# Get Started with X Shield {#doc-title}

By [B2B Gold](/about/#how-we-write) Updated 24 September 2026 [X Shield page](/shopify/x-shield/) [X Shield on the Shopify App Store](https://apps.shopify.com/x-shield-store-guard?utm_source=b2bgold.app&utm_medium=referral&utm_campaign=docs&utm_content=docs/x-shield/getting-started&utm_term=docs-header)

## How do I set up X Shield? {#how-do-i-set-up-x-shield}

To set up X Shield on Shopify, first open the app once from your Shopify admin, then switch on the X Shield app embed in your live theme. Until both are done, no visitor is checked and nothing is blocked. Every protection starts off, so next turn on the ones you want, add a rule and test it.

### Open X Shield once {#open-x-shield-once}

X Shield’s storefront script stays idle until you open the app once: that first visit connects it to your store. Open **X Shield** from **Apps** and wait for the **Overview** to load, which can take a little while.

> **Note:** If X Shield shows **Development Store Not Supported**, install it on a live store on a paid Shopify plan instead.

## Why isn’t anything blocked yet? {#why-isnt-anything-blocked-yet}

Usually because the X Shield app embed is off. X Shield runs from your live theme, and until the embed is on, no visitor is checked and the Overview shows **Theme extension is not enabled — nothing is being blocked**. New stores miss this step more than any other.

### Turn on the app embed {#turn-on-the-app-embed}

1. Click **Enable in theme** on that banner (in the setup guide, **Enable app embed**). Your live theme’s editor opens in a new tab with **X Shield** switched on under **App embeds**.
2. Click **Save** in the theme editor.
3. Go back to the X Shield tab. The banner disappears and the status strip shows **Theme extension** as **Active**.

To do it by hand, follow [Shopify’s steps for app embeds](https://help.shopify.com/en/manual/online-store/themes/customizing-themes/apps): **Online Store** → **Edit theme** on your live theme → the **App embeds** icon → switch on **X Shield** → **Save**.

> **Note:** The app embed belongs to one theme. If you publish a different theme, switch X Shield on there too; until you do, the banner comes back.

### Removing X Shield {#removing-x-shield}

X Shield is a theme app extension, so it writes nothing into your theme files. To pause it, switch the X Shield app embed off in the theme editor and save. To remove it, first release any order holds X Shield placed, then [uninstall the app](https://help.shopify.com/en/manual/apps/uninstalling-apps) from **Settings** → **Apps**; Shopify [removes the app embed automatically](https://shopify.dev/docs/apps/build/online-store/theme-app-extensions/ux). X Shield deletes your settings within 48 hours of uninstall ([privacy policy](/legal/privacy/#app-x-shield)).

## What does the setup guide ask for? {#what-does-the-setup-guide-ask-for}

The setup guide, **Set up X Shield**, has four steps, in any order. Open it with **Continue setup** on the Overview’s **Finish setting up X Shield** strip.

| Step | What to do |
| --- | --- |
| **Turn on X Shield in your theme** | **Enable app embed**, then save the theme. |
| **Turn on the protections most stores need** | **Turn them all on** switches on **Bot protection**, **Media protection** and **Right-click on media**. |
| **Block the countries you don’t sell to** | Add countries and click **Save country rules**, or choose **I sell everywhere**. |
| **Choose your plan** | **Stay on Free** or pick a paid plan. This step waits for the app embed. |

**Save country rules** switches on GEO control with those countries blocked; the guide never suggests a country you sell to through Shopify Markets. Protections that can turn real shoppers away, such as **VPN/Proxy protection**, stay off until you choose them.

## How do I add my first rule? {#how-do-i-add-my-first-rule}

Use the setup guide’s country step, or open **GEO control** or **IP & Network**: switch the page on, pick an **Access mode**, add your entries and click **Save** in the save bar. The Free plan caps how many entries you can list ([compare plans](/shopify/x-shield/#pricing)); [block a country](/docs/x-shield/block-countries/) and [block an IP address](/docs/x-shield/block-ip-addresses/) cover every option.

Your own visits are checked like anyone else’s. If a rule you’re editing matches your connection, the page warns **These rules would block you** before you save.

## How do I check a rule before it goes live? {#how-do-i-check-a-rule-before-it-goes-live}

Switch on dry run before you save the rule, then watch what it would do. Both testing tools are on the **Safety & testing** page.

### Observe with dry run {#observe-with-dry-run}

1. Under **Dry run**, click **Observe only**, then **Save**. A toast confirms **Dry run on — nobody is being blocked right now**.
2. Save your new rule. X Shield records who your rules would block, but lets everyone through.
3. After a day or two, click **Block for real** and **Save**.

Dry run is free on every plan, but only paid plans show its results visitor by visitor in **Analytics**. On the Free plan, **Recent blocked visitors** lists real blocks only, so rely on **Test your rules**.

### Test one visitor {#test-one-visitor}

1. Under **Test your rules**, enter an **IP address** or a two-letter **Country code** and click **Test**, or click **Test my own connection**.
2. Read the result: **Blocked** or **Let through**. The test checks your saved country, IP and network rules, not bot, VPN, scraper-network or developer-tools protection.

## How do I make sure I can always get back in? {#how-do-i-make-sure-i-can-always-get-back-in}

Create your private access link on the first day. Opening your store with it skips every rule, on any network and any device.

1. On **Safety & testing**, under **Your private access link**, click **Create link**.
2. Click **Save**. The link starts working when you save.
3. Click **Copy link** and keep it somewhere safe, such as a password manager.

The bypass lasts until you close that browser tab. Treat the link like a password: if it leaks, click **Generate a new link** and **Save**, and the old one stops working. Your Shopify admin is never blocked.

## How do I know X Shield is working? {#how-do-i-know-x-shield-is-working}

Look at the Overview: there’s no warning banner, **Theme extension** reads **Active**, and the subtitle shows how many protections are on. Once all four setup steps are done, the setup guide’s status reads **Your store is guarded**. Rule changes apply from the next page a visitor loads.

- Blocked visitors appear in **Analytics** as traffic arrives.
- X Shield works in each visitor’s browser, so Shopify’s checkout and tools that don’t run JavaScript are outside its reach, and Shopify may still count visits it blocked: see [why blocked visitors can still appear in Shopify Analytics](/docs/x-shield/blocked-visitors-in-shopify-analytics/).
- If the embed is on and still nothing is blocked, see [what to check when X Shield isn’t blocking](/docs/x-shield/not-blocking/).

## What should I set up next? {#what-should-i-set-up-next}

Check [how X Shield keeps Googlebot in](/docs/x-shield/bot-protection/), then consider [VPN and scraper-network blocking](/docs/x-shield/vpn-proxy-scraper-blocking/) for the cloud networks scrapers use.

## Related {#related}

- [Block a country](/docs/x-shield/block-countries/)
- [Block an IP address](/docs/x-shield/block-ip-addresses/)
- [Dry run and your private access link](/docs/x-shield/safety-and-testing/)

[X Shield: IP Country Blocker](/shopify/x-shield/)

X Shield is a Shopify app that blocks visitors by country, IP address or network, and turns away the bots, VPNs and spy extensions it detects, showing them a blocked page instead of your store. Googlebot and Bingbot, checked against their published IP ranges, still get in, and dry run lets you test every rule before it blocks anyone.

[Install free on the Shopify App Store](https://apps.shopify.com/x-shield-store-guard?utm_source=b2bgold.app&utm_medium=referral&utm_campaign=docs&utm_content=docs/x-shield/getting-started&utm_term=card) [Plans and pricing](/shopify/x-shield/#pricing) [How X Shield compares with Blockify](/compare/x-shield-vs-blockify/)

Need help with X Shield? Email [support@b2bgold.app](mailto:support@b2bgold.app).