Bot traffic on Shopify: add-to-carts and checkouts with no sales
By the HonestTag team · Published November 10, 2026 · Updated November 11, 2026
Add-to-carts by the thousand, checkouts nobody finishes, and an order count that has not moved. Here is how to tell bot traffic from shoppers, what Shopify and Google Analytics already filter, and which number to judge your ads on.
When add-to-carts, checkouts or sessions jump and your orders do not, the order count is the number to trust, and the rest is often automated traffic. Shopify labels each session human or bot and leaves identified bot sessions out of its session reports by default, but that filter covers session metrics only and is built to miss some bots rather than mislabel a shopper. Google Analytics leaves out known bots only. So the order count is the first number to read, Shopify's Human or bot session filter and the signs Shopify lists confirm a spike, and a campaign judged on purchases is one a bot cannot flatter without buying.
What bot traffic looks like in your Shopify admin
A bot is software that does a person's clicks for them, faster. Some are welcome: Shopify points to Google's crawlers, which index your store so it can appear in search. Others fill carts, start checkouts, test card numbers or sign up fake customers. Shopify's first point is that bot activity "doesn't necessarily mean that your online store is insecure or broken", and that it "can occur on any publicly-accessible website on the internet."
Shopify says bot activity shows up mostly as sudden changes in volume, and lists these signs:
- A sudden spike in sessions, or in sessions from one device type.
- Many sessions from Google Cloud or Amazon Web Services data center locations, such as Ashburn, Virginia or Los Angeles, California.
- A conversion rate that suddenly jumps or drops.
- Store searches that look like request IDs or code.
- Many checkout or payment attempts with repeated or suspicious customer details.
- Many new customer profiles with strange names, such as mixtures of letters and numbers.
- A high volume of free ($0.00) orders.
Shopify also lists causes that are not bots, so rule them out first: a load test or quality check someone is running on your storefront, or a free product that is still for sale when you thought it was hidden.
What Shopify and Google Analytics filter, and what gets through
Shopify labels each session as coming from a human or a bot, judged on everything that happened in it, and since a rollout that ran from September 21 to 23, 2026 it leaves identified bot sessions out of its session reports by default. Reports that support it have a Human or bot session filter you can change. The Home page and Live View leave identified bots out with no way to change it.
Three limits matter when you are staring at a spike:
- It is cautious on purpose. Shopify says its classification is "designed to be conservative because it's better to miss some bots than incorrectly label real customers as bots", and that some sophisticated automated traffic "might not be immediately classified".
- It covers sessions only. In Shopify's words, "Bot filtering applies only to sessions-related metrics." Your orders, sales and customer counts are what they are, and Shopify's own example notes that "some automated traffic is completing checkouts".
- It starts on October 7, 2025. Older sessions were never classified, so a comparison with a period before that date mixes filtered and unfiltered numbers.
Abandoned checkouts get a partial clean-up of their own. Shopify leaves some suspected card testing and bot checkouts out of the list, and says "Not all automated activity is filtered out, so some abandoned checkouts might still come from bots."
Google Analytics works differently. It automatically excludes "traffic from known bots and spiders", identified from Google's own research and the Interactive Advertising Bureau's International Spiders and Bots List, and Google says you "cannot disable known bot traffic exclusion or see how much known bot traffic was excluded." A bot Google does not know about is outside that exclusion. One merchant reported add-to-carts "like 1000s every hour" in October 2026, along with begin_checkout and add_shipping_info events (the thread is in Sources). Shopify itself suggests bot filtering to "Compare your analytics with other platforms that filter bots differently": the two can disagree about the same spike because each filters in its own way. Google Ads filters invalid clicks out of its own counts too, one of the reasons ad clicks and Shopify sessions differ.
A week of bot carts, worked through
The numbers below are made up to show the arithmetic. A store has a normal week: 2,000 sessions, 120 add-to-carts and 20 orders. The next week reads 9,000 sessions, 3,100 add-to-carts and 21 orders.
- Add-to-carts per order go from 6 to almost 148. Nobody became 25 times keener to browse without buying.
- Orders per session, the rough shape of your conversion rate, fall from 1% (20 of 2,000) to about 0.23% (21 of 9,000), which reads like a broken checkout.
- Orders went from 20 to 21. That is the line that tells you the store's sales did not change.
Now say Shopify's Human or bot session filter, set to show both, splits the week into 2,100 human sessions and 6,900 bot sessions. Orders per human session are 21 of 2,100, 1%, the same as before. The spike was automated, it came in through sessions, and a report that counted carts or checkouts would have shown a great week that never happened.
Judge your ads on orders, not bot carts. HonestTag counts from your Shopify orders, so bot carts and checkouts do not move The Gap, and on paid plans each verified web order goes as a purchase to the ad platforms your plan delivers to.
What this means
Read orders first. If they held steady for the same dates while carts, checkouts or sessions jumped, the problem is in measurement, and your sales did not change. Shopify's Human or bot session filter shows how much of the spike it identified as bots, and Shopify says "Significant bot traffic from specific sources might suggest automated crawling or testing from those channels." Events in Google Analytics that double with no extra visitors point elsewhere: two setups sending the same events. A comparison that crosses October 7, 2025, or sets the bot filter differently on each side, is not like for like.
The cost lands on anything judged on carts or checkouts. A campaign whose conversion goal is an add-to-cart or a started checkout gets credit for actions a bot can produce without buying anything, and your conversion rate reads like a broken checkout when nothing is broken. HonestTag counts from your Shopify orders, so a wave of bot carts does not change the orders, new customers and purchases it reports.
How HonestTag helps
HonestTag starts from your Shopify orders, not from sessions or browser events, so a wave of bot carts and checkouts does not change the orders, new customers and purchases it counts.
- On the free Mirror plan, The Gap shows how many of your new customers first arrived from a Google Ads or Meta click, counted from your store's real orders over the 14 days up to yesterday. A visit from a known crawler is not recorded as an ad click, so it never becomes anyone's first click.
- On paid plans, every verified web order goes as a purchase to the ad platforms that hold your plan's delivery slots, sent from HonestTag's server. HonestTag_Purchase (ht_purchase in Google Analytics) counts every order HonestTag sends, new and returning customers both. A cart or checkout that never becomes an order is never sent as a purchase.
- Add-to-cart and checkout events from known crawlers are held back: when HonestTag sends those events to one of your ad platforms, a known crawler's never go, though a bot posing as an ordinary browser can still get through.
- Page views from known crawlers do not count toward your plan's pageview allowance, on every plan.
- On paid plans, Orders and order proof let you open an order that looks automated and see whether an ad click stands behind it, and what each platform was sent.
HonestTag does not block bots from your store; that is Shopify's protection and your settings.
Install HonestTag free from the Shopify App Store and see on the Mirror plan how many new customers your Google Ads and Meta clicks brought, counted from orders rather than sessions.
Frequently asked questions
Does Shopify filter bot traffic out of its analytics?
Partly. Shopify labels each session human or bot and leaves identified bot sessions out of its session reports by default, with a Human or bot session filter where a report supports it. The filter covers session metrics only, it starts with sessions from October 7, 2025, and Shopify built it to miss some bots rather than mislabel real customers.
Why do I have thousands of add-to-carts and no extra sales?
Often automated traffic, though Shopify also lists causes that are not bots, such as load testing or a free product someone found. If orders stayed flat while carts and checkouts jumped, your sales did not change, and Shopify's Human or bot session filter shows how many of those sessions it identified as bots.
Can bots create abandoned checkouts?
Yes. Shopify leaves some suspected card testing and bot checkouts out of the abandoned checkouts list, but says not all automated activity is filtered out, so some abandoned checkouts might still come from bots.
Does hCaptcha stop bots from adding to cart?
No. Shopify lists where hCaptcha can display: contact, newsletter signup and comment forms, and the login, create account and password recovery pages. The cart and checkout are not on that list, and checkout bot protection is a Shopify Plus feature.
Does HonestTag send bot add-to-carts to my ad platforms?
Not from known crawlers. When HonestTag sends add-to-cart and checkout events to an ad platform, it holds back the ones from known crawlers. Its purchases come from your Shopify orders, so a cart or checkout that never becomes an order is never sent as a purchase.
Sources
- Shopify Help Center: Identifying bot activity on your online store, read November 10, 2026
- Shopify Help Center: Bot filtering in Shopify analytics and reports, read November 10, 2026
- Shopify Help Center: Changes to sessions and conversion rate in Shopify Analytics, read November 10, 2026
- Shopify Help Center: Protecting your store from bots, read November 10, 2026
- Shopify Help Center: Understanding bots at Shopify, read November 10, 2026
- Shopify Help Center: Abandoned checkouts, read November 10, 2026
- Shopify Help Center: Setting your online store preferences (hCaptcha), read November 10, 2026
- Google Analytics Help: Known bot-traffic exclusion, read November 10, 2026
- Shopify Community: Extreme add to carts and checkout sessions (merchant thread, October 3, 2026), read November 10, 2026
- HonestTag: Order proof
- HonestTag pricing and plan limits
Related reading: why Shopify lists your own store as the referrer, GA4 revenue vs Shopify sales, ad platform purchases vs Shopify orders, and duplicate purchase events.
Judge your ads on orders, not bot carts
HonestTag counts from your Shopify orders, so bot carts and checkouts do not move The Gap, and on paid plans each verified web order goes as a purchase to the ad platforms your plan delivers to.
- Feed your ads a clean signal. On paid plans, the platforms you send to get each verified purchase, new customers marked as new once confirmed.
- Catch the sales your pixels miss. On paid plans, purchases are sent from your Shopify orders, server to server.
- Know what to scale. From the Truth plan, a weekly scale, hold or cut call when the data supports one, and on every paid plan, proof behind every attributed order.
- Start free. The free Mirror plan puts Google Ads and Meta claims beside your orders. Keep your current tracking while you look.