Most "ghost carts" are automated bot-created abandoned checkouts, not real shoppers who changed their minds. The first move isn't blocking the bots at the firewall. It's stopping them from triggering recovery emails and skewing your analytics, which you can do through Shopify Flow tagging, ESP suppression filters, and Shopify's own reporting tools, before you spend money on edge defenses like a WAF or Shop Pay protections.
TL;DR:
- Review the last 50 to 100 abandoned checkouts for repeated shipping details, disposable email domains, placeholder names, and sessions with almost no engagement.
- Shopify filters identified bots from most standard reports, but Live View still displays them, while Flow excludes flagged attempts from its abandoned checkout workflow.
- Tag suspected profiles in Shopify Flow, suppress matching addresses in your email platform, and exclude near zero engagement sessions from GA4 and Shopify reports.
- A web application firewall can challenge suspicious requests, but stores without Shopify Plus may not proxy the checkout domain, while native bot protection and checkout CAPTCHA require Plus.
- Once bot activity is filtered, email recovery still misses visitors who never share contact details; native iOS App Clips provide a push notification channel.
Table of Contents
- How Bots Create Ghost Carts (and Why It Matters)
- What Shopify Already Filters, and Where Gaps Remain
- Your Detection Checklist in Shopify, GA4, and Your ESP
- Mitigation Tactics, Ordered from Easiest to Most Technical
- How to Stop Ghost Carts from Costing You Marketing Budget
- Re-Engaging Anonymous Visitors Without Email
- Do Ghost Carts Behave Differently Across Themes and Apps?
- Staying Ahead of Bot Patterns Over Time
- The Part of This Playbook Most Merchants Skip
- Try a Cart Recovery Channel That Doesn't Need an Email
- FAQ
- Sources
How Bots Create Ghost Carts (and Why It Matters)
Ghost carts almost always trace back to a handful of automated patterns. Bots skip your storefront entirely and hit the backend directly, often through a cart permalink like /cart/{variant_id}:1, then push straight to checkout without ever loading your theme or its JavaScript. That's why storefront-based CAPTCHAs and pop-up blockers frequently miss them.
Once at checkout, scripted bots fill in fake customer data: disposable email addresses, placeholder names, and shipping details that repeat across dozens or hundreds of attempts. You'll often see the same address format, the same zip code, or the same oddly capitalized name pattern showing up again and again.
The damage isn't theoretical. Ghost carts:
- Pollute your abandoned-cart reports with checkouts that were never going to convert
- Waste email sends and strain your sender reputation when messages bounce or get ignored
- Skew ad platform learning, since attribution models can't tell a bot session from a real one
- Create false urgency around inventory that isn't actually moving
A Shopify Community thread tracking this exact problem shows bots hitting cart and checkout permalinks directly, bypassing the storefront entirely and defeating many app-based blockers in the process.
What Shopify Already Filters, and Where Gaps Remain
Shopify isn't blind to this. By default, it filters sessions it identifies as bots out of session-related reports, so your traffic numbers aren't automatically inflated by every scraper that visits your store. The bot filtering documentation is clear that this filtering happens automatically in most standard reports.
The catch is that not every surface respects that filter. Live View, for example, still shows bot interactions as they happen, which can make traffic look more alarming than your weekly reports suggest.
Shopify Flow gets more targeted protection: checkout attempts it flags as suspected card testing or bot activity are excluded from triggering the customer abandons checkout workflow, so at least some bot sessions never reach your recovery automations in the first place.
Where gaps show up most is on non-Plus stores, where the checkout subdomain can't be proxied the same way, leaving a direct path for backend-targeting bots that built-in filtering doesn't fully catch.
Your Detection Checklist in Shopify, GA4, and Your ESP
Before you suppress anything, confirm you're actually looking at bot activity and not a weird but real sales pattern. Run through this sequence:
- Pull your last 50 to 100 abandoned checkouts and scan for repeated shipping addresses, identical zip codes, or names with unusual formatting.
- Check for disposable email domains (temporary mail services, obviously randomized strings) clustering around the same product or variant ID.
- Turn on the Human or bot session filter where Shopify supports it, and cross-reference flagged sessions against your abandoned checkout list.
- Build a GA4 segment for sessions with near-zero engagement time, since genuine shoppers almost never abandon in under a second.
- Export a sample batch of five to ten suspected bot checkouts, capturing IP, referer, and shipping pattern, so you have concrete signatures to build suppression rules from.
Shopify's own guidance on identifying bot activity points to sudden traffic spikes, unusually formatted customer profiles, and high volumes of zero-engagement sessions as the clearest tells, as described in its identifying bot activity resource. That matches what merchants report in the wild: the pattern is rarely subtle once you know where to look.
Mitigation Tactics, Ordered from Easiest to Most Technical
Start cheap and reversible, then escalate only if the problem persists, including using Shopify SEO Automation tools to help optimize your store's performance and analytics. Here's the order that tends to make sense for most stores:
- Edge control first: routing traffic through Cloudflare or another WAF lets you rate-limit and challenge suspicious requests before they reach your store, though non-Plus stores can't always proxy
checkout.shopify.com, which limits how much this helps against direct-to-checkout attacks. - Shopify Plus protections: if you're on Plus, native Bot Protection and checkout CAPTCHA options give you platform-level defenses that non-Plus stores don't have access to, as noted in Shopify's abandoned checkouts guidance.
- Front-end friction, with trade-offs: requiring login before checkout, switching to a three-page checkout flow, or hiding free and ultra-cheap SKUs can break simple scripts, but each one adds a small amount of friction for real customers too.
- App-level suppression: tagging suspected bot profiles through Flow, scoring incoming requests, or using a dedicated filtering app removes fake customers from your recovery flows even when you can't block the request itself.
- Custom proxy or developer escalation: when backend-targeting bots persist, a custom server-side proxy or fingerprinting layer can catch what storefront defenses miss, though this is the most expensive and technical option on the list.
Merchant threads documenting large-scale bot abuse consistently point to a practical sequence: capture examples, suppress in the ESP, tag in Flow, then re-enable clean recovery emails, as described in reports on backend checkout abuse.
Pro Tip: Fix your email and analytics suppression before you spend money on a WAF. It's the cheapest step and it stops the bleeding immediately.
How to Stop Ghost Carts from Costing You Marketing Budget
Protecting your marketing channels is the highest-leverage move you can make, and it doesn't require developer time.
- Build a Shopify Flow that checks new abandoned checkouts against red flags (disposable email domain, duplicate shipping address, placeholder-style name) and tags or deletes matching customer records before your abandoned-cart automation fires.
- Create a suppression segment in your ESP using the same signatures: repeated address blocks, known disposable domains, and obviously fake name patterns.
- Build a GA4 segment and a Shopify report filter that exclude zero-engagement sessions, so your ad attribution and conversion numbers reflect real shoppers.
- Watch your bounce rate after any suppression change. If bounces spike, pause the abandoned-cart flow and investigate before resuming sends.
A detailed walkthrough of Flow logic for this exact use case is in our Shopify Flow automations guide, and merchants running similar suppression workflows on the Shopify Community describe a recurring four-step fix: capture samples, suppress in the ESP, tag in Flow, then re-enable targeted sends to human traffic only.
Pro Tip: Pause your abandoned-cart automation the moment you notice a spike. It's easier to resume a clean flow than to repair a damaged sender reputation.
Re-Engaging Anonymous Visitors Without Email
Suppression and blocking solve the bot problem, but they don't solve the bigger one: most real visitors leave without giving you an email or phone number at all. That's the gap we built StorePush to close. We send push notifications to shoppers' lock screens through native iOS App Clips, with no email, phone number, or app install required.
That matters most after you've cleaned up your bot problem, because it means your recovery efforts aren't capped by how many people filled out a form. Detection and suppression come first. Once your abandoned-checkout data is trustworthy, re-engaging the anonymous visitors you'd otherwise never reach becomes the next lever, one email suppression alone can't pull. We cover this approach in more detail in our piece on recovering carts without emails or phone numbers.
Do Ghost Carts Behave Differently Across Themes and Apps?
Yes, and the differences come down to how much of your checkout logic lives in the theme versus the platform. Stores running heavily customized themes with extra JavaScript-based cart validation tend to see fewer ghost carts from simple scripts, since those bots often fail to execute anything beyond a basic form post.
But that protection is partial at best. Bots that target the cart permalink directly, as documented in merchant reports on backend checkout abuse, never load your theme's JavaScript at all, so a custom theme offers no real defense against that specific attack pattern.
Apps add another layer of variation. Upsell apps, subscription apps, and third-party checkout extensions each create additional entry points into your cart and checkout flow, and bots that target one store's exact app stack often fail against a different combination simply because the request structure doesn't match. This is part of why a mitigation that works for one merchant sometimes does nothing for another: the bot was built against a specific setup, not against Shopify generally.
The practical takeaway is that theme and app diversity creates inconsistent bot behavior across stores, so a tactic you read about in a forum post may need adjusting for your specific stack before it does anything useful.
Staying Ahead of Bot Patterns Over Time
Bot tactics shift, and a suppression rule that works today can stop working in a few months once the pattern changes. Treat detection as an ongoing habit rather than a one-time fix.
Review your abandoned checkout list on a regular cadence, not just when something looks obviously wrong. Spikes are easy to spot, but a slow drift in fake-looking checkouts can go unnoticed for weeks if you're not checking.
Keep a running log of the signatures you've already suppressed (address patterns, email domains, user-agent quirks) so you can compare new suspicious activity against what you've seen before. If a new wave of ghost carts doesn't match your existing suppression rules, that's a sign the bot has changed tactics and your filters need updating.
Pay attention to community threads and Shopify's own documentation updates, since large-scale bot campaigns tend to get reported by multiple merchants around the same time. If you see a sudden uptick that matches what others are describing, you're likely dealing with the same wave rather than something unique to your store.
Finally, revisit your edge defenses periodically. A WAF rule set configured a year ago may not account for newer bot behavior, and Shopify's own bot filtering improves over time too, so what required a manual workaround last year might be handled automatically now.
The Part of This Playbook Most Merchants Skip
Most advice on ghost carts jumps straight to blocking: get a WAF, enable Plus bot protection, add a CAPTCHA. That's not wrong, but it's backward for most stores. The actual cost of a ghost cart isn't the fake checkout itself. It's the email that goes out to a dead address, the ad platform that learns from a session that never engaged, and the conversion rate that looks worse than your real performance.
Suppression is cheap, fast, and entirely within a merchant's control without touching infrastructure. Blocking at the edge is valuable, but it's also the step most likely to require a developer, a budget line, or a Plus plan you may not have.
The other blind spot is treating email as the only recovery channel worth protecting. Once your data is clean, the bigger opportunity is the anonymous majority of visitors who never gave you a way to follow up at all. Fixing your analytics without expanding who you can actually reach solves half the problem.
— Lucas
Try a Cart Recovery Channel That Doesn't Need an Email
Suppression and bot filtering clean up the carts you already know about, but they don't do anything for the visitors who leave without entering an email or phone number in the first place. That's most of your traffic. Our push notifications reach those shoppers' lock screens through native iOS App Clips, with zero signup or app install required on their end, so you can recover carts from the segment your ESP never even sees.
It works alongside the suppression workflow covered above, not instead of it: clean your data first, then use push to reach the anonymous majority your email flows were never going to touch. Our Free plan is available at Storepush, with a Pro plan at $50 per month plus a 5% usage commission on recovered revenue for stores that want full dashboard attribution and funnel tracking. Check out the integration details and start recovering carts you've been missing entirely.
FAQ
How do you recover an abandoned cart?
Standard recovery relies on an abandoned-cart email sent after a shopper enters an email and leaves without buying, triggered once Shopify records the checkout as abandoned per its abandoned checkout guidance. For visitors who never provide an email, a lock-screen push notification through an App Clip offers a non-email path to the same follow-up.
Can you make $10,000 a month on Shopify?
Shopify stores at that revenue level exist, but the figure depends entirely on niche, margins, ad spend, and operational costs, none of which follow a fixed formula. Treat any specific income claim as store-dependent rather than a typical outcome.
Does Kim Kardashian use Shopify?
We don't have a verifiable source confirming which e-commerce platform any specific celebrity-owned store runs on, so this isn't something we can confirm or deny accurately.
What is the best cart app for Shopify?
The right app depends on whether you need bot suppression, email recovery, or non-email re-engagement, since those solve different parts of the abandonment problem. For anonymous visitors who never share contact details, a push-based tool like StorePush addresses a gap that email-only recovery apps can't reach.
How do I fix ghost carts on my store?
Start by suppressing suspected bot profiles in your ESP and Shopify Flow so they stop triggering recovery emails, then layer in edge defenses like a WAF if the pattern persists, as outlined in Shopify's bot filtering documentation. Confirm the pattern with a detection checklist before applying any fix, since not every unusual checkout is actually a bot.
Sources
- Bot filtering in Shopify analytics and reports — Shopify Help Center
- 100s of Bots Are Abandoning Cart and Abusing Checkout Everyday, Nothing Works! — Shopify Community