Contributor I

Solved

How to stop bots

5 replies
1039 views

Hi there,

We’re looking for a double opt-in alternative to prevent our list from being spammed.

Recently we have been attacked by bots. I can see there are a lot of fake emails, but their domain is @gmail.com, so I can’t bulk delete them, segment them or do anything that’s not manual. I don’t understand how to prevent it from happening, because we have double opt-in activated.

Any suggestions in how to prevent them and how to delete them?

Shop is made in shopify

Thanks.

Byrne CAnswer

Community Manager

Hey @Taishah99,

Have you managed to suppress these bot profiles? If not, I get it; it can be tricky, especially if they all come from common email domains like gmail.

When I encounter bots in customer accounts, I like to see if they all have certain features in common. Do they all have a + sign in their email address? Did they all take exactly the same action (like starting checkout with a certain item and doing nothing else), or are they all from the same location? If you find similarities between the bot profiles, you can create a segment using these characteristics that does a fairly good job capturing the bots.

Of course, it won’t be perfect, because bot profiles can sometimes try and appear like real profiles, leading to a small number of real profiles entering that segment, but I’d say that this would be a small risk to take for the sake of suppressing these bots. After you create a segment that isolates these profiles, you’d want to suppress that segment periodically, or create a flow with a webhook in it that suppresses profiles that enter that segment.

J

Julia23

Problem Solver I

Hi @Taishah99,

Even with double opt-in, bots can sometimes get through. Here are a few ways to reduce spam in Shopify + Klaviyo:

Enable CAPTCHA/reCAPTCHA on your forms.

Use hidden honeypot fields to catch bots.

Segment and suppress suspicious emails in Klaviyo.

Consider bot-detection apps for Shopify forms.

Combining these should help prevent fake sign-ups and make cleanup easier.

Byrne CAnswer

Community Manager

Hey @Taishah99,

Have you managed to suppress these bot profiles? If not, I get it; it can be tricky, especially if they all come from common email domains like gmail.

When I encounter bots in customer accounts, I like to see if they all have certain features in common. Do they all have a + sign in their email address? Did they all take exactly the same action (like starting checkout with a certain item and doing nothing else), or are they all from the same location? If you find similarities between the bot profiles, you can create a segment using these characteristics that does a fairly good job capturing the bots.

Of course, it won’t be perfect, because bot profiles can sometimes try and appear like real profiles, leading to a small number of real profiles entering that segment, but I’d say that this would be a small risk to take for the sake of suppressing these bots. After you create a segment that isolates these profiles, you’d want to suppress that segment periodically, or create a flow with a webhook in it that suppresses profiles that enter that segment.

L

LifeIsAParty

Contributor I

Hello @Taishah99 ,

There is a new app in the Shopify App store called CartWatch (https://apps.shopify.com/cartwatch), it was created specifically to solve this problem. Have you tried it out?

S

StickySam

Problem Solver I

Hi!

I know this is marked as solved, but I wanted to offer you one more solution that might help! You can create a “suspicious emails” exclusion segment that will target bot behavior. If a bot does make it through the double opt-in, this would be another way to prevent them from getting any campaigns or flow messages. The segment would be Person can receive marketing because person never subscriber and person has received email zero times over all time and person has placed order zero times over all time.

michael_lifecycle

Problem Solver I

Before deleting profiles in bulk, I’d first identify where the records entered the system and whether they share the same source, timestamp pattern, or form behavior.

The safest sequence is source analysis, consent status, profile suppression, then a controlled sign-up test. Otherwise, a cleanup can remove legitimate profiles while leaving the acquisition problem untouched.

Sign up

Use your Klaviyo credentials

Log in to the Community

Use your Klaviyo credentials