Shopify bot traffic checker
This free checker reads a sessions export from your own Shopify admin and shows how many sessions Shopify classified as bots, which countries they came from and which pages they landed on. It runs in your browser: the file is never uploaded, stored or sent anywhere.
How do I check my Shopify store for bot traffic?
To check a Shopify store for bot traffic, run two ShopifyQL queries in your Shopify admin, export the results as CSV and drop the files below: the checker shows the share of sessions Shopify classified as bots, by country and by landing page. It takes a few minutes, and the files never leave your browser.
We tested it on 10 October 2026 with real exports from X Shield’s demo store. You need access to the store’s reports in its Shopify admin.
Step 1: Run the two queries in your Shopify admin
Each link opens Analytics → Reports in your Shopify admin, with the query already loaded, in a new tab. If you work in more than one store, the link may open a different one from the store you mean, so check the store name before you export. Neither query filters out bots, which Shopify’s own session reports do by default.
Query 1: Sessions by country, human or bot
FROM sessions
SHOW sessions, sessions_with_cart_additions, sessions_that_reached_checkout,
sessions_that_completed_checkout
GROUP BY session_country, human_or_bot_session
SINCE startOfDay(-30d) UNTIL today
ORDER BY sessions DESC
LIMIT 1000Query 2: Sessions by landing page, human or bot
FROM sessions
SHOW sessions, sessions_with_cart_additions, sessions_that_completed_checkout
GROUP BY landing_page_path, human_or_bot_session
SINCE startOfDay(-30d) UNTIL today
ORDER BY sessions DESC
LIMIT 1000Step 2: Export each result as CSV
- Click Export at the top of the report (on a narrow window it may be under the ⋯ menu). You don’t need to save the report first.
- Choose Comma Separated Values (CSV) and All results from the data query, then click Export. The file downloads with the report’s name and dates, such as “Sessions by location - 2026-09-10 - 2026-10-10.csv”.
If the Unsaved changes bar covers the Export button, collapse the admin’s sidebar or widen the window. Labels checked in a Shopify admin on 10 October 2026.
Step 3: Check the files here
This step needs JavaScript, which is off or blocked in your browser. You can still read the export yourself: see how to read the export without the checker.
Or paste the CSV text
No export to hand?
Your results
- Sessions
- Bot sessions
- Bot share
What it means
Shopify classified none of these sessions as bots. Either it identified none on your store, which its cautious classification allows, or the export was filtered to human sessions. Shopify’s own Sessions by location report carries that filter, so check that you exported the queries above unchanged.
Shopify classified of your sessions as bots. That is under 10%, which by our rule of thumb (Shopify publishes none) is low, and Shopify already leaves these sessions out of its session reports by default.
Shopify classified of your sessions as bots: between 10% and 30%, which by our rule of thumb (Shopify publishes none) is noticeable. Shopify leaves them out of its session reports by default, but they still load your pages, and ad pixels that run in the browser can fire for bots that run JavaScript.
Shopify classified of your sessions as bots: more than 30%, which by our rule of thumb (Shopify publishes none) is high. Shopify leaves them out of its session reports by default, but they still load your pages, and ad pixels that run in the browser can fire for bots that run JavaScript.
Countries behind of the bot sessions: .
of the bot sessions landed on product or collection pages rather than your home page. In our reading, automated visits that go straight to products are either search and shopping crawlers or tools copying your catalogue and prices; this export can’t tell them apart.
of the bot sessions landed on your home page. In our reading, bots that load only your home page are more often speed tests and site checkers than scrapers, and not every bot is unwelcome.
Some countries sent sessions that Shopify classified as human but that never added to cart or completed checkout in this period: . They may be people browsing, or automation Shopify didn’t identify. If you don’t sell there, they are worth a closer look; if you do, check whether a campaign sends that traffic.
This export’s session total is only , so a handful of visits moves these percentages a lot.
Sessions with neither a human nor a bot label: . They count towards your total sessions, but not as bots.
Your two files don’t cover the same number of sessions. Either they are for different periods, or the landing-page export stopped at the query’s 1,000-row limit; if so, the landing-page shares cover only those rows.
The column names in your export weren’t the ones we know, so the checker matched the columns by their position in the query. If a number looks wrong, export the queries above unchanged.
Rows skipped because a count in them couldn’t be read: .
Countries with the most sessions
Add the export of query 1 to see countries.
| Country | Sessions | Bot sessions | Bot share |
|---|
Landing pages bots hit most
Add the export of query 2 to see landing pages.
No bot sessions in this export, so no landing pages to show.
| Landing page | Bot sessions | Share of bot sessions | Human sessions |
|---|
Cart additions and purchases by country
Add the export of query 1, with all its columns, to see this.
| Country | Sessions | No cart addition | Completed checkout |
|---|
Highlighted: 10 or more sessions, and not one added to cart or completed checkout in the period. Bot and human sessions are counted together here.
What to do next
- For your reports, nothing. Shopify already leaves the bot sessions it identifies out of its session reports, by default since 21–23 September 2026.
- For crawlers that obey robots.txt, a rule in your theme’s robots.txt asks a named crawler to stay away; scrapers can ignore it. How to add a robots.txt rule on Shopify.
- For your ads, judge campaigns on purchases rather than page views or add-to-carts, which bots inflate far more easily.
If you don’t sell where most of your bot sessions come from (), X Shield, which we build, can block on your storefront with a country rule, and visitors you block by country, IP, VPN or bot rules stay out of your Shopify Analytics. If you do sell there, block the networks the bots come from instead: a country rule turns away your customers too.
Block countries in X Shield · block scraper networks in X Shield · test the rule in dry run first
X Shield, which we build, has Bot protection and Scraper network blocking for automated visits to your storefront, and visitors you block by country, IP, VPN or bot rules stay out of your Shopify Analytics.
Block scraper networks in X Shield · how X Shield keeps Googlebot in
X Shield, which we build, blocks visitors on your storefront by country, IP address and network, with bot and VPN protection, and visitors you block by country, IP, VPN or bot rules stay out of your Shopify Analytics. Its dry run lets you test a rule without blocking anyone.
Your reports don’t need a blocker: Shopify already leaves out the bot sessions it identifies. X Shield, which we build, is for keeping visitors off your storefront instead: countries you don’t serve, or networks you don’t want reading your products. Visitors you block by country, IP, VPN or bot rules stay out of your Shopify Analytics.
X Shield works as JavaScript on your storefront pages. Bots that never run JavaScript, requests to /products.json and Shopify’s checkout are outside its reach, and sessions Shopify has already recorded stay in your reports.
How do I read the export without the checker?
To read a Shopify sessions export by hand, open the CSV in a spreadsheet and add up the Sessions column twice: once for the rows marked bot, once for all rows. The first total divided by the second is your bot share. Sort the bot rows by Sessions to see where the bots come from.
| Column | What it counts |
|---|---|
| Session country | The country the visitor was in (query 1) |
| Landing page path | The first page of the visit; your home page is / (query 2) |
| Human or bot session | Shopify’s verdict on the visit: human or bot |
| Sessions | Visits to your online store |
| Sessions with cart additions | Visits in which something was added to the cart |
| Sessions that reached checkout | Visits that reached the checkout page (query 1) |
| Sessions that completed checkout | Visits in which a purchase was completed |
Field definitions: Shopify’s ShopifyQL sessions schema. In the country export, a country whose sessions over 30 days never once add to cart or complete checkout deserves a second look, even where Shopify says they were human: a person who never shops and a bot Shopify didn’t catch look the same here.
Example exports from X Shield’s demo store, 10 September to 10 October 2026
Query 1, as Shopify exported it (it downloaded as “Sessions by location - 2026-09-10 - 2026-10-10.csv”). The demo store’s storefront is password-protected, so it gets few visitors.
"Session country","Human or bot session","Sessions","Sessions with cart additions","Sessions that reached checkout","Sessions that completed checkout"
"India","human",28,0,0,0
"Vietnam","human",18,0,0,0
"United States","bot",9,0,0,0
"France","human",2,0,0,0
"Canada","human",2,0,0,0
"United States","human",2,1,1,0
"Italy","human",1,1,1,0
"Pakistan","human",1,0,0,0
"Japan","human",1,0,0,0
"French Polynesia","human",1,0,0,0
"Switzerland","human",1,0,0,0
Query 2, with the handles of two unlisted test pages replaced by page-a and page-b.
"Landing page path","Human or bot session","Sessions","Sessions with cart additions","Sessions that completed checkout"
"/","human",43,2,0
"/pages/page-a","human",12,0,0
"/","bot",9,0,0
"/pages/page-b","human",2,0,0
How does Shopify decide which sessions are bots?
Shopify decides which sessions are bots by checking each event on your online store “against a set of criteria” and then labelling the whole session human or bot; the checker only counts those labels. The classification is cautious by design: Shopify says “it's better to miss some bots than incorrectly label real customers as bots”, so read the bot share as a minimum.
- Only sessions from 7 October 2025 onwards are classified: Shopify “can't retroactively classify older sessions”.
- Since Shopify’s session measurement update, rolled out from 21 to 23 September 2026, identified bot sessions are filtered out of session-related reports by default. The two queries above count both kinds.
- The same update ends a session after 30 minutes of inactivity, and Shopify asks you to treat data from after the update as a new baseline. If your period starts before 21 September 2026, the report itself warns that results “may shift”: compare it only with periods after the update.
Sources on help.shopify.com, checked 10 October 2026: Bot filtering in Shopify analytics and reports and Changes to sessions and conversion rate in Shopify Analytics. Exporting is described in Exporting reports.
What should I do with my result?
What to do about the bot traffic the checker finds depends on what it costs you: Shopify already keeps the bot sessions it identifies out of your session reports, which is enough if reports are your only concern. Block traffic on your storefront only when bots cost you something else, such as copied prices and catalogue, or ad audiences built from automated visits.
| Option | What it does | What it can’t do |
|---|---|---|
| Shopify’s bot filter | Leaves the bot sessions Shopify identifies out of session reports, by default | Stop a single visit: it hides bots, it doesn’t block them |
| robots.txt | Asks named crawlers to stay away | Stop scrapers: Shopify calls its rules “directional and advisory” |
| Markets | Limits where you sell | Stop browsing: customers outside your markets “can browse your store, but can't complete a purchase” |
| A storefront blocker app | Turns visitors away on storefront pages by country, IP address or network, and catches some bots and VPNs | Stop bots that never run JavaScript, requests to /products.json, or anything at checkout |
X Shield, which we build, is a storefront blocker: visitors you block by country, IP, VPN or bot rules stay out of your Shopify Analytics, and its dry run lets you test a rule without blocking anyone. It works as JavaScript on your storefront pages, so it can’t stop bots that never run JavaScript, requests to /products.json or anything in Shopify’s checkout. See X Shield, a free country and bot blocker for Shopify.
What the data-centre cities in your reports mean, and each way to block, with its trade-offs: Bot traffic from Singapore and China, explained. What X Shield blocked across Shopify stores, month by month: the monthly Shopify bot traffic report.
Is my data private?
Yes. The checker reads your export with your browser’s own file reader and works everything out on your device; nothing is uploaded, stored or sent to us or anyone else.
- This page’s Content-Security-Policy includes
connect-src 'none', so the browser refuses any connection the page’s scripts try to open, ours included, and the page can load nothing from another site. - No cookies and no analytics, and nothing from your file is stored: close or reload the tab and it is gone.
- To see it for yourself, open your browser’s developer tools on the Network tab and check a file: no request appears. Or load this page, disconnect from the internet, and check a file.
- The two queries group sessions by country and by landing page, so the exports hold no customer names, email addresses or IP addresses.
The rest of the site is covered by the privacy policy.
Frequently asked questions
Why are these numbers higher than my Shopify sessions report?
The checker’s session totals are higher because Shopify’s session reports leave out identified bot sessions by default, and the two queries here count both kinds.
Why does the checker find no bots?
The checker finds no bots when Shopify identified none, which its cautious classification allows, or when the export was filtered to human sessions. Shopify’s own Sessions by location report carries that filter, so export the queries above unchanged. Shopify doesn’t classify sessions from before 7 October 2025.
Can I check a different period?
Yes. In both queries, change -30d in startOfDay(-30d) to the number of days you want, such as -90d, then export again. Shopify labels only sessions from 7 October 2025 onwards.
What if my Shopify admin isn’t in English?
We have tested the checker only with exports from an admin in English, whose column names are English. If yours are named in another language, the checker matches the columns of these two queries by their position and says so under your results. If a number looks wrong, email support@b2bgold.app.
Is the checker free?
Yes. The checker is free, with no account and no sign-up, and it reads files of up to 10 MB, far more than these exports need.