THE CLUB DROP SHOPIFY WATCH
BOTS ARE HITTING YOUR STORE. HERE'S HOW TO STOP THEM.
Hundreds of fake customer accounts. Traffic spikes that never convert. A wave of tiny failed payments. Sound familiar?
It's one of the most common questions in Shopify groups right now. The good news: most of it can be fixed with settings you already have, and one app handles the rest.
01 WHAT'S GOING ON
THE 3 KINDS OF BOT PROBLEMS.
🤖 Fake signups. Bots create customer accounts and fill your newsletter form with junk emails. They pollute your list, trigger welcome emails to fake addresses and drag down your email deliverability.
📉 Junk traffic. Sessions that bounce instantly, often from one country or data center. Your conversion rate looks like it collapsed, and your ads and reports get harder to read.
💳 Card testing. Fraudsters run stolen cards through your checkout with lots of small orders or failed payments. This one is the most serious: it can bring chargebacks and payment-provider problems.
02 THE CLUB PLAY
5 FREE FIXES TO DO TODAY.
Start here before you pay for anything.
Turn on Shopify's spam protection. Online Store → Preferences → Spam protection. Enable hCaptcha on contact, comment, login and create-account forms. Don't stack a second captcha app on top; they conflict.
Use double opt-in for email marketing. Turn it on in Shopify or your email app (Klaviyo, Omnisend and others). Fake addresses never confirm, so they never reach your list.
Clean up what's already there. Export your customers first, then filter out the obvious fakes (gibberish names, links in name fields, a burst of signups in minutes) and delete them in bulk. Suppress the same emails in your email app so you stop paying for them.
Let Shopify Flow catch new ones. Build a simple Flow that tags new accounts with suspicious names or emails so you can review and remove them weekly.
Read your analytics without the bots. Use the human or bot session filter in Shopify's reports so decisions are based on real shoppers. Note this only cleans your reports; it doesn't stop the bots.
⚠️ Seeing card testing? Treat it as urgent. Contact Shopify support (or your payment provider) right away, review Shopify's fraud analysis on recent orders, and cancel and refund suspicious orders before you ship anything.
03 CLUB PICK
THE APP WE'D INSTALL: BLOCKIFY.
If the bots keep coming after the free fixes, Blockify Fraud Filter & Blocker is the app we'd reach for. It's one of the highest-rated security apps on the Shopify App Store (4.9★ from 1,500+ reviews), and merchants consistently praise its setup and support.
WHAT IT DOES:
→ Blocks traffic by country, IP address, VPN/proxy and user agent
→ Stops repeat offenders from placing fraudulent orders
→ Cuts the junk sessions that wreck your analytics
SET IT UP SAFELY:
→ Never block countries you sell or ship to
→ Make sure Google, Meta and other ad and search crawlers stay allowed
→ Start with the obvious sources in your traffic report, then watch for a week before adding more rules
Running a larger store with chargebacks? Blockify keeps bots out. If fraud is costing you real money, pair it with a chargeback-guarantee service on top.
04 SECURITY ALERT
THAT PHP VULNERABILITY EMAIL: ARE YOU AFFECTED?
You've probably seen warnings this week about a critical PHP vulnerability (nicknamed “PHP2Shell”, CVE-2026-109618 and CVE-2026-109619). The PHP team released emergency fixes on October 21. Here's what it means for a Shopify store.
✅ Your Shopify store itself: nothing to patch. Shopify isn't built on PHP and runs its own servers. Your theme is Liquid, not PHP. There's nothing in your Shopify admin to update for this.✅ Your Shopify store itself: nothing to patch. Shopify isn't built on PHP and runs its own servers. Your theme is Liquid, not PHP. There's nothing in your Shopify admin to update for this.
⚠️ Everything around your store: check it. The risk is the other websites tied to your business that do run PHP:
→ A WordPress blog or landing pages on a subdomain
→ An old WooCommerce or Magento store left online after a migration
→ Custom middleware or sync tools a developer built for you
→ Booking portals, microsites or staging sites
Ask your host or developer one question: “Are we on PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer?” If not, update now. If a site runs PHP 8.1 or older, it no longer gets security fixes, so upgrade it or take it offline. For apps, follow each app's own guidance rather than guessing.
THE THREAT THAT DOES HIT SHOPIFY STORES: CHECKOUT HIJACKS.
The more urgent Shopify story this month: some third-party apps were compromised and used to load malicious scripts that redirected shoppers to fake checkout pages to steal card details. Affected apps have been fixed or pulled from the App Store, and on October 20 Shopify asked every app developer to harden their apps. There's no evidence Shopify's own checkout was breached, but your app stack is your responsibility.
YOUR 15-MINUTE SECURITY CHECK:
Test your checkout. Open a private/incognito window, add a product, click Checkout. You should land on your own store's checkout. If you're sent to an unfamiliar domain (especially one ending in .top), contact Shopify support immediately. Don't enter real card details while testing.
Cut your app list. Uninstall every app you can't justify. Fewer apps, fewer doors.
Check app code fields. Review any “custom JavaScript” or “custom code” boxes in your app settings. If you see code you didn't add, ask the app's support team what it is.
Lock down logins. Turn on two-step verification for every staff account, remove former staff and old collaborator access, and change passwords for any app accounts you log into separately.
Review what has access. Check which apps, agencies and AI tools have access to your store, and remove anything you don't recognise.
Make it a habit. Repeat the checkout test monthly, and add it to your BFCM checklist the week before the sale.
This is a fast-moving story. Always check the official sources: the PHP security advisory at php.net and Shopify's developer changelog. If you got an email about this “from Shopify” asking you to log in or install something, go to your admin directly instead of clicking the link.
FREE STORE CHECKUP
WHAT ELSE IS YOUR STORE MISSING?
Run our free audit and get a score plus a plain-English list of what to fix first: conversion, speed, apps, product pages and more.
💬 THE CLUB COMMUNITY
GETTING HIT RIGHT NOW?
Post what you're seeing in Ask the Club: screenshots of the traffic, the fake accounts or the failed payments. We'll help you work out what it is and what to block.
ONE QUICK FAVOUR
KNOW A STORE OWNER FIGHTING BOTS? SEND THEM THIS.
Every store gets hit eventually. Sharing this takes 5 seconds and could save someone a week of headaches (and a stack of chargebacks).
Or invite them to the community (free, and full of operators who've been there):
LESS NOISE. BETTER ECOMMERCE.
Forward this to whoever manages your store. Bots don't take holidays, especially before BFCM.
Want us to lock your store down for you?
