durations, and traffic from hosting providers instead of consumer ISPs. Even harmless bots cost you money by skewing conversion data, polluting ad audiences, and inflating visitor-based app bills. Stop the bad ones with layered detection (headless markers, request velocity, datacenter ASN blocks) while keeping verified search and AI crawlers allowed. [The free scan](/scan) reads only public pages and shows you what an automated visitor gets from your store today. Your traffic chart jumps 40 percent overnight. Orders: exactly the same as last week. Conversion rate: suddenly terrible. Nothing about your store changed. If that sounds familiar, you are almost certainly looking at bot traffic, and this post shows you how to confirm it in your own reports and what to do about it. ## The classic symptom: a spike with nothing behind it Real traffic surges have a cause you can point to: an ad campaign, an email send, a product going viral, a press mention. They also convert at something resembling your normal rate, because they are made of people. Bot surges have neither. Sessions climb, sales do not move, and every ratio in your analytics quietly breaks, because the denominator inflated while the numerator stayed put. A store converting at 2 percent that suddenly reports 1.2 percent with flat orders did not get worse at selling. It got a few thousand visitors that were never going to buy anything because they are scripts. That broken denominator is the real damage. You do not just get noise in a chart; you get wrong answers from every metric that divides by sessions. ## How to recognize bot traffic in your reports No single signal is proof. Several together are close to it: - **Countries you never sell to.** Hundreds of sessions from markets where you do not ship, do not advertise, and have never had a customer. This is often the first thing merchants notice, and it is why [country blocking](/use-cases/block-traffic-by-country) is many stores' first rule. - **Near-zero session duration.** Real shoppers linger, scroll, and click. Bot sessions last a second or two: load the page, extract the data, leave. - **Product pages in rapid sequence.** A scraper walks your catalog methodically: page 1, page 2, page 3, at machine speed. Landing pages, blog posts, and your about page get ignored. Humans do not browse 300 products in 10 minutes. - **Traffic from hosting providers, not consumer ISPs.** Real shoppers connect from home and mobile networks like Comcast or Vodafone. Nobody shops from a rented server on AWS or Alibaba Cloud. Network origin (the ASN) is the strongest single tell; [here is how ASNs work](/blog/what-is-an-asn-block-bad-bots). - **Conversion rate collapse with flat orders.** The arithmetic signature described above. If orders held steady while conversion halved, the new "visitors" were not visitors. ## What bots cost you even when they behave It is tempting to shrug at bot traffic that is not attacking anything. That is a mistake, because passive bots still bill you in four ways: | Cost | How it happens | | --- | --- | | Bad decisions from skewed data | Conversion rate, bounce rate, and per-page metrics all divide by sessions. Inflate sessions and every one of them lies. You "fix" pages that were never broken and kill campaigns that were working | | Wasted ad spend | Bots that execute JavaScript land in your retargeting audiences. You then pay real money to show ads to scripts, and your lookalike audiences learn from machine behavior | | Higher app bills | Many Shopify apps, traffic blockers included, price by visitor count. Bot sessions push you into tiers you should not need | | Server and speed drag | In extreme cases, aggressive crawling adds load and slows the store for the humans you actually want there | ## Not every bot is bad Blocking all bots is the wrong goal, and any tool that promises it should worry you. Sort them into three buckets: | Category | Examples | What to do | | --- | --- | --- | | Good bots | Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot, Ahrefs | Keep them. They are how you get found in search and recommended by AI assistants | | Gray bots | Price monitors, inventory checkers, uptime tools | Your call. Mostly harmless, but they add up; block them if they bring you nothing | | Bad bots | Scrapers, carders testing stolen cards, checkout and inventory-hoarding bots | Block the visit | The good bots matter more than ever now that AI assistants answer shopping questions. Blocking GPTBot or ClaudeBot removes you from those answers. We covered the SEO side in detail in [do bot blockers hurt SEO](/blog/do-bot-blockers-hurt-seo); the short version is that a well-built blocker protects good crawlers instead of endangering them. ## How to stop the bad bots properly One-signal detection fails. User-agent strings are self-reported, so a scraper can call itself Googlebot in one line of code. This is why user-agent allowlists alone are worse than useless: they wave through anyone willing to lie, which is every bad bot. Detection has to be layered: - **User-agent fingerprinting** catches lazy bots that announce themselves or ship inconsistent headers. - **Headless browser markers** catch automation frameworks (Puppeteer, Playwright, Selenium) that render pages like a real browser but leave detectable traces. - **Request velocity** catches anything hitting pages faster than a human can, whatever it claims to be. - **Datacenter ASN blocking** catches traffic from cloud networks like AWS, Alibaba, Tencent, and Huawei Cloud where shoppers never live (Cordon Pro and up). - **Network-level verification of good bots.** Cordon verifies claimed crawlers with reverse DNS: real Googlebot resolves back to Google's network, and a scraper spoofing the name does not. Verified search engines and good bots are always allowed and cannot be blocked, so an aggressive setup can never cost you your rankings or AI visibility. Layered like this, each check covers the others' blind spots, and the decision happens in under 50 milliseconds. If you are comparing tools, our [rundown of Shopify bot blocker apps](/compare/best-shopify-bot-blocker-apps) goes through what to look for. ## Diagnose it in 15 minutes You can confirm or rule out bot traffic with your Shopify reports plus a visitor log. Cordon's log shows the country, the network (ASN), and the rule that fired for every visit, with IPs stored as SHA-256 hashes (daily-rotating salt) so the log stays GDPR-safe. 1. **Find the spike.** In Shopify analytics, note the day sessions jumped and compare orders for the same day. Flat orders plus a spike means proceed. 2. **Check countries.** Break sessions down by country. Rank the spike-day countries against your actual customer countries. Anything large and unfamiliar is a lead. 3. **Check the networks.** Open the visitor log and look at the ASN column for the suspicious window. Consumer ISPs are normal. Hosting providers (AWS, Alibaba Cloud, Tencent, Hetzner and similar) in volume are your confirmation. 4. **Check the pattern.** Look at what the suspicious visits requested. A methodical walk through product pages at fixed intervals is a scraper, not a shopper. 5. **Apply the narrowest fix that covers it.** One network responsible: block that ASN. Traffic concentrated in a country you never sell to: block the country, or start from Cordon's presets (Block China, Anti-scraper, or Strict mode) and adjust. Mixed and rotating: turn on bot detection and let the layered checks handle it. 6. **Verify tomorrow, in the right report.** Recheck the visitor log: blocked visits now show which rule fired, and you can read what share of your traffic they were. Do not expect your Shopify session count to fall. Shopify serves the page and records the pageview before Cordon runs in the visitor's browser, so blocked visits stay in Shopify's numbers. The visitor log is the record of what was actually stopped, and the number worth recalculating is your real conversion rate: orders divided by the sessions that were not blocked. ## Frequently asked questions ### Why did my Shopify traffic spike with no extra sales? A sudden traffic spike with zero matching sales is the classic signature of bot traffic. Bots generate sessions but never buy, so visitors climb while orders stay flat and your conversion rate collapses. Check where the sessions came from: countries you never sell to and hosting-provider networks are the giveaway. ### Does Shopify filter bot traffic out of analytics automatically? Shopify excludes some known crawlers from reports, but a lot of automated traffic still lands in your numbers. Scrapers running headless browsers and bots on cloud servers execute JavaScript like real visitors, so analytics counts them as sessions. Worth knowing: a blocker running in the storefront stops them shopping, but the visit is still counted, by Shopify and by third-party analytics and session recorders alike, because all of them fire on page load, before the block. Your blocker's own log is the accurate count. ### How can I tell bot traffic from real visitors? Look at network origin and behavior together. Real shoppers come from consumer ISPs, browse a few pages, and linger. Bots come from hosting providers like AWS or Alibaba Cloud, hit hundreds of product pages in rapid sequence with near-zero session duration, and often visit from countries you never sell to. ### Will blocking bots hurt my SEO or AI search visibility? Not if verified good bots stay allowed. Cordon verifies Googlebot, Bingbot, and AI crawlers like GPTBot, ClaudeBot, and PerplexityBot at the network level and always lets them through; they cannot be blocked. The verification uses reverse DNS, so a scraper faking Googlebot's user agent fails the check and gets caught. ### Will blocking bots lower my Shopify session count? No. Cordon runs as JavaScript in the visitor's browser, so Shopify has already served the page and recorded the pageview by the time the block screen appears. Blocked visits stay in your Shopify reports for good. What changes is that your visitor log tells you which sessions were not people, so you can work out your real conversion rate from the ones that were. ### Do bots cost me money even if they never attack? Yes. Bots inflate your session counts, which skews conversion data and leads to bad decisions. They pollute retargeting audiences so ad spend goes to machines, and they push your visitor counts into higher pricing tiers on visitor-billed apps. You pay for them even when they do nothing malicious. --- If your chart has a spike you cannot explain, the fastest way to get an answer is to watch the traffic with the log open. [Install Cordon from the Shopify App Store](https://apps.shopify.com/cordon), run the 15-minute diagnosis above, and block what you find. Basic bot and country blocking is free, and paid plans come with a 7-day trial. --- # How to Stop Discount Code Abuse on Shopify Published 2026-07-16 by Bas Lefeber. Canonical: https://usecordon.com/blog/stop-discount-code-abuse-shopify > **TL;DR:** Discount code abuse on Shopify is mostly one person pretending to be many people. Shopify's native limits are keyed to the customer account and email, so a fresh email defeats them, and IP blocks fail because VPNs rotate IPs in seconds. The fix that actually holds is layered: tighten code scope natively first, then block the anonymizing layer (VPN, proxy, Tor) that makes identity rotation cheap. That raises the effort of farming a code above the value of the discount. A welcome code is a bet: give up margin once, gain a customer who comes back at full price. Discount abuse breaks the bet. The margin goes out repeatedly, the "new customers" are the same person, and your acquisition math quietly stops being true. This post covers the abuse patterns, what Shopify gives you natively and where it stops, and how to close the gap at the network level. ## The quick version If you just want it fixed in the next ten minutes: 1. In Shopify, give every shared code a one-use-per-customer limit, an expiry date, and a minimum order amount. 2. [Install Cordon](https://apps.shopify.com/cordon) and start the Growth trial (7 days free). 3. In Cordon, open **Block by traffic type** and switch on **Block VPNs**, **Block proxies**, and **Block Tor exit nodes**. That is the whole setup. Identity rotation now requires more than a burner email and a free VPN. The rest of this post explains why this works, what it costs you today, and the cases it will not catch. ## The four abuse patterns ### Welcome code farming The classic. Your store offers WELCOME10 to first-time buyers. One person creates account after account, each with a throwaway email, and redeems the code on every order. From Shopify's point of view these are distinct customers, because Shopify keys identity to the account and email. From your P&L's point of view it is one buyer who never pays full price. ### Codes leaking to coupon sites and extensions Any code that reaches a browser eventually reaches everyone. Coupon aggregator sites index codes, and coupon browser extensions auto-apply every known code at checkout. A code you created for one influencer campaign or one email segment ends up applied to orders from shoppers who were already committed to buying. This is the quietest form of abuse because every individual redemption looks legitimate. ### Referral self-referrals Refer-a-friend programs pay out twice: a reward for the referrer and a discount for the friend. When both people are the same person on two accounts, you pay both sides of the transaction to a single buyer. Rings of "friends" referring each other in a loop are the scaled version of the same trick. ### Affiliates abusing their own codes An affiliate with a personal code and a commission has an incentive to apply that code to purchases that would have happened without them: their own orders, orders from family, or orders driven through coupon sites where the affiliate posted their code. You pay a commission plus a discount for demand you already had. ## What it actually costs The direct margin hit is only part of the damage. | Cost | Mechanism | | --- | --- | | Stacked discount on existing demand | The order would have happened at full price; the code turns real margin into a rebate | | Repeated first-order margin | A one-time acquisition cost paid many times to the same person | | Referral payouts to loops | Both sides of a self-referral are the same wallet | | Affiliate commission leakage | Commission plus discount paid on orders you did not need help winning | | Poisoned cohort data | "New customer" counts, repeat rates, and CAC all read wrong when new customers are recycled identities | The last row is the expensive one long-term. If a chunk of your first-order cohort is one person on rotating emails, every decision you base on cohort behavior (ad spend, LTV models, retention targets) is built on bad data. ## What Shopify offers natively, and where it stops Shopify's discount settings give you real controls, and you should use all of them. You can limit a code to one use per customer, cap the total number of redemptions, set a start and end date, require a minimum order amount, and restrict a code to specific customer segments. The [Shopify Help Center](https://help.shopify.com) documents each option. The limits are structural, not bugs: - **One use per customer is keyed to the customer account and email.** A new email is a new customer. Deliberate farmers cycle emails faster than you can read this paragraph. - **Capping total uses punishes legitimate buyers too.** If you cap WELCOME10 at 500 uses and a farmer takes 200 of them, you spent the budget and starved real customers. - **Segment restrictions inherit the same identity problem.** A "new customers" segment contains whoever just made a new account. Native controls narrow the blast radius. They do not answer the core question: is this "new customer" actually a new person? ## Why IP-based limits alone fail The obvious next step is to key limits to IP address instead of email. It fails for the same reason email limits fail: the identifier is cheap to rotate. A consumer VPN switches exit servers in one click. A residential proxy pool hands out a fresh IP per request. Blocking the IP you saw yesterday does nothing about the IP the same person is using today. There is also a false-positive problem in the other direction: mobile carriers and universities put thousands of real people behind shared IPs, so a strict one-redemption-per-IP rule blocks legitimate customers who happen to share an address. Chasing individual IPs is the wrong altitude. The useful observation is one level up. ## The network-level answer: catch the rotation tool The person cycling emails can mint a new inbox in ten seconds. What they usually cannot do as easily is cycle networks. The email rotation is manual and free; the IP rotation runs through a tool: a VPN, a proxy service, or Tor. That tool is detectable, and it is the same anonymizing layer that [checkout fraud rides on](/blog/vpn-proxy-checkout-fraud-shopify). Three detection layers combine here: - **VPN, proxy, and Tor detection** identifies the anonymizing service itself using live commercial data, not a stale IP list. Instead of blocking the thousandth fresh IP, you block the category of connection the farmer depends on. In Cordon this is included on Growth ($19/mo) and up. - **Request-velocity detection** catches the tempo of abuse. Cordon watches request patterns, not your discount codes, but scripted farming has a request signature: creating an account, applying a code, and checking out four times in ten minutes produces a burst of page loads no human shopper generates. The automated version of code farming trips it; a slow manual abuser does not. - **The visitor log makes the pattern visible.** Cordon's live visitor log shows each visitor's country, network (ASN), and the rule that fired, with IPs stored as SHA-256 hashes under a daily-rotating salt so the log stays GDPR-safe. When one ASN keeps hitting your discount landing page, you are looking at one network wearing many faces. If the network is a hosting provider or a known proxy carrier, [blocking the whole ASN](/blog/what-is-an-asn-block-bad-bots) ends the run in one rule. Because allow rules always win over block rules in Cordon, you can protect known-good customers (your own office, a VIP who uses a VPN) explicitly and then be aggressive with the block side. ## The practical playbook Work from cheapest to strongest. Steps 1 through 4 cost nothing and use only native Shopify features. 1. **Tighten code scope natively.** One use per customer, an expiry date, and a minimum order amount on every promotional code. A code with no expiry is a permanent liability on coupon sites. 2. **Keep codes out of URLs.** Auto-apply discount links are convenient, but a code embedded in a shareable URL is a code published to the internet. Extensions and aggregators harvest them. Prefer codes delivered inside email or post-purchase flows, and rotate any code that leaks. 3. **Use unique single-use codes for high-value offers.** Generated one-per-recipient codes cannot be farmed or aggregated. Save the shared evergreen code for low-value offers only. 4. **Audit referral and affiliate payouts monthly.** Same shipping address on both sides of a referral, or an affiliate whose conversions all carry their own code with no traffic source, are ten-minute checks that catch loops early. 5. **Block the anonymizing layer.** Turn on VPN, proxy, and Tor blocking (Cordon Growth and up) so identity rotation requires more than a browser extension. This is the step that changes the economics; see the [VPN checkout fraud use case](/use-cases/block-vpn-checkout-fraud) for how the same control stops card abuse. 6. **Watch the visitor log during promotions.** During a code launch, check which ASNs are hitting the landing page. A hosting network or proxy carrier showing up repeatedly is a farm; block the ASN and move on. The [feature overview](/features) covers what each detection layer contributes, and [pricing](/pricing) shows which plan carries which layer. ## Honest limits A patient abuser on real residential connections, redeeming at a human pace with plausible addresses, is hard to fully stop, because at the network level they look like a genuine new customer. The goal is not perfection. The goal is making the farm cost more than the discount pays: when redeeming a 10 percent code requires clean residential connections, fresh identities, and human pacing, almost everyone doing it at scale stops, because the margin is not worth the effort. The casual majority, running a free VPN and a burner inbox, gets caught at step 5. ## Frequently asked questions ### How do people abuse discount codes on Shopify? The common patterns are one person creating endless accounts to reuse a first-order welcome code, codes leaking to coupon sites and browser extensions, customers referring themselves through referral programs, and affiliates applying their own codes to orders that were happening anyway. ### Does Shopify's one-use-per-customer limit stop welcome code abuse? Only partially. The limit is keyed to the customer account and its email address, so an abuser defeats it by signing up again with a fresh email. It stops accidental double redemptions, not deliberate farming. ### Can I stop discount abuse by blocking IP addresses? Not on its own. VPNs and proxy services hand out a fresh IP in seconds, so blocking individual addresses is an endless chase. Blocking the anonymizing layer itself, meaning VPN, proxy, and Tor traffic, removes the rotation tool instead of chasing its output. ### Which Cordon feature stops discount code abuse? The three toggles under Block by traffic type: **Block VPNs**, **Block proxies**, and **Block Tor exit nodes**. They are available on the Growth plan ($19 per month) and up, with a 7-day free trial. Turning those on blocks the network rotation that code farming depends on; the visitor log then shows you exactly what got caught. ### Will blocking VPNs also block honest customers who use one? Cordon uses a fraud-score threshold backed by live commercial data, so low-risk privacy services like iCloud Private Relay pass through. Allow rules always beat block rules, so you can allowlist any known customer explicitly. --- If welcome codes keep getting farmed and your "new customer" numbers feel off, tightening native limits is the first hour of work and blocking the anonymizing layer is the second. [Cordon is on the Shopify App Store](https://apps.shopify.com/cordon) with a 7-day free trial on paid plans, so you can watch the visitor log during your next promotion and see who is actually redeeming. --- # What Is an ASN? Blocking One Stops Thousands of Bots Published 2026-07-15 by Bas Lefeber. Canonical: https://usecordon.com/blog/what-is-an-asn-block-bad-bots > **TL;DR:** An ASN (Autonomous System Number) is a unique identifier for a network operator, such as an ISP or cloud provider, and every IP address on the internet belongs to exactly one autonomous system. Bots rotate IPs constantly, but the ASN behind them stays stable, so blocking one hosting ASN can stop an entire scraper farm with a single rule. Block datacenter ASNs freely, never block residential ISP ASNs casually, and make sure verified crawlers like Googlebot stay exempt. If you have ever blocked a scraper's IP address only to see the same bot return from a new address five minutes later, you already understand why ASN blocking exists. Individual IPs are disposable. The network they come from is not. This post explains what an ASN is, why it is the most durable signal you have against automated traffic, and where the technique can backfire if applied carelessly. ## What is an ASN? An ASN, short for Autonomous System Number, is a unique number assigned to an autonomous system: a network, or group of networks, run by a single operator with a unified routing policy. In plain terms, it is the ID badge of whoever operates the piece of the internet a visitor connects from. Every IP address that is reachable on the public internet is announced by exactly one autonomous system. That makes the ASN a clean, unambiguous answer to the question "whose network is this?" Some examples: - **AS15169** is Google. Googlebot crawls from here. - **AS16509** is Amazon AWS. A huge share of the world's scrapers rent servers here. - **AS45102** is Alibaba. Alongside Tencent and Huawei Cloud, it is a common origin for scraping traffic aimed at ecommerce stores. When a request hits your store, the source IP maps to exactly one of these numbers. There is no ambiguity and no self-reported information involved, which is more than can be said for a user-agent string. ### How ASNs are assigned ASNs are handed out by the five regional internet registries (ARIN in North America, RIPE NCC in Europe, APNIC in Asia-Pacific, LACNIC in Latin America, AFRINIC in Africa), which receive them from IANA. An operator applies to its regional registry, receives a number, and uses it to announce its IP ranges to the rest of the internet through BGP, the routing protocol that ties networks together. The BGP details do not matter for blocking; what matters is that the mapping from IP address to ASN is public, global, and maintained by the internet's own plumbing, not by any single vendor's database. ## Why ASNs matter for blocking: IPs rotate, networks do not Here is the core asymmetry. For a bot operator, changing IP addresses is trivial. Cloud providers hand out fresh addresses on demand, and a scraper can cycle through a new one on every request batch. IP-based blocklists are always fighting the last war: by the time an address is on the list, the bot has moved on. Changing networks is much harder. The operator would have to move their servers, their tooling, and their billing to a different provider. So while a scraper farm rotates through thousands of AWS IP addresses, every single one of those addresses still belongs to AS16509. The IPs are the disguise; the ASN is the face under it. That is what makes ASN blocking efficient. One rule against a hosting ASN blocks the bot's entire current address pool and every address it might rotate to within that provider. For a store being scraped daily, this is routinely the single highest-impact rule available, which is why it anchors our guide on [stopping scrapers from stealing your product catalog](/blog/stop-scrapers-stealing-shopify-product-catalog). ## Residential ASNs vs datacenter ASNs Not all ASNs are equal, and this distinction is the whole safety model of ASN blocking. | | Residential / ISP ASNs | Hosting / datacenter ASNs | | --- | --- | --- | | Examples | Comcast, Vodafone, Deutsche Telekom | AWS, Hetzner, OVH, Tencent, Alibaba | | Who connects from them | Real people at home and on mobile | Rented servers and virtual machines | | Real shoppers present? | Yes, this is where your customers live | Almost never | | Bot traffic present? | Some (residential proxies) | Constantly | | Safe to block? | No, never casually | Usually, with allowlist caveats | **Residential ISP ASNs** (Comcast, Vodafone, and every other consumer ISP) carry real customers. Blocking one to stop a single abusive user is like closing a highway to stop one car; the collateral damage is your own revenue. If abuse comes through a residential network, block the specific behavior or address, not the network. Residential proxy traffic needs different tools entirely, which is a [live proxy-detection problem](/use-cases/block-vpn-checkout-fraud), not an ASN problem. **Hosting and datacenter ASNs** are the opposite case. Almost nobody does their shopping from a rented server in a Hetzner or OVH datacenter. Traffic from these networks is overwhelmingly automated: scrapers, vulnerability scanners, bulk account creators, price-monitoring bots. For a typical Shopify store, blocking datacenter ASNs eliminates a large share of bad bot traffic at close to zero cost in real customers. ### But isn't Shopify (and half the internet) on AWS? This is the question every merchant asks, and the answer is what makes datacenter blocking safe. A blocker like Cordon evaluates the network the **visitor's browser** connects from, not where any infrastructure lives. When a real customer loads your store, the request comes from their home or mobile ISP. When a scraper on a rented cloud instance loads your store, it comes from AWS. Where Shopify hosts its own servers never enters the picture, because Shopify's backend is not a shopper browsing your storefront through the app. So "block AWS" does not mean "block a huge slice of the web"; it means "block the connections that originate inside a server network," and for a retail store, almost the only things doing that are bots. The proof is in the exemption order. A request to a protected store from a real AWS address carrying a GPTBot identity is allowed, while a request from the same AWS address pretending to be an ordinary browser at scraper speed is blocked. Same network, opposite outcomes, because good bots are verified and cleared before the datacenter rule is ever consulted. The size of AWS is irrelevant when none of your customers are inside it. ## How to find which ASN your bad traffic comes from You need visibility before you block. Two practical routes: 1. **A visitor log with ASN data.** If your blocking app records the ASN for each visit, patterns surface fast: the same hosting ASN appearing behind hundreds of product-page hits at 3 a.m. is not a customer. Cordon's live visitor log shows the network behind every request (with the IP itself stored only as a SHA-256 hash with a daily-rotating salt, so the log stays GDPR-safe). 2. **A whois lookup.** Given a suspicious IP from your server logs, a whois query returns the owning ASN and the operator's name. It is a one-command check (`whois `) and every registry offers a web version. Once the same ASN keeps showing up behind scraping or fraud, you have a block candidate. Correlate it with the table above: hosting provider means block it, consumer ISP means find another tool. ## The risks: where ASN blocking goes wrong ASN blocking is a blunt instrument by design, and the bluntness cuts both ways. Three known failure cases: - **CDNs and infrastructure live in cloud ASNs.** Plenty of legitimate services route traffic through the same cloud providers scrapers use. Payment processors, app integrations, and monitoring services may all originate requests from cloud ASNs your storefront should answer. - **Corporate VPNs egress from datacenters.** An employee shopping from an office network whose VPN exits through a cloud provider looks, at the IP level, like datacenter traffic. This is a small share of shoppers, but it is not zero, especially for B2B stores. - **Privacy relays use CDN networks.** iCloud Private Relay routes Safari users through Akamai and Cloudflare address space. Block those ranges naively and you block real iPhone customers who never touched a VPN. The lesson is not to avoid ASN blocking. It is that raw ASN blocking needs an allowlist layer that carves out known-good infrastructure, privacy relays, and verified crawlers before the block rule fires. Any blocker that applies an ASN rule with no exemptions will eventually block someone you wanted. ## How Cordon implements ASN blocking Cordon treats the ASN as a first-class rule target, with the guardrails built in: - **One-rule ASN blocks.** Enter an ASN and the entire network is blocked. No range lists to maintain, no per-IP whack-a-mole. - **A curated datacenter list.** Instead of researching hosting providers yourself, enable datacenter blocking and Cordon applies a maintained list covering the major hosting networks (AWS, Alibaba, Tencent, Huawei Cloud, and the rest of the usual suspects). The "Anti-scraper" preset switches this on together with velocity and headless-browser detection. - **Verified good bots are always exempt.** This is the one that saves stores. Googlebot lives in Google's ASN, so a naive block on AS15169 would end your organic traffic. Cordon verifies search engines (Google, Bing) and known good bots (GPTBot, ClaudeBot, PerplexityBot, Ahrefs) against their published identities and always lets them through, even when a rule blocks the ASN they live in. You cannot lock Googlebot out by accident. - **Fails open, decides fast.** The detection decision takes under 50 milliseconds and never slows the storefront, and if the service hiccups, real customers shop normally. ASN rules also stack with the rest of the rule set: [country blocking](/blog/how-to-block-a-country-on-shopify), VPN/proxy/Tor detection, and scraper signals all feed the same allow-or-block decision. The full list is on the [features page](/features), and datacenter plus scraper detection is included from the Pro plan on the [pricing page](/pricing). ## Frequently asked questions ### What is an ASN in simple terms? An ASN (Autonomous System Number) is a unique ID assigned to a network operator, such as an ISP, a cloud provider, or a large company. Every IP address on the public internet belongs to exactly one autonomous system, so the ASN tells you who operates the network a visitor is coming from, regardless of which specific IP they use. ### Why is blocking an ASN more effective than blocking IP addresses? Because bots rotate IPs constantly but cannot easily change networks. A scraper farm can cycle through thousands of AWS addresses, yet every one belongs to the AWS ASN (AS16509). One ASN rule blocks the entire pool, including addresses the bot has not used yet, which ends the whack-a-mole of per-IP blocking. ### Is it safe to block datacenter ASNs like AWS or Hetzner? For most stores, yes: almost no real shopper browses from a rented server. The caveats are CDNs, corporate VPNs that egress through cloud providers, and privacy relays like iCloud Private Relay that use Akamai and Cloudflare ranges. A good blocker allowlists those cases and always exempts verified search engine crawlers. ### Does blocking AWS block Shopify or the apps I use? No. Cordon looks at the network each visitor connects from, not where infrastructure is hosted, so where Shopify runs its servers is irrelevant. Real shoppers connect from home and mobile ISPs, never from AWS. The one thing to watch is a legitimate cloud service that fetches your storefront, such as a headless frontend or a price-sync or monitoring tool. Allowlist those, and verified crawlers like Googlebot are exempt automatically. ### How do I find out which ASN bad traffic is coming from? Use a visitor log that records the ASN per visit, or run a whois lookup on a suspicious IP from your logs. When the same ASN keeps appearing behind scraping or fraud attempts, and it belongs to a hosting provider rather than a consumer ISP, that is your block candidate. ### Will blocking an ASN block Googlebot? Only with a naive blocker. Googlebot crawls from Google's own ASN, so a raw block on that network stops it cold. Cordon verifies good bots against their published identities and always allows them through, even when a rule blocks the ASN they operate from. --- If datacenter traffic is hammering your store, you can block it today without maintaining a single IP list. [Install Cordon from the Shopify App Store](https://apps.shopify.com/cordon), turn on the Anti-scraper preset, and watch the visitor log to see which networks were hitting you. Every paid plan comes with a 7-day free trial. --- # Blockify vs Cordon vs Blocky: Shopify Blockers Compared Published 2026-07-14 by Bas Lefeber. Canonical: https://usecordon.com/blog/blockify-vs-cordon-vs-blocky > **TL;DR:** Blockify, Blocky, and Cordon all block unwanted traffic on Shopify, but they are not built the same way. Blockify and Blocky are established, popular apps built around country and IP blocking backed by IP lists. Cordon makes a live detection decision per visit using commercial VPN, proxy, and datacenter data, verifies crawlers instead of trusting user-agents, and hashes every IP it logs. For a simple country block, any of the three works; if proxies and scrapers are costing you money, detection quality decides it. Search the Shopify App Store for a country blocker and Blockify and Blocky appear near the top. Both are established apps with large install bases. Cordon is the newer entrant, so a fair question is: what actually differs, and does it matter for your store? Feature checklists are a bad way to answer that, because every app in this category claims country blocking, VPN detection, and bot protection. The real differences live in how each capability is implemented, so this comparison uses seven evaluation criteria you can apply to any traffic-blocking app. Where I describe Blockify and Blocky, I go by their public App Store positioning as of July 2026. I build Cordon, so read those sections accordingly and verify the claims on a trial. ## 1. Detection quality: IP lists vs live data This is the criterion that separates the category. There are two ways to decide whether an IP belongs to a VPN, proxy, or datacenter. The first is the IP-list approach: maintain a database of known VPN and proxy addresses and check visitors against it. Based on their public positioning, this is how Blockify and Blocky work, along with most of the category. It is cheap, fast, and fine for datacenter VPNs whose ranges rarely change. The second is live detection: query a commercial fraud dataset at request time, continuously updated from real-world signals. This is what Cordon does for VPN, proxy, and Tor detection. The gap shows up with residential proxies, which route bot traffic through thousands of real home connections, each used for minutes before rotating. By the time an address lands on a static list, the proxy network has moved on. Scraper operators pay for residential proxies precisely because they defeat list-based blockers. The mechanics are in [how scrapers steal your product catalog](/blog/stop-scrapers-stealing-shopify-product-catalog). ## 2. Where the blocking happens Ask any blocker vendor one question: can it stop a client that never runs JavaScript? The honest answer, from every app in this comparison including Cordon, is no. Shopify does not allow apps or CDNs to sit in front of a standard storefront, so every blocking app works through a script in the page, and a bot that never executes JavaScript never triggers it. A vendor that implies its app blocks "before the request reaches your store" is describing something the platform does not permit. Given that shared ceiling, the differences that matter are speed and failure behavior. Cordon makes a sub-50ms detection decision and puts up a block screen that re-asserts itself if the theme tries to redraw over it, so browsers and headless bots get the block screen instead of a store they can use. If the detection service ever hiccups, Cordon fails open: real customers shop normally. That is the correct default, because a false block costs a sale while a missed block usually costs nothing. ## 3. Performance cost Every script you add to your storefront costs Lighthouse points, and Lighthouse points correlate with conversion. Check two things on any blocking app: how the script is injected and how heavy it is. Older apps in this category were built on script tags, which load render-blocking JavaScript on every page; Shopify has been pushing the ecosystem toward lighter theme app extensions instead. Cordon is a theme app extension from day one: no script tags, a small asset, an embedded admin. The detection call resolves in under 50 milliseconds and never blocks rendering. Details are on the [features page](/features). ## 4. SEO safety: verified crawlers vs trusted user-agents Here is the failure mode that quietly kills stores: a merchant enables aggressive bot blocking, the app blocks Googlebot, and organic traffic bleeds out for weeks before anyone connects the two events. The root cause is user-agent trust. A user-agent string is a self-declared label: anyone can send `Googlebot` in a header. An app that decides "bot or not" from the user-agent alone gets it wrong in both directions, blocking real crawlers and admitting fake ones. The correct approach is verification: confirm that a visitor claiming to be Googlebot actually comes from Google's published infrastructure. Cordon does this for search engines (Google, Bing) and known good bots (GPTBot, ClaudeBot, PerplexityBot, Ahrefs), and these verified crawlers are always allowed. You cannot block them even by accident, which is exactly the point. A "Googlebot" arriving from a Hetzner server is flagged as a spoofed crawler instead. Ask any vendor whether they verify crawlers or just pattern-match user-agents; the long version is in [do bot blockers hurt SEO](/blog/do-bot-blockers-hurt-seo). ## 5. Privacy and GDPR A visitor log full of raw IP addresses is a log full of personal data under GDPR: retention obligations, access requests, and privacy-policy questions most merchants would rather not own. Cordon stores visitor IPs as SHA-256 hashes with a salt that rotates daily. You still see patterns in the live visitor log (repeat offenders within a day, network origin, what was blocked and why), but yesterday's hashes cannot be joined to today's, and nothing in the log identifies a person. If you sell into the EU, ask every vendor how they store IPs and for how long. ## 6. Scraper-specific detection Country and VPN blocking do not stop scrapers, because commercial scrapers run from datacenters and proxies in whatever countries you allow. Catching them takes dedicated signals: - **Request velocity:** humans browse a few pages per minute, scrapers hit hundreds. - **Headless browser markers:** automation tools leave fingerprints normal browsers do not. - **Spoofed-crawler detection:** the fake-Googlebot check from the SEO section, applied as a block signal. - **Datacenter detection:** almost no real shopper browses from an AWS, Alibaba, Tencent, or Huawei Cloud server. Cordon ships all four, plus one-rule ASN blocking to remove an entire hosting provider's address space at once. Based on their public listings, Blockify and Blocky position primarily around country, IP, and fraud filtering rather than scraper-specific detection, so if scraping is your main problem, test this specifically. See [stop content scraping](/use-cases/stop-content-scraping) for how the layers combine. ## 7. Pricing structure Pricing in this category varies by features and traffic, so compare plans against your actual monthly visitor count rather than the headline price. Cordon's plans are on the [pricing page](/pricing): a free plan with basic country and bot blocking, Starter at $9/month (10k visitors), Growth at $19/month (100k visitors, adds VPN/proxy/Tor), Pro at $49/month (5M visitors, adds datacenter and scraper detection), and Plus at $99/month (365-day logs and priority support for the biggest stores), with a 7-day free trial on every paid plan. For Blockify and Blocky, check their current App Store listings; quoting prices that may change would not be fair or useful. ## Comparison table | Criterion | Blockify / Blocky (public positioning, July 2026) | Cordon | | --- | --- | --- | | Detection data | IP-list based country, IP, and fraud filtering | Live commercial VPN/proxy/Tor data per visit | | Blocking layer | JavaScript-based storefront blocking | Same layer (the platform allows nothing else); sub-50ms decision, theme app extension | | Failure mode | Verify with the vendor | Fails open; outages never block customers | | Crawler handling | Verify with the vendor | Verified Google/Bing and good bots always allowed | | IP storage | Verify with the vendor | SHA-256 hashed, daily-rotating salt | | Scraper detection | Not the core positioning | Velocity, headless markers, spoofed crawlers, datacenter ASNs | | Pricing | See current App Store listings | Free plan; $9 to $99/mo by visitors, 7-day trial | ## Verdict: who should pick what **If you only need a country block**, you have several fine options, and Blockify and Blocky both have the track record to prove they handle that use case. Cordon does it too (200+ countries, one-click flag picker, presets like "Block China"), but a simple country block alone is not a reason to switch apps. **If you are losing money to proxy fraud or scrapers**, detection quality becomes the whole decision. Residential proxies evade static lists by design, and scrapers ignore JavaScript blocks by design. You need live detection data and request-level signals, applied per visit rather than from a static list. That is the case Cordon was built for; merchants seeing checkout fraud through VPNs should start with [block VPN checkout fraud](/use-cases/block-vpn-checkout-fraud). **Whatever you pick**, run the trial against real traffic and check three things: does the visitor log show blocked scrapers you recognize, did your Lighthouse score hold, and can you still fetch your homepage as Googlebot from Search Console. Deeper head-to-head pages: [Cordon vs Blockify](/compare/cordon-vs-blockify) and [Cordon vs Blocky](/compare/cordon-vs-blocky). ## Frequently asked questions ### What is the best Blockify alternative for Shopify? It depends on the problem. If you only need to hide your store from a few countries, several apps handle that fine, including Blockify and Blocky themselves. If you are losing money to residential proxies, VPN fraud, or scrapers, you need live commercial detection data instead of static IP lists, which is the case Cordon was built for. ### Do Blockify and Blocky use the same detection method as Cordon? Based on their public listings as of July 2026, both are IP-list based blockers focused on country and IP blocking with fraud filtering. Cordon queries live commercial VPN and proxy detection data per visit instead of matching a downloaded list, which matters most for residential proxies that rotate faster than lists update. ### Can a traffic-blocking app hurt my Shopify SEO? Yes, if it blocks search engine crawlers. A blocker that trusts user-agent strings fails in both directions: real Googlebot gets caught by an aggressive rule, or a scraper pretending to be Googlebot walks in untouched. Cordon verifies crawlers against their published identities and never blocks verified search engines, on any setting. ### Is it GDPR-compliant to log visitor IP addresses? IP addresses are personal data under GDPR, so storing them raw creates real obligations. Cordon stores SHA-256 hashed IPs with a daily-rotating salt, keeping the log useful for spotting patterns without holding identifiable data. Ask any vendor how they store IPs before you install. ### How much do Shopify traffic-blocking apps cost? Most apps in the category sit between free and roughly $50/month depending on features and traffic. Cordon has a free plan, paid plans from $9 to $99/month priced by visitor volume, and a 7-day free trial on every paid plan. --- To test the live-detection approach against your own traffic, [install Cordon from the Shopify App Store](https://apps.shopify.com/cordon). The free plan covers basic country and bot blocking, and every paid plan starts with a 7-day trial. --- # Do Bot Blockers Hurt SEO? Block Bots, Not Google Published 2026-07-13 by Bas Lefeber. Canonical: https://usecordon.com/blog/do-bot-blockers-hurt-seo > **TL;DR:** A bot blocker hurts SEO only if it can block search engine crawlers, and a properly built one cannot. The correct architecture verifies Googlebot and other good bots cryptographically-adjacent (published IP ranges plus reverse DNS confirmation) and then always allows them, before any blocking rule runs. Blocking the fake Googlebots that fail verification actually helps SEO, because those are scrapers wasting your crawl budget. The most common question merchants ask before installing any traffic filter is some version of: "Will this get me deindexed?" It is the right question. A blocker that cannot tell Googlebot from a scraper is a liability, and crude tools have burned stores before. This post explains how real crawler verification works, why the answer to the title is "only badly built ones," and what to check before you install any bot blocker, including ours. ## The fear is legitimate If a tool blocks Googlebot, Google eventually stops crawling your store, your pages go stale in the index, and rankings decay. If it serves Googlebot a block screen while serving customers your product pages, you risk being evaluated on the wrong content. These are not hypotheticals; the horror stories in SEO forums almost always trace back to the same cause: an IP-list blocker that swept a Google range into a "datacenter" blocklist, or a firewall rule someone wrote by hand and forgot. So the question is not whether bot blocking can go wrong. It can. The question is what separates a blocker that is safe for SEO from one that is not, and the answer is a single architectural property: whether search engines are verified and then structurally exempt from blocking, or merely "not on the list today." ## How crawler verification actually works Search engines want to be identified. Google publishes the IP ranges its crawlers use and documents a verification procedure on [developers.google.com](https://developers.google.com); Bing does the same for Bingbot. Verification is a two-step handshake anyone can perform: 1. Take the visiting IP and do a reverse DNS lookup. A genuine Googlebot IP resolves to a hostname ending in `googlebot.com` or `google.com`. 2. Do a forward DNS lookup on that hostname. It must resolve back to the same IP you started with. The forward-confirm step is what makes this trustworthy. Anyone can point reverse DNS at a domain they do not own, but only Google can make `crawl-66-249-66-1.googlebot.com` resolve back to Google's own address. Combined with the published IP ranges, this gives a definitive answer: this visitor either is Googlebot or is lying about it. That second case is common. Scrapers routinely send `Googlebot` as their user agent because they assume, correctly, that many sites give Googlebot a free pass. But a "Googlebot" request arriving from an AWS or Alibaba Cloud IP fails verification instantly: wrong IP range, no googlebot.com reverse DNS, no forward confirmation. It is a scraper wearing a costume. ## The right architecture: verify, then always allow There are two ways to build search engine safety into a blocker, and they are not equivalent: | Approach | How it works | Failure mode | | --- | --- | --- | | Try not to block them | Maintain an exception list, hope the blocklists never overlap Google's ranges | One stale list update blocks Googlebot silently | | Verify, then always allow | Verify crawlers first; verified good bots bypass all blocking rules by design | None: no rule, preset, or misconfiguration can reach them | Cordon uses the second architecture. Verified search engines (Google, Bing) and verified good bots are always allowed and cannot be blocked, period. Not by a country rule, not by an ASN rule, not by the Strict mode preset, not by a merchant clicking the wrong toggle at midnight. The allow decision for verified crawlers happens before the rule engine runs, so there is no configuration state in which Googlebot sees a block screen. When we [compare Cordon against Blockify](/compare/cordon-vs-blockify), this is one of the structural differences worth checking on any competitor: ask whether search engines are exempt by architecture or by list maintenance. ## Blocking fake Googlebots is good for SEO Here is the counterintuitive part: spoofed-crawler detection does not just avoid hurting SEO, it helps it. Every fake Googlebot on your store is a scraper. It is copying your product descriptions for a competitor, harvesting your prices for a repricing tool, or cloning your catalog for a counterfeit storefront. Duplicate copies of your content on other domains are an SEO problem you did not create. And on large catalogs, heavy scraper traffic competes with real crawlers for server responsiveness, which is one input into how much Google is willing to crawl. Filtering out the impostors means your crawl budget is spent by crawlers that actually index you, and your content stays yours. If catalog theft is your main concern, the [content scraping use case](/use-cases/stop-content-scraping) and our [guide to catalog scrapers](/blog/stop-scrapers-stealing-shopify-product-catalog) go deeper. ## The new dimension: AI crawlers are the new Googlebot Search is no longer the only discovery channel that crawls your store. GPTBot, ClaudeBot, PerplexityBot, and OAI-SearchBot feed the AI assistants that shoppers increasingly ask for product recommendations. When someone asks an assistant "best waterproof hiking boots under 200 euros," the stores present in that answer are the stores whose pages the assistant's crawlers could read. Blocking AI crawlers therefore has a real cost: you disappear from AI-generated answers. Some publishers make that trade deliberately; for a store that wants to be found, it is usually the wrong call. Cordon treats verified AI crawlers the same as verified search engines: always allowed, alongside SEO tools like Ahrefs whose crawlers your own marketing team depends on. The scrapers pretending to be them still get caught, because pretending fails verification. ## What actually hurts SEO (and how to avoid all three) Bot blockers can damage SEO through mechanisms that have nothing to do with blocklists: **Slow JavaScript.** A blocker that loads a heavy script before deciding adds render-blocking work to every page view. That delays LCP, drags your Lighthouse score, and Core Web Vitals are a ranking input. The blocker punishes every customer to catch a minority of bots. **Interstitial block screens served to crawlers.** Some tools show every unverified visitor a challenge page first. If a crawler ever lands on that interstitial, that challenge page is what gets indexed instead of your product. **Cloaking risk.** Serving crawlers meaningfully different content than users is against Google's guidelines. A poorly designed blocker that special-cases crawlers with different page content flirts with this line. Cordon's design avoids all three at once: the detection decision completes in under 50 milliseconds, it ships as a theme app extension rather than an injected script tag, and verified crawlers receive the identical page a customer receives, always. Real customers are never challenged, and if the detection service ever hiccups, Cordon fails open and everyone shops normally. The full mechanics are on the [features page](/features). ## How to evaluate any bot blocker before installing Run this checklist against any traffic-filtering app, ours included: 1. **Ask how search engines are protected.** The answer should be "verified and structurally always allowed," not "they're on our whitelist." Lists rot; architecture does not. 2. **Ask whether verification uses reverse DNS and published IP ranges,** or just the user agent string. User agent alone is trivially spoofed in both directions. 3. **Check the AI crawler policy.** GPTBot, ClaudeBot, and PerplexityBot should be treated as good bots by default, not swept into a generic bot category. 4. **Check how it loads on the storefront.** Theme app extension is the Shopify-sanctioned mechanism (documented on [shopify.dev](https://shopify.dev)); script tag injection is the legacy pattern that slows pages and survives uninstalls badly. 5. **Measure before and after.** Run Lighthouse on a product page, install the app, run it again. More than a point or two of movement is a red flag. 6. **Verify crawl health after a week.** Check Google Search Console's crawl stats for drops, and confirm your visitor log shows verified crawlers passing through. 7. **Confirm it fails open.** Ask what happens to customers if the vendor's detection service goes down. The only acceptable answer is "nothing." A blocker that passes all seven is safe to run. A blocker that stumbles on the first two can cost you rankings no matter how good the rest of it is. Pricing tiers and what each Cordon plan includes are on the [pricing page](/pricing). ## Frequently asked questions ### Can a bot blocker accidentally block Googlebot? Yes, if it is built on crude IP lists or heuristics with no verification layer. That is where the deindexing horror stories come from. A well-built blocker verifies search engine crawlers through published IP ranges and reverse DNS confirmation, then allows them before any blocking rule is evaluated, which makes accidental blocking structurally impossible. ### Does Cordon ever block Google or Bing? No. Verified search engines are always allowed and cannot be blocked in Cordon, even by manual country, IP, or ASN rules, and even under the Strict mode preset. The allow decision for verified crawlers happens before the rule engine runs, so no configuration can put a block screen in front of Googlebot. ### Should I block AI crawlers like GPTBot or ClaudeBot? For most stores, no. AI assistants are now a real product discovery channel, and the stores that appear in AI-generated answers are the ones whose pages the assistants' crawlers could read. Cordon treats verified AI crawlers (GPTBot, ClaudeBot, PerplexityBot) as good bots and always allows them, while still blocking scrapers that impersonate them. ### How do I verify whether a Googlebot visit is real? Run a reverse DNS lookup on the visiting IP: a real Googlebot resolves to a hostname on googlebot.com or google.com. Then resolve that hostname forward and confirm it returns the same IP. A scraper sending the Googlebot user agent from a cloud server fails both steps. Google documents the procedure and publishes its crawler IP ranges. ### Do bot blockers slow down my store? The JavaScript-heavy ones can, by adding render-blocking work that delays LCP and drags Core Web Vitals, which are a ranking input. A blocker that makes its decision in under 50 milliseconds and integrates as a theme app extension instead of an injected script adds no meaningful latency, so your Lighthouse score stays where it was. --- Blocking bots and ranking well are not in tension when the blocker verifies crawlers instead of guessing. If you want scrapers gone and Googlebot untouched, [try Cordon on the Shopify App Store](https://apps.shopify.com/cordon). The free plan covers basic bot blocking, and every paid plan has a 7-day free trial. --- # Shopify VPN Fraud: How to Stop Proxy Checkout Fraud Published 2026-07-12 by Bas Lefeber. Canonical: https://usecordon.com/blog/vpn-proxy-checkout-fraud-shopify > **TL;DR:** VPN and proxy checkout fraud works by making the attacker's IP address lie about where they are. Stolen card testing, serial refund abuse, and drop sniping all rely on rotating anonymized IPs. Shopify's built-in fraud analysis only flags orders after they exist. Blocking anonymized traffic at the visit level, with a fraud-score threshold so ordinary privacy users still get through, stops most of it before checkout is ever reached. Every fraudulent order starts with a visit. Before the stolen card number is typed, someone connects to your storefront from an IP address. Fraudsters know that IP is their weakest link, so they hide it. This post explains how that hiding works, what it costs, and how to block it without also blocking honest customers who happen to use a VPN. ## The fraud pattern: anonymized IPs before the order exists Card fraud on Shopify follows a predictable shape. Someone buys a batch of stolen card numbers, then needs to test which cards still work and cash out the live ones. Both steps happen behind a VPN, a residential proxy network, or Tor, because the fraudster's real IP would place them in a different country than the card's billing address. That mismatch is the oldest fraud signal in payments, so professional fraud hides it first. Card testing is the noisy version: rapid small orders to see which numbers authorize. Cash-out is the quiet version: a single large order shipped to a freight forwarder or reshipping mule. Both arrive through anonymized connections, usually a different IP per attempt. The same infrastructure serves non-card abuse too. Serial refund abusers who have been banned once come back through a fresh IP and a fresh email. Discount-code farmers create dozens of accounts to claim a first-order coupon repeatedly, rotating IPs so account-per-IP limits never trigger. And when you run a limited product drop, sniping bots check out through pools of thousands of residential proxies, so each purchase looks like a different household. The [proxy pools that snipe drops](/blog/stop-scrapers-stealing-shopify-product-catalog) are often the same ones that scrape catalogs. ## Why 2018-era IP reputation lists fail Most legacy blocking apps work from downloaded IP reputation lists: a snapshot of known VPN exit nodes, datacenter ranges, and proxies, refreshed occasionally. That approach made sense when anonymization meant renting a server. It does not survive contact with residential proxies. A residential proxy routes the fraudster's traffic through a real home internet connection. The exit IP belongs to an actual consumer ISP, often on a connection whose owner installed a "free VPN" app that quietly resells their bandwidth. On paper the visitor is a household on a cable modem. No static list can flag that, because the IP genuinely is residential, and it may only act as a proxy for a few hours before the pool rotates it out. Detecting this requires live commercial detection data: providers that score each IP on how it is behaving right now, not what network block it belonged to years ago. This is the core difference between Cordon and list-based blockers. Cordon queries live detection data per visitor and caches the decision, rather than shipping a stale list. The [feature breakdown](/features) covers what each signal contributes. ## What proxy checkout fraud actually costs | Cost | Mechanism | | --- | --- | | Chargeback amount | The cardholder disputes the charge, you refund the full order value | | Chargeback fee | Your payment processor charges a fixed fee per dispute, win or lose | | Lost inventory | Physical goods shipped to a mule or forwarder are gone | | Fulfillment cost | Picking, packing, and shipping paid on an order that reverses | | Processor risk score | Sustained disputes raise your rate profile and can trigger reserves or termination | | Card-testing fees | Hundreds of failed authorizations still incur per-transaction costs | The last two rows matter most. A store can absorb one chargeback, but a rising dispute ratio gets you flagged by your processor, and once you are in a high-risk bucket, everything gets more expensive. Prevention is cheaper than dispute management at every scale. ## Reading the signals You can spot proxy checkout fraud in your own order data before you install anything. Three signals carry most of the weight: **IP country versus shipping country.** A visitor whose IP resolves to one country ordering delivery to another is not automatically fraud (expats and gift buyers exist), but a cluster of such orders in a short window is, especially when the IP country also fails to match the card's billing country. If one region is the consistent source, [blocking that country outright](/blog/how-to-block-a-country-on-shopify) is a blunt but effective first response. **A datacenter ASN at checkout.** Every IP belongs to an autonomous system, and the ASN tells you who operates the network. Real shoppers browse from consumer ISPs and mobile carriers. A checkout completed from an AWS, Alibaba, Tencent, or Huawei Cloud address is a script, full stop; humans do not shop from inside a datacenter. If you are new to network-level signals, the [ASN explainer](/blog/what-is-an-asn-block-bad-bots) covers how one rule can cover an entire hosting provider. **Many accounts from one network.** Discount farmers and refund abusers rotate IPs, but proxy pools have finite breadth, so the accounts still cluster: same ASN, same city-level geolocation, same device fingerprint, created within hours of each other. Five new accounts from one network claiming the same welcome code is not a coincidence. ## What Shopify gives you natively, and where it stops Shopify includes fraud analysis on qualifying plans, and it is genuinely useful: it scores each order and flags high-risk ones for review. The documentation at [help.shopify.com](https://help.shopify.com) covers how the indicators work. The structural limitation is timing. Fraud analysis evaluates an order that already exists. The authorization already hit your processor, the inventory is already reserved, and on automated fulfillment the order may already be moving before anyone reads the flag. Blocking at the visit level inverts this. If the anonymized visitor is stopped on the page they land on, there is no cart, no authorization attempt, and no order to review. The visit itself still counts as a session in Shopify Analytics, because Shopify serves the page and records the pageview before any app can act. What blocking prevents is everything that comes after it, which is where the cost is. The two layers are complementary: visit-level blocking as the filter, Shopify fraud analysis as the safety net for whatever gets through. ## How Cordon blocks it Cordon makes its detection decision on page load, in under 50 milliseconds, using live commercial VPN, proxy, and Tor detection data. VPN and proxy blocking is available on the [Growth plan](/pricing) and above. The design choice that matters most is the fraud-score threshold. Cordon does not block an IP just because it is technically a relay. Low-risk privacy services, most visibly iCloud Private Relay, which is switched on by default for millions of iPhone users, score below the threshold and pass through. High-risk exits, rotating residential proxies, and Tor score above it and get the block screen. This is the difference between blocking anonymized fraud and blocking everyone who cares about privacy. Cordon also fails open. If the detection service ever hiccups, real customers shop normally instead of hitting an error. A fraud filter that can take your store down is worse than no filter. ## Not every VPN user is a fraudster This deserves its own section because it is the most common objection, and it is correct. Plenty of legitimate customers browse through a VPN: corporate laptops, privacy-conscious shoppers, travelers on hotel Wi-Fi. Blocking all of them by default is a mistake for most stores. The practical pattern we see: many merchants leave VPN blocking off during normal operation, enable it when a fraud wave starts, and turn it off once the attack burns out. Cordon supports this directly. VPN blocking is a per-store toggle, and the allowlist exempts known customers permanently. The [live visitor log](/features) shows exactly who was blocked and why, with SHA-256 hashed IPs so the log itself stays GDPR-safe. ## Setting up VPN and proxy blocking 1. Review your recent flagged orders and note the pattern: IP versus billing country mismatches, repeated ASNs, account clusters. 2. Install Cordon and enable the app embed in your theme (it is a theme app extension, no script tags, no theme code edits). 3. Start with country and bot blocking on the free plan if you only need geography-level control. 4. On Growth or above, toggle on VPN, proxy, and Tor blocking, or use the Anti-scraper preset as a starting point. 5. Add known VPN-using customers to the allowlist. 6. Watch the visitor log for a few days and adjust. Blocked-visit entries tell you what the filter caught; the [VPN checkout fraud use case page](/use-cases/block-vpn-checkout-fraud) walks through a full configuration. ## Frequently asked questions ### Does blocking VPNs on Shopify stop all checkout fraud? No, and any vendor claiming otherwise is overselling. What it does is remove the anonymity layer that card testers, serial refund abusers, and discount farmers depend on. Fraud that has to run from a real, traceable connection is rarer, riskier for the attacker, and easier to dispute when it happens. Keep Shopify fraud analysis as your second layer. ### Will blocking VPNs also block legitimate customers? Not if the blocker distinguishes risk levels. Cordon applies a fraud-score threshold, so low-risk privacy services like iCloud Private Relay pass through untouched, and you can allowlist known customers who shop through a VPN. Blanket blocking of every relay is the legacy approach, and it is why VPN blocking got a bad reputation. ### Why doesn't Shopify's built-in fraud analysis solve this? Shopify fraud analysis scores an order after it is placed. By then the payment attempt, the inventory hold, and the processor risk signal already exist, and on automated fulfillment the order may already be moving. Blocking at the visit level prevents the order from ever being created, which is cheaper in every way. ### What is a residential proxy and why is it hard to detect? A residential proxy routes traffic through a real home internet connection, usually an infected device or a bandwidth-sharing app the owner barely knows they installed. The exit IP genuinely belongs to a consumer ISP, so static IP lists see a normal household. Detection requires live commercial data that scores how an IP is behaving right now. ### Which Cordon plan includes VPN and proxy blocking? VPN, proxy, and Tor detection starts on the Growth plan at $19 per month for 100k visitors, and is included on every plan above it. Every paid plan comes with a 7-day free trial, so you can enable it during a fraud wave and evaluate it on your own traffic. --- If your flagged-order queue is growing and the IPs never match the shipping addresses, visit-level blocking is the fix that works before the damage, not after. [Try Cordon on the Shopify App Store](https://apps.shopify.com/cordon) with a 7-day free trial on every paid plan. --- # Stop Scrapers Stealing Your Shopify Product Catalog Published 2026-07-10 by Bas Lefeber. Canonical: https://usecordon.com/blog/stop-scrapers-stealing-shopify-product-catalog > **TL;DR:** Every Shopify store ships with its full catalog exposed through `/products.json` and the sitemap, and robots.txt does nothing to stop a scraper that ignores it. Stopping catalog theft takes layered detection: user-agent fingerprinting, headless browser markers, request-velocity limits, spoofed-crawler verification, and datacenter ASN blocking. [Cordon](https://apps.shopify.com/cordon) runs all five layers while always allowing verified search engines and good bots, so SEO is never at risk. Watch it happen to your own store: [the free scan](/scan) copies your live catalogue in front of you, then deletes it. If a competitor's store looks suspiciously like yours, same products, same descriptions, prices always one euro under, you are probably not imagining it. Catalog scraping on Shopify is cheap, automated, and common, because the platform makes catalogs unusually easy to extract. This post explains how it works and which defenses hold up. ## How catalog scraping works on Shopify Shopify stores are the easiest e-commerce platform to scrape, and it is worth understanding why. **Every store exposes structured catalog endpoints by default.** Append `/products.json` to almost any Shopify store URL and you get a clean, paginated JSON feed of products: titles, descriptions, variants, prices, image URLs. The sitemap (`/sitemap.xml`) lists every product page. Neither requires a login or an API key, so a scraper does not need to parse your HTML at all. Shopify's own developer documentation ([shopify.dev](https://shopify.dev)) treats these as public surface area, and you cannot turn them off. **The tooling is commodity.** The typical scraping stack, roughly in order of sophistication: 1. **python-requests or curl** hitting `/products.json` in a loop. Trivial to write, no browser involved, identifiable by its default user agent unless the operator fakes one. 2. **Scrapy**, the industrial framework, which handles pagination, retries, and rotation and can crawl your whole sitemap in minutes. 3. **Puppeteer, Selenium, and headless Chrome** for cases where simple scripts are already blocked. These present as real browsers at first glance. **The infrastructure is predictable.** Most scraping runs from datacenter networks: AWS, Alibaba Cloud, Tencent, Huawei Cloud, and the long tail of VPS providers. Real shoppers do not browse from an AWS IP range. Careful operators route through residential proxy networks to look like home connections, which defeats network-based checks but not behavioral ones. ## What scrapers do with your data Scraped catalogs feed three concrete businesses: - **Price undercutting.** Automated repricers watch your catalog and set their prices just below yours, permanently. You are competing with your own price feed minus a margin. - **Catalog cloning.** Dropshipping copycats lift your titles, descriptions, and images wholesale, spin up a store selling the same products, and run ads against your keywords. - **Review and content theft.** Product reviews, size guides, and buying guides get scraped and republished, sometimes outranking the original. Your content took time and money to produce, and scraping transfers it for free. The full breakdown is on our [stop content scraping](/use-cases/stop-content-scraping) page. ## Why robots.txt does not stop them Robots.txt is a text file that politely asks crawlers to stay out of certain paths. Googlebot honors it. Bingbot honors it. A scraper copying your catalog reads it, if at all, as a map of what you consider valuable. There is no enforcement: the server serves the page whether the client honored the file or not. Anything that claims to stop scrapers via robots.txt, meta tags, or terms-of-service pages is decoration. Stopping scrapers means detecting and refusing requests. ## Detection layers that actually work No single check catches everything, which is why serious scraper protection is layered. Five layers, what each catches, and what Cordon does at each: | Layer | Catches | Misses | |---|---|---| | User-agent fingerprinting | Lazy scripts, default UAs, malformed headers | Anyone who spoofs a browser UA | | Headless browser markers | Puppeteer, Selenium, headless Chrome | Plain HTTP scripts (caught by layer 1) | | Request-velocity detection | Anything crawling faster than a human | Slow, patient scrapers | | Spoofed-crawler verification | Fake Googlebots and fake Bingbots | Scrapers not pretending to be crawlers | | Datacenter ASN blocking | Cloud-hosted scrapers (the majority) | Residential proxy traffic | A scraper has to beat all five simultaneously, and each evasion makes them more expensive to run and easier to catch on another layer. ### 1. User-agent fingerprinting The cheapest scrapers do not bother disguising themselves. `python-requests/2.31`, Scrapy's default agent, empty user agents, and header combinations no real browser sends are all dead giveaways. Cordon fingerprints the user agent and the surrounding request headers and blocks the obvious automation outright. This layer alone removes a surprising share of scraping volume, because most scraping is lazy. ### 2. Headless browser markers Puppeteer and Selenium drive real Chrome, so the user agent looks legitimate. But headless browsers leak: automation flags, missing browser features, and property mismatches that real user-driven browsers do not exhibit. Cordon checks for these markers and blocks confirmed automation only. An in-app webview or an unusual but human browser never trips this layer, because Cordon acts on definitive automation signals rather than heuristic guesses. ### 3. Request-velocity detection Behavior is the hardest thing to fake. A real shopper browses a few product pages a minute, lingers, backtracks, adds something to cart. A scraper loads 40 product pages in 30 seconds in perfect sequential order. No user agent spoofing and no residential proxy changes that pattern, because the pattern *is* the job: a scraper that crawls at human speed takes days per store and stops being economical. Cordon tracks request velocity per visitor and blocks clients whose crawl rate no human shopper could produce. This is the layer that catches the careful operators who beat every other check. ### 4. Spoofed-crawler verification The oldest trick in scraping: set your user agent to `Googlebot` and watch naive defenses wave you through, since nobody wants to block Google. The defense is verification. The real Googlebot comes from Google's own network, and that is checkable. Cordon verifies crawler claims against the actual network: a "Googlebot" arriving from an Alibaba Cloud IP is a scraper wearing a costume, and it gets blocked. The real Googlebot passes verification and is always allowed, no configuration needed. ### 5. Datacenter ASN blocking Every network on the internet belongs to an autonomous system with an ASN, and cloud providers' ASNs are public knowledge. AWS, Alibaba Cloud, Tencent, Huawei Cloud: these networks host servers, not shoppers. Cordon blocks entire datacenter networks, and whole ASNs, with a single rule, removing the scraping industry's default habitat in one move. Real customers browse from residential ISPs and mobile carriers, so the false-positive cost is near zero. Deeper explainer here: [what is an ASN and why block one](/blog/what-is-an-asn-block-bad-bots). And if the scraper origin clusters geographically, [country blocking](/use-cases/block-traffic-by-country) stacks on top with a one-click flag picker. ## The bots you must not block Scraper protection that hurts your SEO is worse than no protection. Cordon hard-codes the safeguard: **verified Google and Bing crawlers are always allowed and cannot be blocked**, by any rule, preset, or misconfiguration. The same allowlist covers the good bots that now drive real discovery: **GPTBot, ClaudeBot, PerplexityBot** (AI search visibility) and **Ahrefs** (your own SEO tooling). Blocking scrapers and staying fully visible to search and AI answers are not in tension when verification is done properly. If you want the full argument, read [do bot blockers hurt SEO?](/blog/do-bot-blockers-hurt-seo) ## Setting up scraper protection with Cordon 1. **Install Cordon** from the [Shopify App Store](https://apps.shopify.com/cordon). It is a theme app extension with an embedded admin: no script tags, no theme edits, Lighthouse-friendly. 2. **Apply the "Anti-scraper" preset.** It enables user-agent fingerprinting, headless markers, velocity detection, and spoofed-crawler verification in one click. (There is also a "Strict mode" preset if you want the aggressive version.) 3. **Turn on datacenter network blocking** to cut off AWS, Alibaba, Tencent, Huawei Cloud and the rest of the hosting world, or block specific ASNs you see in your logs. 4. **Watch the live visitor log.** Every decision shows up in real time, with IPs SHA-256 hashed under a daily-rotating salt so the log stays GDPR-safe. This is where you confirm scrapers are dying and shoppers are not. 5. **Add allowlist entries** for any partner, feed service, or monitoring tool of your own that legitimately needs automated access. Every decision completes in under 50 milliseconds and never slows the storefront. If the service ever hiccups, it fails open: real customers shop normally. Datacenter and scraper detection ship on the Pro plan ($49/mo, 5M visitors); basic bot blocking is on the Free plan, and every paid plan has a 7-day trial. The [pricing page](/pricing) has the full matrix, and [features](/features) covers the detection engine in full. ## Frequently asked questions ### How do scrapers get my Shopify product catalog? Through the public surface every Shopify store exposes by default: `/products.json` returns a clean JSON feed of your products, variants, prices, and image URLs, and the sitemap lists every product page. No login or API key is needed, and these endpoints cannot be turned off, which is why the defense has to happen at the traffic level. ### Does robots.txt stop scrapers on Shopify? No. Robots.txt is a request, not an enforcement mechanism. Legitimate crawlers like Googlebot respect it, but a scraper copying your catalog ignores it, or uses it as a map of what you consider valuable. Stopping scrapers requires detecting and refusing their requests, which robots.txt cannot do. ### Will scraper protection block Google or hurt my SEO? Not with verified-crawler allowlisting. Cordon checks that a crawler claiming to be Googlebot actually comes from Google's network and always allows verified search engines, with no way to block them even by misconfiguration. Good bots like GPTBot, ClaudeBot, PerplexityBot, and Ahrefs stay allowed too, so SEO and AI search visibility are never hurt. ### Can scrapers using headless Chrome or residential proxies still be caught? Yes. Headless Chrome driven by Puppeteer or Selenium leaves detectable automation markers even with a perfect user agent. And residential proxies only disguise the network, not the behavior: request-velocity detection catches any client loading product pages far faster than a human shopper, regardless of where the requests appear to come from. ### What is datacenter ASN blocking and why does it matter for scrapers? Every network belongs to an autonomous system identified by an ASN, and cloud providers like AWS, Alibaba, Tencent, and Huawei Cloud have well-known ones. Blocking the ASN blocks the entire network with one rule. Since scrapers overwhelmingly run on cloud servers and real shoppers browse from residential and mobile networks, it is one of the highest-value, lowest-collateral rules you can set. ## Wrapping up Your catalog is exposed by default and robots.txt will not save it. But the scrapers taking it are identifiable: by their tooling, their behavior, their fake crawler costumes, and the datacenter networks they run from. [Install Cordon from the Shopify App Store](https://apps.shopify.com/cordon), apply the Anti-scraper preset, and watch the visitor log do its work. Free plan available, 7-day trial on every paid plan. --- # How to Block a Country on Shopify (2026 Guide) Published 2026-07-08 by Bas Lefeber. Canonical: https://usecordon.com/blog/how-to-block-a-country-on-shopify > **TL;DR:** Shopify has no built-in way to block visitors from a country. Shopify Markets controls where you sell and ship, not who can browse. To actually block a country you need either a fragile theme-level liquid hack or a traffic-blocking app like [Cordon](https://apps.shopify.com/cordon), which decides on page load and never blocks verified search engines like Google. Every week merchants search for "how to block a country on Shopify" and land on forum threads full of half-working liquid snippets. This guide covers why merchants block countries, what Shopify actually offers natively (less than you think), and the three realistic options in 2026. ## Why merchants block countries Country blocking sounds heavy-handed until you have run a store for a year and looked at where your problems come from: - **Fraud hotspots.** Chargeback rates are not evenly distributed. They cluster in a handful of countries, and if you have eaten three chargebacks from orders you could never fulfill anyway, blocking the source is a rational move. - **Scraper origins.** A large share of catalog scraping and price-monitoring traffic originates from specific regions and from datacenter networks headquartered there. If your competitors clone your catalog, the requests often come from a predictable set of countries. (More on that in our guide to [stopping content scraping](/use-cases/stop-content-scraping).) - **No-ship regions.** If you will never ship to a country, every visitor from it is either a lost cause, a bot, or a fraud attempt using a stolen card with a mismatched region. Serving them pages costs you bandwidth and pollutes your analytics. - **Carding and gift card testing.** Automated card-testing runs tend to originate from a small set of regions, often routed through VPNs. Blocking the country plus [blocking VPN checkout fraud](/use-cases/block-vpn-checkout-fraud) closes both the front door and the side door. None of this is about disliking a country. It is about the traffic quality you actually observe in your own logs. ## What Shopify offers natively (and what it does not) This is the part most guides get wrong, so let's be precise. **Shopify Markets controls where you sell.** You can define which countries appear in your market settings, which currencies you support, and where you ship. If a country is not in any market, customers there cannot complete checkout with a shipping address in that country. **Shopify Markets does not block visitors.** A visitor from an excluded country can still load every page of your store, read every product description, download every image, add items to cart, and scrape your entire catalog through `/products.json`. Markets is a selling configuration, not a traffic filter. **There is no built-in visitor-level country block.** Nothing in the Shopify admin lets you say "do not serve pages to visitors from country X." Shopify's own documentation on international selling (see [help.shopify.com](https://help.shopify.com)) covers markets, duties, and shipping zones; visitor blocking is out of scope for the platform. If your goal is "people from country X should not be able to browse my store at all," you need to add something. There are three ways to do it. ## Your three options compared | Option | Stops the visitor browsing | Survives theme updates | Bypassable | Setup effort | Cost | |---|---|---|---|---|---| | Liquid/JS theme hack | Briefly, and trivially undone | No | Trivially (disable JS) | High, per theme | Free | | Traffic-blocking app (Cordon) | Yes, on page load | Yes | VPN only, and that is detectable | Minutes | Free plan available | | Cloudflare/firewall (headless) | Yes, the request never reaches your store | N/A | VPN only | High, needs proxy control | Infra dependent | ### Option 1: manual .liquid or JavaScript hacks The forum-thread classic: paste a snippet into `theme.liquid` that reads a geolocation value and redirects or hides the page. It sort of works, and here is why it is a bad primary mechanism: - **It has no idea who it is talking to.** A snippet reads a country code and nothing else. It cannot tell a customer from a scraper, a rotating proxy from a home connection, or a real Googlebot from something wearing its name. That last one is how stores accidentally deindex themselves. - **It is trivially bypassable and stays bypassed.** Disable JavaScript, or just request the page with `curl`, and the block never runs again. A purpose-built blocker has the same JavaScript ceiling for raw HTTP clients, but for anyone using an actual browser the block screen re-asserts itself and cannot be clicked away. - **It is theme-dependent and breaks on updates.** Every theme update can wipe or conflict with the snippet. Every theme switch means redoing the work. - **Geolocation quality is poor.** Most snippets rely on free geo lookups that are rate-limited, inaccurate, or both. It is a screen door, not a lock. ### Option 2: a traffic-blocking app This is the right answer for almost every merchant on a standard Shopify theme. A purpose-built app like Cordon makes the allow-or-block decision on the first page load, and a blocked visitor gets your block screen instead of a store they can browse, search, or buy from. What that looks like in practice: - **200+ countries with a one-click flag picker.** Tick the flag, save, done. - **Quick presets** like "Block China" for the most common single-country request, plus "Anti-scraper" and "Strict mode" presets for broader policies. - **A customizable block screen** so blocked visitors see your message and branding, not a raw error. - **An allowlist for exceptions.** Blocking a country almost always comes with "except my supplier" or "except this one wholesale customer." Allowlist entries win over every rule. - **Sub-50ms decisions, and it fails open.** If the detection service ever hiccups, real customers shop normally. Your store never goes down because your blocker did. It also stacks with the rest of a traffic policy: [VPN and proxy blocking](/use-cases/block-vpn-checkout-fraud) to close the obvious bypass, datacenter network blocking, and bot detection, all from one rule set. See the full [feature list](/features) and how it compares to the incumbent apps in [Cordon vs Blockify](/compare/cordon-vs-blockify). ### Option 3: firewall rules for headless stores If you run a headless storefront (Hydrogen or a custom Next.js front end) behind Cloudflare or another CDN you control, you can write country-blocking rules at the CDN level. This is genuinely the strongest position: the request dies at the edge and your origin never sees it. The catch is that it is out of reach for most merchants. On a standard Shopify theme you do not control the proxy in front of your store, so there is nowhere to put the rule. This option is for the small minority who run their own edge, and even they usually want the app layer too for the visitor log, presets, and block screen. ## Block a country with Cordon in under 2 minutes Here is the whole flow, timed generously. 1. **Install Cordon** from the [Shopify App Store](https://apps.shopify.com/cordon). It installs as a theme app extension, no code edits, no script tags. 2. **Open the country rules** in the embedded admin and either pick a preset (for example "Block China") or open the flag picker. 3. **Click the flags** of the countries you want to block. All 200+ countries are one click each. 4. **Optionally customize the block screen** with your own message, so a blocked visitor understands why rather than assuming your store is broken. 5. **Add allowlist exceptions** if you have suppliers, agencies, or customers in a blocked country who should get through. 6. **Save.** The rules are live immediately. Open the live visitor log to watch decisions happen in real time (IPs are SHA-256 hashed with a daily-rotating salt, so the log is GDPR-safe). That is it. No theme edits, nothing to redo after a theme change. ## The big fear: "will this block Google?" This is the question that stops most merchants from blocking anything, and it deserves a direct answer. **Blocking a country in Cordon can never block Google, Bing, or any other verified search engine.** Crawler verification runs before country rules: a request claiming to be Googlebot is checked against Google's actual network, and verified crawlers are always allowed, unconditionally. There is no toggle that can block them, so there is no misconfiguration that tanks your SEO. The same applies to the good bots that feed AI search (GPTBot, ClaudeBot, PerplexityBot) and SEO tools like Ahrefs. The flip side is just as useful: a *fake* Googlebot, meaning a scraper spoofing the Googlebot user agent from a non-Google network, fails verification and gets blocked. Country blocking plus crawler verification is strictly safer than a naive block. We covered the mechanics in depth in [do bot blockers hurt SEO?](/blog/do-bot-blockers-hurt-seo) ## Frequently asked questions ### Can Shopify block visitors from a specific country natively? No. Shopify Markets controls where you sell and ship, and checkout will reject shipping addresses in countries you do not serve, but nothing in Shopify stops a visitor from any country from browsing your store, adding to cart, or scraping your catalog. Visitor-level country blocking requires an app or your own edge infrastructure in front of the store. ### Will blocking a country hurt my Google rankings? Not if the blocker verifies crawlers. Cordon always allows verified search engines like Googlebot and Bingbot regardless of which countries you block. Verification happens before any country rule is evaluated, so your store stays fully crawlable and indexable no matter how aggressive your country list is. ### Can a blocked visitor just use a VPN to get around a country block? With a plain country block, yes, connecting through a VPN endpoint in an allowed country is the standard bypass. That is why country blocking pairs naturally with VPN and proxy detection. Cordon detects VPN, proxy, and Tor traffic using live commercial detection data rather than stale IP lists, so on Growth plans and above the bypass route is closed too. ### How do I block a country but allow one specific customer there? Use an allowlist. In Cordon you add the customer's IP address to the allowlist and it takes priority over every blocking rule. The country stays blocked for everyone else while that supplier, agency, or wholesale customer shops normally. ### Does a country blocking app slow down my store? A well-built one does not. Cordon makes its allow-or-block decision in under 50 milliseconds, and it is installed as a theme app extension rather than an injected script tag, so it is Lighthouse-friendly and does not drag your page speed. It also fails open: if the detection service ever has a problem, real customers shop normally instead of hitting errors. ## Wrapping up Shopify gives you tools to decide where you sell. Deciding who gets to browse is on you. If you want country blocking that decides in under 50 milliseconds, survives theme updates, and can never touch Google, [try Cordon on the Shopify App Store](https://apps.shopify.com/cordon). There is a free plan with basic country and bot blocking, and every paid plan has a 7-day free trial. Full plan details are on the [pricing page](/pricing). ---