If your add-to-cart rate suddenly looks brilliant while conversion falls off a cliff, check for bots before you congratulate anyone. Threads on the Shopify community forums and r/shopify describe a wave of automated traffic hitting stores through thousands of rotating IPs. It creates carts and fake customer accounts in bulk, and it gets past captcha and app-based bot protection because it fires cart events through backend APIs and never touches the storefront UI those tools watch.
Merchants report corrupted analytics and attribution, and retargeting spend inflated by audiences full of bots. The nastiest part is email deliverability. Fake accounts subscribe, never open anything, and drag sender reputation down with them.
How to tell if this is happening to you
- ✓Add-to-cart and account-creation volume spikes with no matching change in sessions from known channels
- ✓Cart-to-checkout progression collapses while cart creation climbs
- ✓New customer accounts follow a pattern: real-looking names with trailing digits, repeated or near-identical addresses
- ✓Klaviyo or email lists grow fast with profiles that never open, never click, and share signup timestamps in bursts
- ✓Abandoned cart flows fire far more often without a matching revenue lift
What helps today
Merchants have asked Shopify to intervene at the platform WAF level. So far the guidance points back to store-level mitigation, so until that changes the workable defence is layered, and most of it is hygiene.
- ✓Segment suspicious profiles out of email sends immediately. Sender reputation is more urgent than deleting the accounts
- ✓Build a Shopify Flow automation that flags or removes accounts matching the fake patterns you observe
- ✓Move critical ad decisions off polluted signals: exclude bot-heavy audiences and optimise on purchase events instead of add-to-cart
- ✓Filter analytics reports to exclude the affected window when reading CRO results, or you will optimise against noise
- ✓Rate-limit and monitor cart endpoints if you run a custom storefront, because the attack goes through the APIs and never presses a button
"The expensive part of bot traffic is the next quarter of decisions you make on numbers the bots wrote."
— Thought Bulb
Protect the decisions as well as the store
The lasting damage shows up in meetings. A team that trusts a poisoned add-to-cart rate will redesign the wrong PDP and credit the wrong campaign. It will also switch off flows that were working. Annotate the affected periods in your analytics, agree as a team which metrics you currently trust, and treat purchase data (which bots rarely fake) as the source of truth until this passes.
The ongoing community thread documents the attack patterns, fake account signatures, and merchant workarounds in detail.
Follow the community investigation →If you are not sure whether bots are distorting your numbers, we can check, build the Flow automations to contain them, and clean up the analytics so your next CRO decision is based on humans.
Get a bot-traffic audit →
