Shopify bot traffic: why sessions spiked and conversion rate dropped

Updated October 19, 2026

Short answer: if sessions jumped and orders didn't, bots are a likely cause. Shopify already filters the bot sessions it identifies out of its session reports, but not all of them, and not data from before October 7, 2025. Open the Sessions by location, Sessions by referrer and Sessions by device reports over 30 to 90 days, filter to human and bot traffic, and look for a spike from one place, one device type or a city that hosts cloud data centers. Then judge your conversion rate against orders, not sessions alone.

Why bots lower your conversion rate

Shopify defines conversion rate as the percentage of online store sessions that resulted in a sale. Bots add sessions and never buy, so the same number of converting sessions gets divided by a bigger total. In Shopify's words, when your session count changes, your conversion rate can change too, "even when your orders or sales haven't changed."

Example	Sessions	Converting sessions	Conversion rate
Before the bots	10,000	200	2.0%
With 4,000 bot sessions	14,000	200	1.4%

Nothing about your store got worse. The denominator did. The same inflation shows up anywhere sessions are the base: ad return per session, email sign-up rates, and A/B tests that compare conversion rates.

What Shopify and GA4 already filter

Shopify shields stores from the majority of automated traffic. Every request to a Shopify store passes through Cloudflare, with a web application firewall and DDoS protection. Extra checkout bot protection during sales is only on Shopify Plus. hCaptcha protects contact, newsletter and blog comment forms and legacy customer account pages, not page views.
Shopify filters identified bots out of session reports. Once the update reaches your store, sessions Shopify classifies as bots are left out of session-related reports by default, for sessions from October 7, 2025 onward. It applies only to sessions metrics, can't reclassify older sessions, and Shopify notes that some sophisticated automated traffic might not be classified right away.
GA4 excludes known bots. Traffic from bots on Google's list and the IAB's International Spiders and Bots List is excluded automatically. You can't see how much was excluded, and newer bots that aren't on those lists aren't covered by it. GA4's internal traffic filter is for your own IP addresses, not bots, and data filters don't change data that's already processed.

So some bot traffic still reaches your reports, especially newer or better-disguised bots, and older periods were never filtered at all.

Step by step: checking a traffic spike

Pick a long enough window. Shopify recommends looking at 30 to 90 days rather than a few days, so a normal busy weekend doesn't look like an attack.
Open Sessions by location. It shows the countries, regions and cities your visitors come from. A sudden block of sessions from one country you don't ship to, or from cities that host big cloud data centers, such as Ashburn, Virginia or Los Angeles, California, when the volume doesn't match your real customers, is a common sign. Shopify names large volumes from Google Cloud or Amazon Web Services data center locations as a signal.
Filter to human and bot traffic. Shopify's session reports let you filter by human and bot traffic, so you can see how much Shopify already caught and how much of the spike it counted as human.
Open Sessions by referrer and Sessions by landing page. A spike that's all direct traffic, or all from one unfamiliar referrer, is worth a closer look. Shopify also lists a flood of landing page URLs from marketing integrations such as Facebook or Instagram as a bot sign, so don't assume ad traffic is real just because a campaign is running.
Check the device mix. Shopify also lists a spike in sessions from one device type as a sign of bot activity.
Line it up against orders. If sessions rose and orders, add to carts and checkouts stayed flat over the same days, the extra sessions weren't shoppers. If orders rose too, it was probably real demand.
Check paid traffic separately. If you run ads, compare the spike dates with your campaign reports. Bot clicks on ads cost money, not just analytics accuracy, so that's the part worth acting on first.

What you can do about it

Read your numbers with the filter on. Use Shopify's human traffic view for conversion rate decisions, and treat older periods with care.
Don't chase every bot. Shopify already shields your store from the majority of automated traffic, and blocking good bots can hurt you. Search engine crawlers and AI assistants find your products for shoppers.
Use robots.txt for crawlers that respect it. Shopify lets you customize robots.txt with a robots.txt.liquid template. robots.txt is a request, not a block: crawlers that ignore it, and some user-initiated AI visits, aren't stopped by it. Save a copy of your current robots.txt before you change it.
Exclude bot IPs from ad platforms where you can. If the spike is on paid traffic, IP exclusions in your ad platform cut repeat clicks from the same addresses.

AI agents are not the same as bad bots

Some automated visitors are worth keeping. For eligible stores, Shopify's agentic storefronts let customers discover and buy your products in AI channels such as ChatGPT, Google AI Mode and Gemini, Microsoft Copilot and Meta, and orders from those channels show in your admin with channel or referrer attribution. OpenAI documents separate crawlers for ChatGPT search, for model training, and for actions a ChatGPT user starts, and robots.txt rules may not apply to the user-initiated ones. Before you block "AI bots", decide which of these you actually want to keep out.

Where ClearSignal fits

We make ClearSignal: Bot & AI Traffic, a Shopify app that measures bot and AI agent traffic with its own detection, as a second opinion next to Shopify's. It sorts your sessions into human, good agent, bad bot and unclassified, shows a conversion rate with bad bots and agents taken out, and breaks bot traffic down by country. ClearSignal doesn't block visitors, doesn't change Shopify's own reports, and only counts traffic from the day you turn on its app embed. Read how ClearSignal works. Free and paid plans available. See the ClearSignal listing on the Shopify App Store for features and plans.

Common questions

Does Shopify filter bot traffic out of analytics?

Partly. Since October 7, 2025, Shopify filters the bot sessions it identifies out of session-related reports by default. The filter applies only to sessions metrics, can't reclassify older sessions, and Shopify says some sophisticated automated traffic might not be classified right away.

Why did my Shopify conversion rate drop when sales didn't?

Shopify calculates conversion rate as the percentage of sessions that resulted in a sale. If extra sessions arrive that never buy, such as bots, the rate falls even though your orders and sales stay the same.

Does GA4 remove bot traffic?

GA4 automatically excludes traffic from known bots and spiders, using Google research and the IAB's International Spiders and Bots List. You can't turn this off or see how much was excluded, and newer bots that aren't on those lists aren't covered by it.

Can I remove bot traffic from my past Shopify reports?

No. Shopify's bot classification applies only to sessions from October 7, 2025 onward, and GA4's data filters only apply going forward. For older periods, compare sessions against orders to judge how much of a spike was real.

Should I block AI bots like ChatGPT from my Shopify store?

Think before you do. AI assistants such as ChatGPT can send real shoppers and real orders, and Shopify shows orders from AI channels with channel or referrer attribution. OpenAI also runs different crawlers for search, model training and user-initiated actions, and robots.txt rules may not apply to the user-initiated ones. Decide crawler by crawler rather than blocking all AI traffic.

Sources

Questions: support@alpenglowsoftware.com