Are bots inflating my Shopify add-to-cart numbers?

How to tell bot carts from real shoppers

Two signs are strong, because a real shopper practically never produces them:

• The same visitor in different countries seconds apart. One client appearing in the US and then Germany fifteen seconds later is not a person on a trip.
• Checkouts opened straight from a checkout link, with no visit before them. The first event is an add to cart or checkout start on a checkout that software built, with no product page or collection view earlier. In 52 stores using CartSpy, more than 51,000 such visitors placed no order at all.

Other patterns only matter when they come together. Real shoppers also start a checkout and leave before typing anything, arrive with no referrer, or buy a single product, so none of these mean a bot on their own:

• checkouts where no name, email or address is ever entered;
• one product per checkout and an empty referrer;
• carts and checkouts that climb while orders stay flat.

What we saw on a real store

One CartSpy store (details anonymized) saw checkout starts jump from about a dozen a day to more than forty a day within two days. Over the next 3.75 days CartSpy counted 136 clients starting checkout and 6 orders. Of those checkout starts, 114 (84 percent) shared one pattern:

• the checkout was opened from a checkout link created through the Universal Commerce Protocol, an open standard that lets software build a checkout for a shopper, rather than from a visit to the store;
• no store page was viewed first and the referrer was empty;
• the country changed from one checkout to the next;
• no one entered contact details, shipping or payment.

None of these checkouts became an order. We cannot say what the software was for; price, stock or shipping checks are plausible, but that is a guess. What the data does show is that the add-to-cart and checkout counts were mostly this traffic, while the real shoppers' numbers were small and steady.

What Shopify does and does not block

Shopify stores sit behind Cloudflare, with protection that is always on. Contact forms and customer account pages use hCaptcha by default. Shopify Analytics has a human-or-bot session filter, and since the September 2026 rollout, bot sessions are filtered out of its session reports by default. Checkout bot protection with a CAPTCHA checkpoint is a Shopify Plus feature, turned on through Plus Support for limited periods, mainly for flash sales.

Two things follow for a store that is not on Plus. Checkouts that start but never get an email also never appear in Shopify’s Abandoned checkouts list, so you will not see them there. And the counts that remain in other tools, or in the pixel events that feed them, can still include automated carts.

Sources: Shopify Help Center pages on dealing with bots, bot filtering in analytics, bot protection in checkout settings, and abandoned checkouts, read on October 31, 2026.

How CartSpy marks suspected bots

CartSpy has a Hide suspected bots setting. When it is on, sessions that match the bot rules are left out of your carts and checkout counts. Only the two strong signs are used, so a shopper who simply leaves an empty checkout is never marked:

• Country hopping: one client appearing in two countries seconds apart.
• Checkout-link opens: a checkout opened straight from a link, with no store visit before it.

Nothing is deleted and orders are never hidden. Turn the setting off and everything is back. You can also use the Only these countries setting to count only the countries you ship to.