Shopify Bot Traffic: Stop Fake Add-to-Cart Abuse

Your sessions are up, conversion rate is down, and you have hundreds of abandoned carts from people who never existed.

This is one of the most reported problems in the Shopify Community right now. Bots hit the add-to-cart endpoint at scale, which inflates sessions, destroys your conversion rate, and — the expensive part — feeds garbage into your ad platforms' bidding algorithms.

Symptom

• Sessions climb but orders stay flat, so conversion rate falls for no explicable reason.
• Abandoned checkouts pile up with blank names, nonsense email addresses, or no contact details at all.
• Traffic concentrates in countries you do not ship to.
• Bounce rate spikes overnight with no campaign change.
• Add-to-cart events far exceed any plausible ratio to sessions.

Cause

Shopify's /cart/add.js endpoint is public by design — it has to be, for the storefront to work. Nothing in a default store rate-limits it per IP.

Bots hit it for several reasons: scraping inventory and prices, testing stolen card numbers via checkout, competitor interference, or simply indiscriminate crawling. The motive rarely matters; the cleanup is the same.

What makes it costly is downstream. Smart Bidding in Google Ads and similar systems optimise toward reported conversions and engagement. Feed them bot sessions and they will spend your budget chasing more traffic that looks the same.

Fix

1. Confirm it is bots, not a real traffic shift

Check Analytics → Reports → Sessions by location and Sessions by referrer. Bot traffic usually shows one or more of:

• A single country you do not market to, appearing suddenly.
• Direct traffic with no referrer, in volume.
• Sessions with a session duration of zero.

In GA4, compare Users against Sessions. A ratio near 1:1 with very short durations is a strong bot signal.

2. Turn on Shopify's native bot filtering

Shopify added bot detection and filtering to analytics reports in October 2025. It does not block bots — it excludes known ones from your reports, which at least restores trust in the numbers.

Check Analytics → Reports for the bot-filtering toggle and confirm it is enabled before doing anything more complex.

3. Rate-limit add-to-cart at the edge

Native filtering cleans reporting but does not stop the requests. If you use Cloudflare in front of your store, a rate-limiting rule is the most effective single change:

# Cloudflare → Security → WAF → Rate limiting rules
When incoming requests match:
  URI Path contains "/cart/add"
Then:
  Rate:     10 requests per 1 minute per IP
  Action:   Managed Challenge
  Duration: 10 minutes

Ten add-to-carts a minute is far above what any real shopper does and far below what a bot does. Use Managed Challenge rather than Block — a hard block risks catching a real customer on a shared corporate IP.

Keep legitimate crawlers out of the rule:

# Add an exception before the rate limit rule
When incoming requests match:
  cf.client.bot          equals true
Then:
  Skip → all remaining rules

cf.client.bot matches verified bots like Googlebot and Bingbot. Blocking those would cost you indexing.

4. Stop counting bot carts in your own tracking

Even with filtering on, your custom events may still fire. Guard the ones that matter:

analytics.subscribe('product_added_to_cart', (event) => {
  // A real shopper has interacted with the page before adding to cart.
  // Scripted requests typically have neither of these.
  const hasInteracted = sessionStorage.getItem('user_interacted') === '1';
  if (!hasInteracted) return;

  gtag('event', 'add_to_cart', {
    currency: event.data.cartLine.cost.totalAmount.currencyCode,
    value: event.data.cartLine.cost.totalAmount.amount,
  });
});

// Set the flag on the first genuine interaction.
['pointerdown', 'keydown', 'scroll'].forEach((evt) =>
  window.addEventListener(evt, () => sessionStorage.setItem('user_interacted', '1'), {
    once: true,
    passive: true,
  })
);

This is imperfect — a sophisticated headless browser can fake interaction — but it removes the bulk of scripted traffic from your reporting.

5. Clean up bot customer accounts

If bots are creating accounts, Shopify Flow can remove them automatically. Trigger on Customer created, add a condition for empty first name AND empty last name, then delete. Review the pattern in your own data before automating deletion — you do not want to remove real customers who skipped a field.

Verify

1. After the rate-limit rule, watch Cloudflare's Security → Events for challenged requests on /cart/add.
2. Compare sessions week over week; a genuine bot problem shows a visible drop.
3. Confirm conversion rate returns toward its previous baseline.
4. Confirm Googlebot is still crawling — Search Console → Settings → Crawl stats.

Prevent

• Keep native bot filtering on so reports stay trustworthy.
• Monitor the sessions-to-orders ratio weekly. A sudden divergence is the earliest signal.
• Exclude suspect countries from ad targeting rather than only from reports.
• Re-check after big sales events. Bot activity spikes around BFCM, when it is easiest to miss in the noise.

Frequently asked questions

Will blocking bots hurt my SEO?

Not if you exempt verified crawlers, as above. Googlebot and Bingbot identify themselves and can be allow-listed reliably. Never rate-limit by user-agent string alone — that is trivially spoofed and risks blocking real crawlers.

Does this affect my Shopify bill?

Shopify does not charge by bandwidth, so bot traffic costs you in corrupted decisions and wasted ad spend rather than hosting fees.

Can I recover the corrupted historical data?

Not retroactively. Annotate the date you fixed it and avoid comparing across that boundary.

Related reading

• Duplicate GA4 events inflating your revenue
• Traffic but no sales? Start here
• website SEO audit — our service page

Need a hand?

We audit and fix analytics and performance problems on Shopify stores across the USA, UAE, Saudi Arabia, Qatar and the UK. If your numbers stopped making sense, get a free audit or see our website SEO audit service.