Bot Mitigation for Shopify: Stopping Scrapers, Sniffers and Carders

A sneaker retailer in Perth ran a release one Friday evening for a limited drop. Within four seconds of going live, the inventory was gone. The cart abandonment dashboard showed thousands of failed attempts. The first hundred orders all came from the same dozen IP ranges, all using sequential email aliases at the same provider, all shipping to addresses near freight forwarders in two suburbs. Their real customers, the ones the campaign was for, never got near the checkout. By Monday morning, half the orders had been cancelled because the cards were stolen, and the resale market had the rest of the inventory listed at double the retail price.

Bots are not a future problem for Shopify merchants, they are a present one. They scrape pricing, hoard inventory during releases, test stolen cards at scale, and snipe gift card balances. This article covers the categories of bots you should worry about and the practical layers of protection that actually work for Australian Shopify stores.

The bots that target Shopify stores

Not all bots are bad. Search engine crawlers are bots. Monitoring tools are bots. The category that hurts your store is sometimes called “bad bots” and it splits into a few patterns.

• Scrapers: pull your product catalogue, pricing and stock levels for competitor intelligence or to feed third party marketplaces.
• Inventory hoarders: race to the checkout during launches, add product to cart faster than humans, and resell at markup. Common in sneakers, collectibles, beauty drops and concert merch.
• Card testers: hammer the checkout with stolen card details to validate which ones still work. Damage shows up in chargeback fees and processor risk ratings.
• Credential stuffers: try leaked email and password combinations against your customer accounts to take them over.
• Gift card sniffers: brute force gift card codes hoping to drain balances.
• Form spam bots: fill out contact and newsletter forms with junk, often to seed phishing campaigns or for SEO purposes on the bots’ own sites.

What Shopify does out of the box

Shopify has invested heavily in baseline bot protection. The checkout includes a CAPTCHA that triggers under suspicious conditions. Velocity controls limit how many attempts a single source can make in a window. Fraud analysis flags orders that look automated. For most general merchandise stores, these defaults catch a meaningful share of bot traffic without you doing anything.

What the defaults do not handle well is high value, high demand release events, sustained card testing campaigns, or scrapers that pace themselves carefully. For those, you need additional layers.

Cloudflare in front of Shopify

The single most effective layer we add for Australian Shopify merchants is Cloudflare in front of the storefront. Cloudflare sees traffic before it reaches Shopify, scores it against a model trained on billions of requests across millions of sites, and can challenge, rate limit or block requests that look automated. The setup is non trivial because Shopify is opinionated about how its proxy works, but it is solvable. We covered the configuration in detail in our piece on running Cloudflare proxy with Shopify and the performance benefits in Cloudflare proxy for Shopify performance.

The key Cloudflare features for bot mitigation:

• Bot Management: scores every request from 1 (definitely a bot) to 99 (definitely human) and lets you act on the score.
• Turnstile: a friendlier CAPTCHA replacement that runs invisibly for most users and challenges only the suspicious ones.
• Rate limiting: caps requests per IP, per token, or per session over a chosen window.
• Managed challenges: present the right challenge based on the threat model, ranging from JavaScript checks to interactive puzzles.

Designing release events that survive bots

For inventory drops, the rules change. Demand spikes a hundred times in seconds, the bots are tuned for exactly your category, and your real customers are competing with scripts that buy faster than they ever can. A few patterns work well:

• Waiting room: hold all traffic in a queue and admit users to the store in a controlled rate. Cloudflare Waiting Room and Shopify’s own queue features both work for this. Users see a friendly “you are number 1,243 in line” page rather than a broken site.
• Account requirement: only allow checkout for verified accounts created at least 48 hours before the release. Catches most bot accounts because the bots create accounts immediately before the drop.
• Aggressive bot scoring: turn the threshold up for the duration of the release. False positives are higher, but they are recoverable, while a stolen drop is not.
• Address and email pattern checks: block freight forwarder postcodes, block disposable email providers, limit the number of orders to the same address or card.

Stopping card testing in particular

Card testing is its own beast. The attacker does not care about your products, they care about whether the cards work. The signature is bursts of small dollar orders with high decline rates, often hitting the same one or two cheap products. The defences:

• Configure Shopify’s checkout CAPTCHA to be aggressive (it already auto adjusts, but be aware of the setting).
• Add Cloudflare rate limiting on the checkout endpoint to cap attempts per IP and per session.
• Use Bot Management to block known card testing infrastructure.
• Monitor decline rates and set an alert if they spike.
• Have a runbook for pausing the checkout briefly if a campaign begins, just to break the bot’s rhythm.

Stopping scrapers

Scrapers are usually less destructive than the other categories but more persistent. They will hit your product pages thousands of times a day, sometimes from residential IP pools to evade detection. Three habits help:

• Use Cloudflare Bot Management to challenge unverified bots while allowing the search engines you want.
• Be careful with metadata in your product pages. The richer the structured data, the easier it is to scrape clean.
• For high value catalogues (jewellery, fashion drops, technical equipment), consider rate limiting unauthenticated catalogue browsing.

Monitoring: you cannot defend what you cannot see

Bot mitigation is only as good as your visibility into it. The signals to watch:

• Checkout decline rate over the last hour, day and week.
• Add to cart volume relative to product views (high cart, low view often means inventory hoarders).
• Cloudflare bot score distribution if you have it.
• Login failure rates on your customer accounts.
• Gift card validation attempts in your logs.
• Form submission volume relative to legitimate conversions.

Put the most important of these on a dashboard. If your team sees the numbers daily, they will spot the anomaly that matters.

The cost of false positives

Every bot mitigation layer carries a tradeoff: turn it up too high and real customers get challenged or blocked. Cloudflare Turnstile is invisible to almost all genuine traffic, but aggressive bot scoring will catch the occasional VPN user, accessibility tool, or older browser. The fix is monitoring, not avoidance. Track your challenge rate, your block rate, and the customer support tickets that mention “I cannot access your site.” If those numbers drift up, dial back. Bot defence is a posture you tune, not a setting you switch on once and forget.

What to do this week

• Check your last 30 days of orders for card testing patterns (small bursts, low value, high decline).
• If you run release events, plan your bot mitigation strategy before the next one, not during it.
• Scope Cloudflare in front of your store if you do not have it already.
• Set up basic monitoring on decline rates and add to cart volume.
• Configure account creation rules if your category attracts inventory hoarders.

Where Defyn fits in

Bot mitigation is a layered, ongoing problem. We help Australian Shopify merchants configure Cloudflare properly in front of Shopify, tune bot rules for their category, and design release event protections that hold up under real load. The work pairs naturally with our Core Web Vitals optimisation and mobile speed projects, because the same edge layer that blocks bots also accelerates real users. Take a look at our services page or start a project to scope a bot mitigation review. Our Sydney web hosting customers get edge configuration as part of the package.

Fighting bots is easier with backup. Our Shopify developers set up these protections for Australian stores week in, week out.