Tutorial
How to block an IP address on Shopify (2026 guide)
Shopify has no native IP blocking, so this needs an app. Here's how to do it, how to find the offending IP in the first place, and why blocking a single address is usually the wrong rule.
Bas Lefeber
Founder, learnshopify.dev · August 3, 2026 · 4 min read
Someone is placing fraudulent orders, spamming your contact form, or hammering your product pages, and you have their IP address. The obvious move is to block it. Two things to know before you start, because both change what you should do.
Answer first
Shopify has no native IP blocking. There is no setting anywhere in the admin, and no Liquid code can do it either, because Liquid never sees the visitor's IP. An app is the only route. And before you block a single address, check whether it is actually the right rule: most abuse rotates addresses, so blocking one IP stops it for roughly ten minutes.
Step 1: find the IP
You cannot act on what you cannot see, and where the IP lives depends on what happened.
If it was an order, Shopify recorded it. Open the order in your admin and look at the fraud analysis section, which shows the IP the order was placed from alongside its risk signals. Developers can read the same value as clientIp on the Admin API's Order object with the read_orders scope:
query OrderIp { order(id: "gid://shopify/Order/1234567890") { name clientIp }}If it was traffic rather than an order, Shopify did not record it anywhere you can reach. Storefront analytics show sessions and countries, not IPs. This is the common case for scraping and bot traffic, and it is the reason most merchants end up installing a blocking app: the app's visitor log becomes the only place the offending address is visible at all.
Do not trust a Liquid snippet for this
Any tutorial offering theme code that reads a visitor's IP is wrong. Shopify's Liquid request object exposes exactly five properties (design_mode, host, locale, origin, page_type) and none of them is the IP. Here is the architectural reason: Shopify renders Liquid once and caches the HTML for many visitors, so per-visitor data cannot be in the template.
Step 2: pick the right rule, not the narrowest one
This is where most people go wrong, and it is worth thirty seconds of thought because it decides whether the fix lasts. A single IP is the narrowest tool available and the easiest to walk around: a phone toggling airplane mode gets a new one, and a botnet never used the same one twice.
| What you're seeing | The rule you want |
|---|---|
| One person, repeatedly, from one address | Single IP |
| Several addresses that look sequential | CIDR range, e.g. 203.0.113.0/24 |
| Constantly changing addresses, same behaviour | ASN, the whole network operator |
| Catalog scraping, ad click fraud | Datacenter networks (AWS, GCP, Alibaba) |
| Fraud that reappears after every block | VPN and proxy detection |
Step 3: add the rule
Using Cordon as the example, since IP rules are on its free plan:
- Enable the app embed. After installing, the Setup screen opens your theme editor so you can switch on the
Cordon Block & Protectembed and save. Nothing is filtered until this is on. - Open the Rules page and use Block by IP address. Paste a single address or a CIDR range. For a whole network operator, use the ASN field instead. Changes stay a draft until you press Save.
- Add anything that must never be blocked to the Allowlist. Your office, your agency, your monitoring service. Allowlist entries win over block rules, which saves you from locking yourself out with an over-broad range.
- Watch the Logs page. It shows country, network, and the exact rule that fired for each visitor, so you can confirm you caught the right traffic and nothing else.
Allowlist yourself before you block a range
The classic self-inflicted outage is blocking a CIDR range or ASN that turns out to include your own ISP, then locking yourself out of your own storefront while convinced the app is broken. Add your own address to the allowlist first. It takes ten seconds.
What blocking an IP will not fix
Set expectations honestly, because IP blocking gets oversold:
- It will not stop a determined individual. Anyone who notices they are blocked can use a VPN, mobile data, or a proxy. That is why VPN and proxy detection matters more than the address list itself.
- It will not undo an order already placed. Blocking after the fact prevents the next one. Cancel and refund the existing order separately.
- It will not stop raw HTTP clients from reading your HTML. Storefront-layer apps run in the browser, so they stop a person using the store rather than a script fetching the page. Edge-tier enforcement narrows that considerably, but nothing available to a merchant closes it fully.
Learn this properly · free lesson
The shape of a theme: where everything lives
Understanding what a theme can and cannot see makes security advice much easier to evaluate. Map a real Shopify theme in your browser. Free lesson, no signup.
Try this lesson — freeFor the merchant-side walkthrough there is a step-by-step IP blocking guide, and an explainer on ASNs if the "block the whole network" option in the table above is the one that matches your problem. If the addresses keep changing, blocking VPN and proxy traffic is the follow-up you actually need.
Frequently asked questions
Can you block an IP address on Shopify without an app?
No. Shopify has no native IP blocking setting anywhere in the admin, and it cannot be done with theme code either, because Liquid never receives the visitor's IP. The Liquid request object exposes only design_mode, host, locale, origin and page_type. An app that runs its own detection service is the only way.
How do I find the IP address of a Shopify order?
Open the order in your Shopify admin and check the fraud analysis section, which shows the IP the order was placed from. Developers can query the same value as clientIp on the Order object in the GraphQL Admin API, which requires the read_orders scope. For traffic that never became an order, Shopify does not expose the IP at all, so a blocking app's visitor log is usually the only place to see it.
Should I block a single IP or a whole range?
It depends on the pattern. A single IP suits one known individual. Sequential addresses suggest a CIDR range. Constantly changing addresses with the same behaviour call for blocking the ASN, meaning the whole network operator. Catalog scraping and ad click fraud usually come from datacenter networks like AWS, GCP or Alibaba, and fraud that reappears after every block needs VPN and proxy detection rather than any address rule.
Will blocking an IP stop someone using a VPN?
No. Blocking an address stops that address only, and a VPN gives the visitor a different one immediately. To stop someone who is actively evading you, you need detection of the connection type (VPN, residential proxy, Tor exit, datacenter) rather than a list of addresses, because that survives rotation.
How do I avoid blocking myself on Shopify?
Add your own IP address to the app's allowlist before adding any broad rule. Allowlist entries take priority over block rules. The common self-inflicted outage is blocking a CIDR range or ASN that happens to include your own ISP, then losing access to your storefront while assuming the app has broken.
Start free
Ready to become a Shopify developer?
You just read how it works. Now write it yourself: real tickets from a live store, in an editor where the storefront updates as you type. Module 1 is free, no card.
Free · No credit card · Your first win in minutes
About the author
Bas Lefeber, Founder, learnshopify.dev
Bas builds learnshopify.dev, where developers learn production-grade Shopify theme development against a live storefront. He writes about Liquid, theme architecture, and the parts of the job that still matter now that AI writes the code.
Keep going in the curriculum
