In short: You cannot fully block bots from a Shopify store, because robots.txt only stops bots that choose to follow it. Focus on the damage instead: reporting noise is easy to filter out, while bots in your advertising waste spend and corrupt your audiences, and need active attention.
Struggling with bot traffic?
This is one of the most pressing issues for a lot of Shopify store owners we speak to.
First off, you can't definitively stop bots from visiting your site.
You can disallow bots via your robots.txt, but that only works if the bot listens to your rules, it's not a hard barrier.
A more helpful framing is this:
What problems is the bot traffic actually causing you?
Those problems fall into two buckets, advertising and reporting.
| Reporting issues | Advertising issues | |
|---|---|---|
| What happens | Bots inflate sessions and skew your analytics | Bots click ads and fire events like AddToCart |
| What it costs | Nothing directly, it is noise | Wasted ad spend and corrupted audiences |
| How urgent | Low | High, damage builds every day |
| What to do | Turn on the bot filters in Shopify, Hotjar, Clarity and GA | Watch for bot patterns, claim credits and protect your audiences |
Reporting issues
Reporting issues are annoying, ultimately do not cost you any money.
Shopify, Hotjar, Clarity and GA all have bot traffic filters you can toggle on for your reports and they generally do a good job of cleaning them up.
Advertising issues
Advertising bot issues can become costly very quickly:
Spend loss: Modern bots can mimic real user behavior very well, bypassing Google and Meta bot traffic filters.
This can eat your budget intra-day, causing you to spend less on real users, even if you get credits later.
If the platforms don't catch it at all and you don't make a claim, bot traffic can cost you money permanently in the form of wasted spend.
Audience and optimization corruption: When a bot triggers a purchase or add-to-cart event, the ad system learns that this fake behavior equals success.
Then it serves more ads to similar bot profiles.
The algorithm cannot tell a bot AddToCart from a human one, so it builds its model of "your customer" partly out of non-humans and buys more of them.
Retargeting and lookalike audiences can be built from site visitors. Good bots will enter those pools, so the modeling of your audiences will become junk over time.
Email me at james@kirkbyconsulting.com or contact us if you need help solving your bot traffic issues.
Frequently asked questions
Can I block bots with robots.txt?
Does bot traffic cost me money?
How do I filter bot traffic out of my reports?
Why is bot traffic bad for Meta and Google ads?
Sources
Spotted something wrong or out of date? Email hello@kirkbyconsulting.com with the details and we will correct it.