Tutorial
How to block VPN and proxy traffic on Shopify (2026 guide)
Shopify cannot detect VPNs natively, so this needs an app. Here's how to set it up, and why blocking every VPN visitor outright is usually the wrong setting to choose.
Bas Lefeber
Founder, learnshopify.dev · August 3, 2026 · 5 min read
VPN traffic is how most storefront abuse gets around your other defences. Block a country and a VPN walks past it. Block an IP and a VPN hands out a new one. Chargeback fraud, discount-code abuse, and repeat offenders you thought you had banned nearly always share the same underlying signal: the connection is anonymised.
Answer first
Shopify has no native VPN or proxy detection. Nothing in the admin evaluates whether a visitor's IP is anonymised, and no theme code can do it either. You need an app. But do not reflexively set it to block: a meaningful share of ordinary customers browse on a VPN, and asking them to turn it off converts far better than turning them away.
First: are you sure you want to block them?
This is the question the other guides skip, and it is the one that costs money. Not everyone on a VPN is a fraudster. Consider who is actually behind those connections:
- Corporate employees. Anyone shopping from a work laptop is often routed through a company VPN by policy, with no choice in the matter.
- iCloud Private Relay users. Apple turns this on for iCloud+ subscribers, and many have no idea it is active. Sweep these up with a blunt proxy rule and you are blocking iPhone owners.
- Privacy-conscious customers. Plenty of people simply run a VPN all the time. They still buy things.
- Travellers. Anyone abroad using a VPN to reach their home region's pricing or catalog.
The expensive mistake
Turning on "block all VPN traffic" as a first move, then wondering why conversion dropped. You will not see the lost orders in any report, because they never happened. Fraud you block is visible; customers you block are invisible.
The three settings, and which to pick
A good VPN tool gives you three options rather than a single on/off switch. Understanding the middle one is the whole point of this post.
| Setting | What happens | Use it when |
|---|---|---|
| Allow through | VPN is not used as a block signal at all | You sell to privacy-focused or technical audiences |
| Challenge | A retryable screen asks them to turn the VPN off and continue | Almost every store. This is the recommended default |
| Block | VPN visitors see your block screen, no route through | You are certain real customers never shop on a VPN |
The challenge option is the one worth understanding properly. A real customer sees a short message, switches their VPN off, and carries on shopping: you keep the order. An automated script, a bot, or someone deliberately hiding their location does not complete that step, because the whole point of their setup is the anonymised connection. It separates the two populations without you having to guess in advance which is which.
How to set it up
Using Cordon, which has the three-way setting described above:
- Install and enable the app embed. The Setup screen opens your theme editor so you can switch on the
Cordon Block & Protectembed and save. Nothing is detected until this is live. - Open Rules, then Block by traffic type. VPN, proxies, Tor exit nodes, datacenter traffic, bots and headless browsers, and scrapers are independent switches, so you can tighten one without the others.
- Set VPN handling to "Ask them to turn off their VPN". Start here rather than at block. You can always tighten later; you cannot recover the orders you lost while being too aggressive.
- Leave the search-engine exemption on. Verified crawlers are confirmed by reverse DNS and pass through regardless of your other rules. Turning this off is how stores accidentally deindex themselves.
- Watch the Logs page for a few days. Every decision shows the country, network, and rule that fired. If you see recognisable customers getting challenged constantly, loosen it.
Tor and datacenter are the easy wins
Unlike VPNs, these two have almost no legitimate shopper population. Tor exit nodes and datacenter networks (AWS, GCP, Alibaba, Tencent, Huawei Cloud) are where scrapers and automated abuse actually originate, so blocking them outright carries far less conversion risk than a blanket VPN block. If you want a low-risk first move, start with those two switches and leave VPN on challenge.
Why live detection matters more than the feature list
Every app in this category claims VPN blocking. The difference that determines whether it works is where the data comes from. VPN and proxy endpoints change constantly: providers add ranges, rotate exits, and residential-proxy networks are built specifically to look like ordinary home connections.
A tool built on a downloaded IP list is stale within weeks, and stale lists fail in both directions at once: they miss new proxy endpoints, and they block addresses that have since been reassigned to real customers. Live commercial detection data is the thing worth paying for. It is also the reason VPN detection sits on a paid tier in most apps, including Cordon, where it starts at the Growth plan while country and IP rules are available free.
Two things to verify in any tool
Does it fail open? This code runs on every page load, so if the vendor's detection service is unreachable, visitors must be let through rather than blocked. Does it allowlist iCloud Private Relay? If not, a proxy rule will silently block a slice of your iPhone customers. Cordon does both by default, but ask before you install anything.
Learn this properly · free lesson
The shape of a theme: where everything lives
App embeds, theme files, and where a storefront script actually runs: worth understanding before you install anything that loads on every page. Free lesson, no signup.
Try this lesson — freeWhere this fits with your other rules
VPN detection is the layer that makes your other rules stick. On its own, country blocking is bypassed by any free VPN, and IP blocking is bypassed by reconnecting. Adding VPN and proxy detection closes both gaps at once, which is why these are sold together rather than separately.
For a fuller merchant-side walkthrough there is a step-by-step VPN blocking guide, plus specific guides on proxy checkout fraud and stopping discount code abuse, which are the two problems that send most merchants looking for this in the first place. If you want the architecture underneath, the four layers you can block Shopify traffic at explains why none of this can be done natively.
Frequently asked questions
Can Shopify detect VPN traffic?
No. Shopify has no setting that detects or blocks VPN, proxy, or Tor traffic, and it does not evaluate whether a visitor's IP is anonymised. It cannot be done with theme code either, because Liquid never receives the visitor's IP address. Detecting anonymised connections requires a third-party app running its own detection service.
Should I block all VPN traffic on my Shopify store?
Usually not. Corporate employees on company VPNs, iCloud Private Relay users who may not know it is on, privacy-conscious shoppers, and travellers are all legitimate customers on anonymised connections. A better default is a challenge: show a retryable screen asking the visitor to turn the VPN off and continue. Real customers do it and still buy; automated abuse does not, because the anonymised connection is the point.
How do I block VPN traffic on Shopify?
Install an app with live VPN detection, enable its theme app embed so it can see visitors, then set the VPN rule. In Cordon this is the Rules page under Block by traffic type, where VPN, proxy, Tor exit, datacenter, bot and scraper detection are independent switches, and VPN handling offers allow, challenge, or block. VPN and residential-proxy detection starts on the Growth plan.
Will blocking VPNs hurt my conversion rate?
It can, and invisibly. Blocked customers never appear in any report, so the loss is hard to attribute, while the fraud you stop is highly visible. That asymmetry makes blanket VPN blocking feel more successful than it is. Use challenge mode instead, and consider blocking Tor exit nodes and datacenter networks outright, since those have almost no legitimate shopper population.
What is the difference between a VPN, a proxy, and Tor?
A VPN routes all of a device's traffic through an intermediary server, and is widely used by ordinary people and companies. A proxy does the same for specific traffic, and residential proxies are deliberately built to look like ordinary home connections, which makes them the tool of choice for abuse. Tor routes traffic through multiple relays for anonymity and arrives from known exit nodes. Tor and datacenter traffic carry the least legitimate-customer risk when blocked; VPNs carry the most.
Why do VPN blockers need a paid plan?
Because the detection data is the product. VPN and proxy endpoints change constantly as providers add ranges and rotate exits, and residential-proxy networks are designed to look like home connections. A downloaded IP list goes stale within weeks and then fails in both directions, missing new endpoints while blocking reassigned addresses belonging to real customers. Live commercial detection data carries an ongoing cost, which is why country and IP rules are often free while VPN detection is not.
Start free
Ready to become a Shopify developer?
You just read how it works. Now write it yourself: real tickets from a live store, in an editor where the storefront updates as you type. Module 1 is free, no card.
Free · No credit card · Your first win in minutes
About the author
Bas Lefeber, Founder, learnshopify.dev
Bas builds learnshopify.dev, where developers learn production-grade Shopify theme development against a live storefront. He writes about Liquid, theme architecture, and the parts of the job that still matter now that AI writes the code.
Keep going in the curriculum
