Bot checkouts on Shopify: what they are, and how to keep them out of your ad data

A bot checkout is an automated session that adds products to the cart and starts checkout without buying. One is noise. Hundreds a day become a problem: they fill your admin with abandoned checkouts and fake customers, send recovery emails to addresses nobody reads, and, if you advertise, feed your ad platforms events that look like shoppers.

What it looks like in your store

Merchants describe the same pattern again and again in the Shopify Community: bursts of abandoned checkouts, often far more than the store has real visitors that day; customer profiles with repeated or nonsense names; the same cheap product in every cart; addresses that repeat or make no sense. Some threads also describe card testing, where bots use cheap purchases to try stolen cards.

• Abandoned carts spam bots, over 400 per day
• 2,000+ "John Doe" customers and 1,000+ abandoned carts
• A fraud bot using Shopify checkout to test stolen cards

Why a bot does it is usually not visible from the store. What you can measure is the pattern, and the pattern is enough to act on.

What it costs an advertiser

The cleanup is the visible cost. The hidden one is your ad data. A bot that lands from an ad, adds to cart and starts checkout produces the same AddToCart and InitiateCheckout events a shopper does. When those events reach Meta, Google Ads or GA4 as conversions, the platforms' bidding learns from them, and it learns to find more of the traffic that produced them.

Recovery emails are the second cost. Abandoned checkout emails sent to fake addresses bounce or go unread, and some merchants pause them during an attack to protect their sending reputation.

What Shopify covers

• Spam protection puts hCaptcha on storefront forms, such as contact, newsletter, login and account creation, under Online Store → Preferences. It protects those forms. A bot can fill a cart without touching any of them. Shopify: online store preferences
• Checkout bot protection is a Shopify Plus feature that you schedule per protection event, under Settings → Bot protection. Shopify: bot protection
• Card checks from your payment provider, such as CVV, address verification and 3-D Secure, are what stop card-testing purchases from going through.

Shopify also keeps a general guide to dealing with bots. Running WooCommerce too? See WooCommerce card testing attacks.

What AdProtektor adds

• It scores every storefront visit for bots, competitors and click farms.
• It links a checkout that arrives with no browser visit to the visitor it came from, where the evidence allows, and gives it that visitor's verdict.
• It records a checkout that links to no one but carries attack evidence, such as one started straight from the cart API or a burst that outnumbers your real sessions, as Bot traffic in your dashboard.
• With ConversionOS and fraud protection active, it can withhold conversion events linked to blocked visitors or crawlers instead of sending them to Meta, Google Ads and GA4.
• It excludes the IP addresses of blocked visitors from eligible connected Google Ads campaigns, and maintains Meta exclusion audiences where configured and supported.

Setting it up today

The ConversionOS app for Shopify is awaiting Shopify App Store review. Until it is listed, you set up three parts from your dashboard:

1. The storefront script in your theme header, so every storefront visit is scored.
2. The Custom Pixel snippet in Shopify Admin → Settings → Customer events, which carries checkout events.
3. The signed order webhook, from the same ConversionOS section.

Refusing checkout outright for a flagged visitor is part of the app's checkout protection, so it arrives with the app. With the manual setup, bot checkouts are recorded as fraud and, with ConversionOS, kept away from your ad platforms. The Shopify integration page walks through each step.

To see what reaches your store, start a free trial and add the storefront script.