Do Blocked Visitors Show in Shopify Analytics?
Do blocked visitors show up in Shopify Analytics?
Not when X Shield blocks them by country, IP, VPN or bot rules: X Shield holds Shopify’s analytics scripts until it decides, and visitors those rules block leave no session in Shopify Analytics (tested on 8 October 2026). Shopify still counts some visits, such as shoppers who go straight to checkout.
X Shield holds Shopify’s analytics until it decides whether to let a visitor in. They start a moment late for a visitor it allows, and never for one it blocks.
How did we test it?
On 8 October 2026 we blocked our own visits by country on X Shield’s demo store: a rule blocked Vietnam on one hidden test page, and a second hidden page stayed open as the control. The visitor was in Vietnam, on one connection, with a fresh, cookie-free browser per visit, so each visit was its own session. ShopifyQL then counted human and bot sessions.
| Visits | X Shield’s decision | Sessions in Shopify Analytics |
|---|---|---|
| 15 to the home page, the control page, and the test page before the rule | Allowed | 15, all human |
| 12 to the test page with the rule on | Blocked | 0, human or bot |
The store had 15 sessions that day, all of them ours.
Only the country rule was tested; IP and network rules, VPN, proxy, Tor and scraper-network blocking, and bot protection decide in the same step and hold Shopify’s analytics the same way. Spy-extension and developer-tools protection don’t.
What still gets counted?
Several kinds of visit still reach Shopify’s reports, where Shopify’s own classification labels each one human or bot.
| Visit | Why Shopify can count it |
|---|---|
| A visitor blocked by spy-extension or developer-tools protection | Detected after the page loads, often once Shopify’s analytics have already started |
| A visit X Shield could not decide in time | If its script fails to load or stops responding, X Shield lets Shopify’s analytics run on purpose, so your data is delayed, not lost |
| A shopper who goes straight to checkout | Checkout is outside X Shield’s reach, and Shopify now counts some of these sessions even without a pageview |
| Any visitor while you’re testing in dry run | Dry run records who would have been blocked but lets everyone through |
| Your Global bypass addresses and private-link visits | They skip every rule by design |
| Verified crawlers ticked under Known bots | They skip every rule, which keeps your store indexed |
| Bots that never run JavaScript | X Shield can’t block them; whether they appear is up to Shopify |
| Visits from before you set up X Shield or a rule, or while its app embed was off | Nothing was blocked, and recorded sessions stay in your reports |
If none of these explains what you see, X Shield may not be running for those visitors: work through X Shield isn’t blocking.
How can I check my own store?
To check your own store, count human and bot sessions by country with ShopifyQL: in your Shopify admin, go to Analytics → Reports and run this in the ShopifyQL editor (Using ShopifyQL, checked 8 October 2026).
FROM sessions SHOW sessions, online_store_visitors
GROUP BY session_country, human_or_bot_session
SINCE -30d UNTIL today
ORDER BY sessions DESC LIMIT 100Compare a country you block before and after its rule went on: sessions that remain are most likely the kinds of visit listed above. Our test used the same query with WHERE landing_page_path STARTS WITH '/pages/xs-gate', grouped by landing page. To see each country’s bot share without a spreadsheet, export the result as CSV and drop it into the free Shopify bot traffic checker.
What changed in Shopify Analytics in September 2026?
Shopify rolled out a new way of measuring sessions between 21 and 23 September 2026. Identified bot sessions are now filtered out of session-related reports by default, a session ends after 30 minutes of inactivity instead of at midnight UTC, and some sessions without a pageview now count, “such as a customer going directly to checkout from a cart link”.
What that means if you use X Shield:
- Bots X Shield doesn’t block can still be left out of Shopify’s session reports, because Shopify now hides the bot sessions it identifies. Shopify notes that “some sophisticated automated traffic might not be immediately classified”.
- Shopify’s bot classification only covers data from 7 October 2025 onwards, so compare older periods with care.
To see bot sessions again, use the Human or bot session filter. In your Shopify admin, go to Analytics → Reports, open a sessions report, and change the filter under Filters.
Sources on help.shopify.com: Changes to sessions and conversion rate in Shopify Analytics and Bot filtering in Shopify analytics and reports, checked 24 September 2026.
How do I compare X Shield’s numbers with Shopify’s?
Don’t expect them to match: X Shield counts decisions, one for every blocked page load, while Shopify counts sessions and now leaves out the bot sessions it identifies. Use each report to answer its own question.
- Is X Shield blocking what I asked? Read X Shield’s Analytics, which is updated every few minutes. Paid plans show blocks by country, IP address, network and protection; the Free plan’s Recent blocked visitors lists the latest blocks.
- How many people really visited? Use Shopify’s session reports with Human or bot session left at its default.
- Why do blocked countries still place orders? Orders go through Shopify’s checkout, which X Shield can’t control. See Did they go straight to checkout?
Sessions from a blocked country can be shoppers who went straight to checkout, bot sessions Shopify hasn’t classified yet, visits X Shield could not decide in time, or sessions from before the rule.
Does this affect my Meta, Google and TikTok pixels?
App pixels that run through Shopify, the Meta and Google sales channels’ pixels among them, don’t start for visitors X Shield blocks by country, IP, VPN or bot rules.
Pixels and tags hard-coded into your theme weren’t part of the test, and the exceptions above apply to pixels too, checkout included. Shopify describes its new bot filter as applying to its session-related reports, and the pages cited above don’t mention ad pixels.
Why bot traffic distorts your numbers, and what to do: Bot traffic from Singapore and China, explained.
