How can I block Credit Card Testing bots on shopify creating active profiles

Question

I was wondering if anyone else has experienced this. I use Shopify for my website and for the last few weeks I’ve had an increasing amount of credit‑card testing bots hitting my checkout.

Shopify support say they’ve done everything they can on their side to block the bot traffic (and the attempts no longer appear in my Abandoned Checkouts), but the issue I’m having is that the bots are still triggering Klaviyo to create new profiles. These aren’t sign‑ups — just “active profiles” created when the checkout page loads. The bots don’t visit any other page on my site.

This is pushing my active profile count up, and I’m having to manually suppress these profiles daily using an implicit‑profile segment.

Is there any way to prevent these profiles being created in the first place, or to filter this kind of checkout‑only bot traffic before it counts as an active profile?

Thanks for any help or insight.

ArpitBanjara · Answer

Hey ​@DotKDesignI would suggest using Cloudflare.so what is happening is thatevery time someone enters their email address on the Shopify checkout page, Shopify fires a "Checkout Started" event to Klaviyo and creates a profile., regardless of whether that person signed up for marketing.So even though Shopify has stopped these bots from appearing in your Abandoned Checkouts,, if those bots are still touching your checkout page at all, their email addresses are still making it into Klaviyo. Double opt-in doesn't help here either, because this isn't a subscription event.The issue is that you can't prevent Klaviyo from creating profiles when Shopify sends it data. so it is worth looking ata WAF (Web Application Firewall) solution like Cloudflare in front of your store., Cloudflare's bot management rules will stop bot traffic before it ever reaches Shopify. Some also recommend using Armex app, but i dont have experience with this app.Also on the klaviyo side, you can create a segment such that it catches bot profiles more efficiently and there is low risk of catching real customers. The segment logic i would recommend :Checkout Started at least 1 time over all time, ANDPlaced Order zero times over all time, ANDActive on Site zero times over all time, ANDOpened Email zero times over all time, ANDProfile created is within the last 30 days (optional)Once a profiles are bulk suppressed, it won't count toward your billing plan's active profile count. so yes you will have to do this manually.I hope this helps and thank you for sharing your question here in the community.Cheers,Arpit

Sign up

Use your Klaviyo credentials

Log in to the Community

Use your Klaviyo credentials

Scanning file for viruses.

This file cannot be downloaded