Bot protection,
ad fraud, and what we ship.
Notes on how bots and fraud actually behave, how to stop them without frustrating real shoppers, and what's new in Skyfense.
Shopify app delistings and the checkout hijack: what merchants should do now
Apps are disappearing from the Shopify App Store after fake checkout redirects hit stores in October 2026. Here's what is confirmed, how to check your store, and how to pick replacement apps.
Protecting a limited drop without punishing the people who want it
Scalper bots turn a hyped release into a race your real customers can't win. Here's how to keep a drop fair without adding friction that scares buyers off.
Shopify order fraud: why the order alone isn't enough
Checking an order's details catches some fraud. Matching it to the visit that produced it catches much more. Here's how to combine the two.
Stopping a bad order before it exists: checkout validation on Shopify
Cancelling a fraudulent order is cleanup. Rejecting it during checkout means there is nothing to clean up. Here's how pre-payment validation works.
Using Shopify Flow to react to risky visits and orders
Shopify Flow can turn a fraud signal into an action: a tag, a hold, a message to your team. Here's a practical way to set it up.
Traffic rules that fit your store: locations, networks, and repeat offenders
Score-based detection catches most bots. Merchant rules handle the rest: countries you don't ship to, networks that cause trouble, and visitors who keep coming back.
Why bot blocklists need daily updates
Bad user agents, spam referrers, and fake crawlers change constantly. Here's why fresh intelligence matters and how it fits alongside behavior-based detection.
WooCommerce support is on the roadmap
Skyfense runs on Shopify today. Here's what to expect as WooCommerce support is built out, and how to get on the list.
Session hijacking and fingerprint drift: what changes when an account is taken over
A hijacked session usually still has a valid login. What changes is everything underneath it, and that's what a fingerprint-drift check is built to notice.
Fake Googlebot is more common than you think
Anyone can put 'Googlebot' in a user agent string. Here's how to tell the real crawler from scrapers, scanners, and impersonators without blocking the traffic you actually want.
Inside a headless browser: how automation actually gets caught
Selenium, Puppeteer, and Playwright all leave marks. Here's what they look like from the storefront side, and why headless traffic is easier to catch than bot operators think.
TikTok and Microsoft Ads: the invalid-click problem nobody is watching
Most click-fraud attention goes to Google and Meta. TikTok and Microsoft/Bing campaigns see the same problem, with a lot less tooling built to catch it.
How checkout bots drain your inventory before real customers see it
Sneaker bots and scalping scripts can empty a limited drop in seconds. Here's how they work and how to stop them.
The invalid clicks quietly eating your Google and Meta ad budget
Invalid clicks don't show up as a line item. They show up as a worse ROAS you can't explain. Here's what causes them and how to filter them out.
Card testing: the automated fraud that costs you before a human ever sees it
Card testing scripts run stolen card numbers through your checkout in bulk, looking for ones that work. Here's how it shows up and how to catch it early.
CAPTCHA vs. invisible detection: what actually stops fraud without losing sales
CAPTCHAs punish every visitor to catch a few bots. Invisible, behavior-based detection can do better without the friction.
The ad spend dashboard: from invalid visits to Google Ads evidence
Review paid traffic across four networks, connect Google Ads spend, and prepare monthly invalid-click evidence with the new beta tools.