My store is getting a wave of bot traffic. What should I do?

Bot waves are common on Shopify stores, especially stores running paid ads. During a wave you’ll usually notice replays that behave nothing like a real shopper: they land, sit still or scroll instantly to the bottom, never move the mouse naturally, and leave. Sometimes you’ll see dozens or hundreds of near-identical sessions in a row.

This article covers what Propel Replays does about bots automatically, why some still slip through, and what you can do about the rest.

First, see how much is already being blocked

Propel Replays blocks recording of bots it detects. Those blocked visits never become replays and never count toward your page view quota.

To see the scale of it, go to Analytics and open the Bot traffic tab. You’ll see:

• Bot sessions: how many bot sessions were detected in the period.
• Bot % of sessions: bots as a share of all sessions, bots and humans combined.
• Bots from paid traffic: how many of those arrived from paid ads.
• Est. ad spend wasted: what those paid bot clicks cost you, once you enter your average cost-per-click. See What is the ad waste calculator?

Below the headline numbers, four breakdowns show you where the bots are coming from:

• By traffic type and By traffic source: the networks and referrers sending them.
• By campaign (utm_campaign): which of your campaigns attract the most bot traffic.
• Top targeted entry pages: the pages bots are landing on most.

During a heavy wave it is not unusual for this report to show bots making up more than half your traffic on some days.

The Bot traffic tab is available on paid plans. The ad waste estimate is available on the Plus plan and above.

Why some bots still get recorded

Our bot detection is good, but it is not perfect, and no detection system is.

Propel Replays makes its decision at the moment a visit is recorded, based on signals it can see from the browser:

• Visitors that identify themselves as bots in their user agent (most crawlers and scrapers do).
• Requests that don’t carry a valid Shopify signature, which catches traffic hitting our servers directly rather than genuinely browsing your store.
• Automated and headless browsers such as Puppeteer, Selenium and headless Chrome.
• Rate limiting, which caps how much a single address can send.

What we cannot see is the reputation of the visitor’s IP address. A bot that drives a real browser through a residential or datacenter proxy behaves, from our side, like a real shopper on a real browser. It passes every check above, so it gets recorded. That is the traffic you’re seeing in your replay list.

Checking an individual replay

Open any replay you suspect is a bot and look at the IP row in the session details panel. Under the IP address there’s a Bot check link.

That link opens a third-party lookup service that scores the IP against its own database of known proxies, VPNs and datacenter ranges. It is normal, during a bot wave, for that tool to flag visits that Propel Replays recorded as legitimate. The two systems are looking at different things: we look at how the browser behaves, the lookup service looks at where the connection comes from. That reputation database is a paid, private dataset we don’t have access to, which is why it can catch what we can’t.

What a Shopify app can and cannot block

This is the most important thing to understand before you spend money on a fix.

Any app installed on your Shopify store, including bot-blocker and IP-blocker apps, runs after the visitor has already reached your store. The request has been served, the page has loaded, and only then does the app’s JavaScript run and decide whether to show a block screen. That means:

• The visit still hits your store, and still appears in Shopify’s own analytics.
• A bot that doesn’t execute JavaScript never runs the blocker at all.
• A bot that does execute JavaScript can simply ignore the block screen and keep requesting pages.

So if you already have a bot-blocker app installed and you’re still seeing bot replays in Propel Replays, that isn’t a sign the app is broken. It’s a limit of what any app on the platform can do. Blocking bots properly has to happen before the request reaches your store, at the network edge. On Shopify that edge is Shopify’s by default, though there is a way to put your own layer in front of it (see the next section).

Can you put Cloudflare in front of your store?

Yes. It can genuinely help with bots, but it is a deliberate tradeoff rather than a quick fix, and Shopify does not support it. Here is the honest version.

It works, and Cloudflare documents it. Shopify itself runs on Cloudflare. If you proxy your own Cloudflare zone in front, Cloudflare routes the request through your zone first and Shopify’s second, using a feature called Orange-to-Orange (O2O). Cloudflare publishes a setup guide for Shopify specifically and says it “partners with Shopify”.

Your bot rules really would run. This is the part that matters for a bot wave. Cloudflare’s product compatibility table confirms that in an O2O setup, your own zone’s Bot Management, WAF custom rules, WAF managed rules, Rate Limiting and Security Level all apply, and that “settings on the customer zone will override settings on the SaaS zone.” So bots can be challenged or blocked at your edge, before they ever reach your store.

Shopify will not support it. Your admin will show “Your domain is using a Cloudflare Proxy, which Shopify does not support,” and Shopify’s documentation says the setup “could break at any time” and that “any issues that arise from using a Cloudflare proxy in front of your Shopify store are outside the scope of Shopify Support.” That is a statement about responsibility, not about whether it functions. A number of well-known Shopify brands run this configuration in production.

What you take on. Two costs are real, and good configuration does not remove them:

• Outage exposure. Shopify uses multiple providers to route around infrastructure problems. A proxy in front makes that harder, so during an incident you may be more exposed, not less.
• One more layer to debug. When checkout misbehaves at two in the morning, the proxy is one more thing to rule out, and Shopify Support will not help you rule it out.

The setting that catches people. Cloudflare’s own Shopify guide is blunt about this: do not enable Always Use HTTPS. It forces a redirect on every request including the /.well-known/acme-challenge/ path that Shopify uses to renew your SSL certificate, which means the certificate quietly fails to renew weeks later. If you want HTTPS enforced at the edge, use a redirect rule that excludes that path. Shopify already upgrades HTTP to HTTPS on its own, so you can also just leave it alone.

Our recommendation. If bots are costing you real money and you are comfortable owning an unsupported layer, this is a legitimate option, and Cloudflare’s guide above is the right set of instructions to follow. If you would rather not own it, work through the ad-platform and Shopify steps below first, since they cost nothing and carry no risk. Either way, do not turn the proxy on casually in the middle of an attack: set it up carefully, confirm the Shopify icon appears next to your DNS record, and put a test order through before you rely on it.

What actually helps

1. Protect your ad spend first

For most stores, the real cost of a bot wave is the ad budget spent on bot clicks, not the bot traffic itself. Use the By campaign and By traffic source breakdowns in the Bot traffic report to see which campaigns are attracting bots, then:

• Pause or narrow the worst offenders. If one campaign, placement or geography accounts for most of your bot clicks, that is the fastest lever you have.
• Add IP exclusions in Google Ads (Admin, then Account settings, then IP exclusions). This works well against a small, stable set of addresses and does little against a pool that rotates IPs. Note that IP exclusions aren’t available for Performance Max, App, Video, Smart Display or hotel campaigns.
• Let the platforms do their own filtering. Google automatically filters clicks it identifies as invalid and credits them back, so some of what you see may already have been refunded. Meta doesn’t offer IP exclusions, so campaign and placement changes are your main tool there.

2. Use Shopify’s built-in protections

Shopify’s guidance for stores dealing with bots comes down to:

• Confirm hCaptcha is active on your store. It’s on by default and protects your forms and account pages.
• Keep your theme and apps up to date.
• Use Shopify’s fraud analysis, and review high-risk orders manually.
• On Shopify Plus, turn on bot protection for your checkout.

If the volume is severe and sustained, it’s worth reporting to Shopify Support, since the network edge where this traffic can genuinely be stopped is theirs.

3. Keep your reporting honest

Once you know roughly what share of your traffic is bots, apply that when reading your numbers. The Bot traffic report gives you the percentage per day, so you can judge how much of a conversion-rate dip is real and how much is inflated sessions.

Clean up bot replays and protect your quota

Bot visits that slip through do consume your page view quota, and when you hit your quota, recording pauses until you fall back under it. During a heavy wave that can mean real shoppers stop being recorded. Two things help:

• Filter and delete in bulk. On the Replays page, open the filters and use the IP address filter to isolate an offending address, then select the results and choose Delete sessions. Deleting returns that quota to you. The IP address filter is part of advanced filters, available on paid plans.
• Start fresh if the wave was large. At the bottom of the Settings page there’s a Delete all session recordings option that clears everything and frees your whole quota. Use this only if you’re happy to lose your existing replays.

Recordings older than 30 days are removed automatically, so your quota also recovers on its own over time.

Keep an eye on it

Turn on the Weekly bot traffic report in Settings, under notification emails. You’ll get a weekly summary of bot activity on your store, so you’ll see the next wave starting without having to check the dashboard.

Still need help?

If bot traffic is badly distorting your replays or your reporting, contact our support team from inside the app. Tell us roughly when the wave started and we’ll take a look at what’s reaching your store.