Shopify bot protection: what it covers, what it skips

This question is confusing because Shopify ships four things under that name, and they stand at four different doors. Two are already on. One needs a plan you probably aren’t on. One doesn’t block anything at all.

Two of them are already running

You didn’t switch these on and there’s no switch to turn them off.

The first is the firewall. Shopify puts Cloudflare in front of every store and says it stays active without any action from you. Its job is the storefront. If a visitor behaves like a script, or arrives over a VPN, Shopify may show a short verification check before the page loads.

The second is hCaptcha, which Shopify files under spam protection. It covers your contact form, your newsletter signup, your comments, and the login, create account and password recovery pages. Shopify says it “is activated by default on all Shopify stores.” Both toggles sit under Online Store, then Preferences.

Read that list again and notice what isn’t on it. Neither one is watching your checkout.

The one actually named Bot protection

This is the feature in the admin under Settings, and it’s the one most people mean. It’s also the one most people can’t have.

Shopify’s page for it says it’s available only to stores on the Shopify Plus plan, and that you turn it on by contacting Plus support. It runs as a scheduled event rather than a standing setting. You pick a challenge, either reCAPTCHA or hCaptcha, you pick up to 500 products, and the event lasts up to an hour. One event at a time.

That shape tells you what it’s for. It was built for a drop. A limited run, a known start time, and a queue of auto-checkout bots trying to buy the lot before people can. Shopify’s own wording keeps it to that job, and the page says plainly that it isn’t designed for fraud.

So if you landed here because of small orders on stolen cards, this feature was never going to help. Shopify says so on its own page.

Bot filtering is a reports setting

This is the fourth one, and it’s the one mistaken for protection most often.

Bot filtering labels each session human or bot, then leaves the bot ones out of your sessions reports. Your traffic number stops being nonsense. The bots keep arriving exactly as before.

Shopify is open about why it works that way. Blocking everything automated would also stop search engines from indexing you. Three limits are worth knowing:

• It only touches metrics tied to sessions. Your orders and your revenue aren’t relabeled.
• It only applies to data collected since Shopify switched it on, so a comparison against an earlier period isn’t a fair one.
• It’s deliberately cautious. Shopify would rather miss a bot than count a real customer as one, so some automated traffic still lands in the human column.

So which problem do you have

The four features answer two different complaints, and they get tangled because people use one phrase for both.

Your numbers look wrong. Sessions climbing with no orders. Traffic from countries you don’t ship to. A conversion rate that fell off a cliff. That’s a measurement problem, and the firewall plus bot filtering is the whole answer. Set the filter in the reports you actually read and move on.

Orders are arriving that nobody placed. Small amounts, made-up names, a burst of them inside an hour, often overnight. None of the four does anything about that. The firewall already let them through. hCaptcha isn’t at the checkout. Bot protection needs Plus and isn’t for fraud. Bot filtering only tidies a chart. If that one is you, the signs of an attack are worth reading before you install anything.

One Shopify lever does reach checkout without Plus, and it isn’t called bot protection. Fraud Control holds checkout rules that stop a checkout before it becomes an order. Whether they’re any use to you turns on what those rules can and can’t say. Each one needs a value you can type in today, so they fit one repeat buyer and miss a bot that never repeats a detail.

Where ours fits

Halt stands at the door none of the four covers, which is the payment attempt. It matches on repetition instead of identity: three checkouts from the same email or address inside a day, five from the same phone. The next one is refused before the payment provider is ever called.

It doesn’t need Shopify Payments and it doesn’t need Plus. It runs on Basic. Anyone who has ordered from you before passes every time.

It also won’t clean up your traffic reports, because it never sees a visitor who doesn’t reach checkout. If the session count is what’s bothering you, the filter Shopify already gave you is the better tool, and it costs nothing.