A traffic spike with no sales is a reason to investigate. It is not, by itself, proof of bots. The useful question is: what did those sessions do, and did they connect to an order?
I’m on the WebDecoy team. We built a Shopify app for that investigation. This guide explains the workflow, including the limits that matter before you automate decisions.
1. Separate three different problems
Treat these as separate questions:
- Suspicious browsing: repeated catalog requests, automation signals, or interactions with hidden decoys.
- Checkout abuse: bursts of checkout or payment attempts that require payment-provider and Shopify investigation.
- Order review: completed orders where you can correlate a storefront session with suspicious activity.
An order-review tool cannot retroactively prevent every failed payment attempt. Keep payment controls and detection evidence in their respective roles.
2. Verify your collection before interpreting a quiet dashboard
After installing WebDecoy, open your theme editor, go to App embeds, enable WebDecoy Bot Detection, and save. Then open Setup & health in the app.
Create a labeled storefront test, visit its link, and confirm delivery. Test detections stay out of normal traffic metrics and order review.
Check storefront delivery and checkout delivery separately. The storefront embed and checkout Web Pixel are different collection paths. A successful storefront test does not prove every checkout event is arriving.
3. Investigate the signals together
Look for a combination of evidence: browser automation indicators, behavioral patterns, request context, and decoy interactions. IP enrichment adds VPN, proxy, and data-center context.
A VPN is not a fraud verdict. A cloud IP is not proof that a purchase is unauthorized. Check whether the suspicious activity actually supports the action you are considering.
WebDecoy’s actor profiles can group related detections across sessions and IPs. That helps investigate repeat activity without treating every request as a completely separate visitor. Correlation is evidence to inspect, not proof of a person’s identity.
4. Bring the evidence into Shopify order review
For orders with a matching session and detection, inspect the score, signal breakdown, and available actor history. WebDecoy supports order tags, native Shopify risk assessments, and bot-score and risk-level metafields. Availability depends on your plan and configuration.
Use the Flagged Orders queue to record whether a reviewed order looks legitimate or suspicious and leave notes for the next person. A useful review record explains why you reached a decision.
The order-created handler does not independently stop checkout or cancel orders. Cancellation requires a separate Shopify Flow action in a workflow you configure and enable.
5. Automate the review process first
A sensible first workflow is:
- Detect a correlated high-risk order.
- Tag it for staff review.
- Notify the responsible team.
- Record the outcome before adding stronger actions.
Pro and Agency plans include Shopify Flow triggers. The downloadable review and notification templates start inactive so you can inspect their settings before enabling them.
6. Keep AI crawling and AI referrals separate
An AI crawler fetching product pages and a shopper arriving from an AI assistant answer different business questions. WebDecoy provides separate reports for observed crawler activity and identifiable AI referrals.
Referral counts are a floor: an assistant or browser can omit referral information. Robots.txt guidance expresses policy to cooperating crawlers; it does not enforce access against an uncooperative scraper.
Know the coverage limits
A browser embed cannot observe every scraper that fetches public HTML without running JavaScript or touching a decoy. Checkout pixel delivery can depend on consent and browser conditions. Order correlation needs a matching session and detection.
Use these limits when interpreting reports. A quiet dashboard is only meaningful after you have verified the collection path.
Try it on your store
WebDecoy is available on the Shopify App Store, with a Free plan. Install it, enable the app embed, and verify your first test detection before evaluating the data.
See the full Shopify capabilities and setup guide.
If you are investigating a traffic spike, which part is hardest to explain: the source of the visits, checkout activity, or the connection to orders? Please keep customer and payment information out of public comments.
Top comments (0)