Skip to main content

By platform

Botscope for Shopify

Our Shopify app shows bots and AI agents on your store. Blocking them takes the store domain on Cloudflare with our Worker in front. What each path covers.

Start free Browse the catalogue

Free plan, no card. 100,000 events a month with every feature on.

botscope.io · last 7d

This site, classified by this product. Nothing here is a mock-up.

live
requests
112,336
human
13%
AI agents
13%
stopped
0%
verdict stream
  1. signals
    • catalogue: claudebot — match (declared identity matches a catalogued agent)
    • threat_feed: datacenter — fail (listed on a subscribed feed)
    • threat_feed: web_attackers — fail (listed on a subscribed feed)
    • anomaly_score: 0.50 — pass (combined disagreement across the collected signals)
  2. signals
    • catalogue: claudebot — match (declared identity matches a catalogued agent)
    • threat_feed: datacenter — fail (listed on a subscribed feed)
    • threat_feed: web_attackers — fail (listed on a subscribed feed)
    • anomaly_score: 0.50 — pass (combined disagreement across the collected signals)
  3. signals
    • catalogue: claudebot — match (declared identity matches a catalogued agent)
    • threat_feed: datacenter — fail (listed on a subscribed feed)
    • threat_feed: web_attackers — fail (listed on a subscribed feed)
    • anomaly_score: 0.50 — pass (combined disagreement across the collected signals)

botscope.io's own traffic only — never a customer's. No addresses, no query strings, and a path is shown only when it is already a public page.

In short

  • Visibility works out of the box: the AiCommerceData app adds our script to the theme, with nothing to paste.
  • Blocking needs the store domain on Cloudflare, with our Worker in front of Shopify. Shopify itself runs no code of ours before a page is served.
  • Behind the Worker, Shopify still sees every visitor's real address, so Markets, currency and its own rate limiting keep working. We measured this before offering it.
  • Without Cloudflare, plain HTTP fetches — how most price monitoring is done — stay out of reach.

Updated 28 October 2026

01 · the platform constraint, first

The platform constraint, first

Shopify hosts the storefront, so there is no server to install an agent on and no request path we can put code into from inside the store.

What an app can do is add a script to the theme. That sees clients that execute JavaScript — browser automation, AI agents driving a real browser — and misses a plain HTTP fetch, which is exactly how most price monitoring is done.

The way past that is in front of Shopify rather than inside it: the store's own domain, proxied by its own Cloudflare zone, with our Worker on the route. Cloudflare documents this as orange-to-orange; Shopify does not support it officially on its side.

02 · two paths, and what each gives you

Two paths, and what each gives you

  1. 1 Visibility: install the AiCommerceData app and switch the Botscope app embed on in the theme editor. Humans, crawlers and AI agents that run scripts appear in the panel; nothing is blocked.
  2. 2 Blocking: put the store domain in your Cloudflare zone — a CNAME to shops.myshopify.com, grey until Shopify issues the certificate, then proxied — and deploy our Worker on a route for it. The connect screen walks through the order.
  3. 3 Keep both. The Worker leaves the app's script in place, so the store's settings for order risk and signup protection still apply.
  4. 4 Start in observe mode either way, read a week, then decide per agent which ones to stop.

03 · what the catalogue knows about commerce-adjacent agents

What the catalogue knows about commerce-adjacent agents

Bot Operator Default policy Verifiable
GoogleAgent-Mariner Google DeepMind Observe By user agent
Manus-User Butterfly Effect Observe By user agent
AI2Bot Ai2 Observe By user agent
Ai2Bot-Dolma Ai2 Observe By user agent
Applebot-Extended Apple Observe By user agent
bedrockbot Amazon Observe By user agent
Bibliotheque Nacional de France Crawler Bibliothèque nationale de France Observe By user agent
Bytespider ByteDance Observe By user agent

Read live from the Botscope crawler catalogue. Default policy is the catalogue default; every agent can be overridden per site.

04 · what is not available here

What is not available here

With the app alone: blocking of any kind, and classification of clients that never run a script.

With the Worker: the Worker has to forward each request to the store's own domain. A Worker that rewrote the target to the store's myshopify.com address would make every visitor look like one Cloudflare address to Shopify — breaking Markets geolocation and switching off Shopify's own rate limit — which is why ours never does.

Checkout and cart links are never challenged on a first visit, because shoppers arrive there straight from ads and emails; known-bad traffic is still blocked there.

Questions

Can Botscope block bots on Shopify?

Yes, when the store domain is on Cloudflare and our Worker runs in front of it. The app on its own observes and does not block.

Will Shopify still see where my customers are?

Yes. We tested it: behind our Worker on the store's own zone, Shopify attributed each request to the visitor's real network and country, and its own rate limit still applied.

Will it stop competitors scraping my prices?

With the Worker, it can: plain HTTP fetches pass through it and get classified like any other request. With the app alone, usually not.

Is there a Shopify app?

Yes — AiCommerceData on the Shopify App Store. It creates the site's keys inside the store, so nothing is pasted into the theme by hand.

Does the Worker touch checkout?

It runs there and blocks known-bad traffic, but never puts a first-visit challenge in front of a shopper about to pay.

See which of these reach your site

Free plan, no card: 100,000 events a month with every feature on. Nothing is blocked until you turn enforcement on.

Start free Browse the catalogue

Related