Help · Bot Wars
Bot Wars
“These aren’t the droids you’re looking for.”
That is, more or less, what your store says to every bot it catches. This guide is about the bots that fill in your forms and your checkout, why they matter more than they look, and how the app waves them along.
Why bots threaten your sending reputation
Bots type addresses that belong to nobody, which bounce, or to somebody who never asked to hear from you, who reports your email as spam. Mailbox providers and phone carriers judge every sender by those bounces and spam reports. When they climb, your real emails go to spam or are refused and your texts are blocked; done badly enough, a store can lose its email and text marketing altogether.
The Sending reputation and deliverability page explains how your store’s reputation is built, and what the app does to protect it from your first send.
Shopify’s end and yours
Bots have been hitting Shopify stores for years, and Shopify works on this at its end. Some still get through, and when they do, they arrive looking like customers. This guide is about your end: your profiles and your sending, which is the part you control.
Every defense in this guide is already working in your store, with nothing to enable. Your part is the judgment only you can make: saying when somebody the app holds back is a real person, and deciding when to delete the bots for good.
The doors bots come through
Bots reach your profiles through three doors, and each one has its own defenses. The checkout needs the most, because a bot that comes through it arrives with your store’s own records behind it.
- Your sign-up forms. A script can fill one in thousands of times. Most of those submissions never become a profile at all.
- Your storefront’s tracking. It sees browsers, not people. It never records consent and can never make anybody look like a bot; a visit it saw can only count in a person’s favor.
- Your checkout. A bot fills it in with an address and ticks the box to get your email. Your Shopify store reports the checkout and the consent, as it should, so the profile looks like a brand-new customer who wants your news.
Telling a person from a bot
Telling a person from a bot explains the bot check: a checkout your Shopify store reported that shows signs a machine made it, from somebody new to you, with no order, no Shopify tags, not seen browsing your store, and nobody on your team saying otherwise. It also explains what is never a sign, and why a confirmed identity and consent are separate questions.
We learned the signs of a bot from real bot traffic, and we keep them to ourselves. If we published them, the people who build bots would read them and build around them.
“More human than human.”
Bots at your forms and on your storefront
Bots at your forms and on your storefront covers what happens to a bot that fills in a sign-up form, an address nobody can vouch for, a phone number that has to prove itself, a back-in-stock request, and your storefront’s tracking.
“Move along. Move along.”
Checkout bots and the hold
Checkout bots and the hold covers the built-in segment Checkout bots, and the hold that keeps every marketing email and text away from the people in it, in every campaign and every automation, without you excluding them anywhere.
“Shields up.”
Letting a real person through
Letting a real person through covers the four ways somebody leaves the bot check behind: your team choosing This is a person, an order, a Shopify tag, and being seen browsing your store before a checkout.
“Have you ever retired a human by mistake?”
Deleting bots for good
Deleting bots for good covers clearing a whole segment of bots out of your store, the box Never let these addresses back, and what happens to the same bots in your Shopify store.
“Resistance is futile.”
The short version
Bots are kept away from your sends on their own, and you never have to exclude them by hand. When a real person is caught by mistake, choosing This is a person lets them through. When you are ready, the owner can delete the bots for good.
“May the Force be with you.”