Why Blocked Visitors Show in Shopify Analytics
Why do blocked visitors still appear in Shopify Analytics?
Because a storefront blocker such as X Shield decides in the visitor’s browser, after your Shopify page has started to load, and Shopify’s own analytics also starts as the page loads. So Shopify can count a visit that X Shield then blocks, and it counts some visits X Shield never sees, such as shoppers who go straight to checkout.
This is expected, and it doesn’t mean blocking failed. X Shield’s in-app FAQ gives the usual reasons: Shopify Analytics “may record visits before X Shield’s blocking screen displays, or from cached resources (images, theme files) served by Shopify’s CDN”, and search engine crawlers can create entries without receiving your content.
X Shield doesn’t guarantee that blocked visitors stay out of Shopify Analytics or your ad pixels. To see what it actually stopped, use X Shield’s own Analytics, which lists each blocked visit with its country, IP address, network and reason.
What changed in Shopify Analytics in September 2026?
Shopify rolled out a new way of measuring sessions between 21 and 23 September 2026. Identified bot sessions are now filtered out of session-related reports by default, a session ends after 30 minutes of inactivity instead of at midnight UTC, and some sessions without a pageview now count, “such as a customer going directly to checkout from a cart link”.
What that means if you use X Shield:
- Much of the bot traffic you were blocking may drop out of Shopify’s session reports anyway, because Shopify now hides the bot sessions it identifies. Shopify notes that “some sophisticated automated traffic might not be immediately classified”.
- Visits that skip your storefront, such as a cart link straight to checkout, now count as sessions, and X Shield never sees them.
- Shopify’s bot classification only covers data from 7 October 2025 onwards, so compare older periods with care.
To see bot sessions again, use the Human or bot session filter. In your Shopify admin, go to Analytics → Reports, open a sessions report, and change the filter under Filters.
Sources on help.shopify.com: Changes to sessions and conversion rate in Shopify Analytics and Bot filtering in Shopify analytics and reports, checked 24 September 2026.
Which visits can still get counted?
Several kinds of visit reach Shopify’s reports whatever your X Shield rules say. Whether Shopify then labels each one a human or a bot session is up to its own classification.
| Visit | Why Shopify can count it |
|---|---|
| A visitor X Shield blocks | Shopify’s analytics can record the page load before the blocked page appears |
| A shopper who goes straight to checkout | Checkout is outside X Shield’s reach, and Shopify now counts some of these sessions even without a pageview |
| Any visitor while you’re testing in dry run | Dry run records who would have been blocked but lets everyone through |
| Your Global bypass addresses and private-link visits | They skip every rule by design |
| Verified crawlers ticked under Known bots | They skip every rule, which keeps your store indexed |
| Visits from before you set up X Shield, or while its app embed was off | Nothing was checked |
If none of these explains what you see, X Shield may not be running for those visitors at all: work through X Shield isn’t blocking.
How do I compare X Shield’s numbers with Shopify’s?
Don’t expect them to match. X Shield counts decisions, one for every blocked page load, while Shopify counts sessions, which group a visitor’s activity until 30 minutes of inactivity and now leave out the bot sessions Shopify identifies. Use each report to answer its own question.
- Is X Shield blocking what I asked? Read X Shield’s Analytics, which is updated every few minutes. Paid plans show blocks by country, IP address, network and protection; the Free plan’s Recent blocked visitors lists the latest blocks.
- How many people really visited? Use Shopify’s session reports with Human or bot session left at its default.
- Why do blocked countries still place orders? Orders go through Shopify’s checkout, which X Shield can’t control. See Did they go straight to checkout?
When you compare, use the same dates, and remember that sessions from a blocked country can be real visits that reached checkout, bot sessions Shopify hasn’t classified yet, or page loads counted before the blocked page appeared.
Does this affect my Meta, Google and TikTok pixels?
It can. Ad pixels and tags load with your pages, much like Shopify’s own analytics, so an ad platform may record a visit that X Shield then blocks. X Shield doesn’t promise to keep blocked visitors out of your pixels. Shopify describes its new bot filter as applying to its session-related reports, and the pages cited above don’t mention ad pixels.
For how bot traffic distorts your numbers, and what you can do about it, read Bot traffic from Singapore and China, explained.
