01
We map what you actually need.
A single scoping call, then a written plan: what gets built, what it costs, and when it ships. No discovery-phase invoices, no moving targets.
Client work
Blocking a Shopify Bot Attack, Not the Buyers
A Shopify store taking thousands of dollars a day came under sustained bot traffic. Shopify does not let a merchant put their own CDN in front of the storefront, so the fix had to work at the storefront layer.
Australian-based team
Senior developers only
Fixed quote before we start
50k+
Bot requests identified
4+
Attacking regions blocked
0
Interruption to trading
Shopify
Blockify
Australian team
Based here, working your hours — not a timezone away
144+ projects delivered
Over 10+ years building and maintaining sites for Australian businesses
One developer, start to finish
The same person every time — no re-explaining your site
Straight answers, on your terms
We only take work we can finish. Ask us anything first — no obligation
The challenge
- A live store with thousands of dollars of daily orders was under sustained automated traffic.
- Shopify already runs behind its own CDN and does not permit proxying the storefront through a merchant’s Cloudflare account — so the WooCommerce playbook did not apply.
- Blocking too broadly risks blocking paying customers, which costs more than the attack.
- Search engine crawlers had to keep full access or the store’s rankings would suffer.
What we did
- Analysed the traffic to establish which regions the automated requests were coming from, rather than blocking on assumption.
- Used Blockify, which operates at the storefront layer where Shopify’s architecture actually allows control.
- Blocked at least four attacking regions, chosen from the traffic data rather than a generic list.
- Whitelisted SEO crawlers explicitly — blocking a region is easy, keeping Googlebot inside it while shutting out attackers is the part that takes care.
The outcome
- Attack traffic filtered without interrupting sales.
- Store continued trading throughout the work.
- Search engine access preserved, so no ranking impact from the mitigation itself.
Got something similar?
Tell us what is happening and we will come back with a fixed quote and a timeline, usually within one business day.
Get a fixed quote
