X Shield: IP Country Blocker

Yes, there is a Free plan. It covers 5 countries and 5 IP addresses or ranges, bot, VPN/proxy and scraper-network blocking, content and image protection, dry run, a custom blocked page and your latest 200 blocked visitors. Paid plans add unlimited country and IP rules, spy-extension and developer-tools protection, visitor history and order protection, and your first paid plan starts with a free trial. The pricing table on this page lists what each plan includes.

Not while Googlebot stays ticked under Global bypass → Known bots, which is the default. Crawlers are checked against their owners’ published IP ranges or networks, so the real Googlebot, Bingbot, Applebot, DuckDuckBot and Meta crawlers pass every rule while impostors get no exemption. AI crawlers are opt-in. The blocked page is marked noindex, and X Shield adds no structured data to your pages. To stay safe, don’t block countries you want search traffic from.

Because Shopify can record a visit before X Shield has finished deciding. X Shield checks each visitor in their browser while the page loads, so Shopify may already have counted the session even though the visitor only saw the blocked page, and crawlers can register too. X Shield Analytics counts blocks and Shopify counts sessions, so the two numbers won’t match. Since late September 2026, Shopify also filters sessions it identifies as bots out of its session reports by default.

No. X Shield works on your storefront pages, so it can’t control Shopify’s hosted checkout, including Shop Pay, or block payment authorisations, and a blocked visitor can still reach checkout through a direct checkout link. On paid plans, order protection checks each new order against what X Shield saw on your storefront and flags risky ones in Shopify’s fraud analysis; higher plans can also tag or hold them. To block checkouts by email, address or IP, use Shopify’s Fraud Control app with Shopify Payments.

Find the visit in X Shield Analytics, which lists each blocked visitor with the protection and reason that stopped them, then loosen that rule or exempt their IP address. The Free plan lists your latest 200 blocked visitors. Your Shopify admin is never blocked, so if you lock yourself out, create a private access link under Safety & testing: it skips every rule on any network or device. Use dry run and the rule tester to check changes before they go live.

There’s no universal list, because risk differs from store to store. If you sell to only a few countries, use Allow only listed and add each of them, including your own. Otherwise block only countries you never sell or ship to, guided by your own orders and traffic; X Shield’s setup suggestions never include a country in your active Shopify markets. Visitors on a VPN can appear to be somewhere else, so test new rules in dry run first.

Only if you turn on VPN/Proxy protection, which is off by default. It blocks Tor and visitors on known VPN, proxy and hosting networks, while iCloud Private Relay is exempt. It can’t catch residential proxies or VPNs on networks it doesn’t list, and it will turn away some honest shoppers, so consider Scraper network blocking first: it refuses only clouds known for scraping. Dry run shows who a VPN rule would block before it goes live.

Yes. In GEO control, set Page targeting to Specific pages only and list the paths the rules should cover. Paths match from the start, so /products/linen-shirt covers that product and /collections/wholesale covers that collection and everything under it. A translated URL such as /fr/products/linen-shirt, or a product opened through a collection link, needs its own entry. IP rules have the same option; every other protection applies to the whole store.

Yes, on paid plans, when the extension is installed in the visitor’s browser. Spy extensions protection looks for more than 130 known store-spy and dropshipping extensions, PPSPY and Koala Inspector among them, and shows the blocked page instead of your store. It can’t stop spy services that collect your public store data from their own servers, and new extensions are missed until an app update adds them. The list includes some Shopify developer and SEO tools, so your own team may trip it.

It adds some load, as any storefront app does. X Shield runs from a small inline script and one main script that loads deferred, so it runs after the page’s HTML has been parsed instead of holding it up. A September 2026 update halved that script and removed its main-thread blocking, but some cost remains, so compare your PageSpeed results before and after you turn it on.

No. X Shield runs as an app embed from a theme app extension, so nothing is written into your theme files, and Shopify removes an app’s blocks from your themes when you uninstall it. Before uninstalling, release any fulfillment holds X Shield placed. Its settings are deleted within 48 hours of uninstalling, while order tags it added and any logo you uploaded to your Files stay in your store.

The X Shield admin is available in 20 languages, including English, Spanish, French, German, Japanese and both Simplified and Traditional Chinese, and follows your Shopify admin language. What shoppers see is up to you: the blocked page and protection alerts show the text you write, in one version for every visitor, with English defaults. Email reports are in English.