Is your conversion rate even real? The bot problem

Before you redesign anything, check whether a big share of your visitors are bots.

It sounds like a strange place to start. But it's a common story: an owner looks at thousands of sessions, a handful of orders and a conversion rate well under 1%, and decides the store must be broken. Sometimes it is. Often, a chunk of those sessions were never people in the first place.

Bots visit, load a page and leave. They never buy, but they can still be counted as sessions, and every one of them pulls your conversion rate down. So the first job isn't fixing the store. It's finding out what your real number is. Here's how we do it: spot the signs, filter the bots out, then measure again.

Warning signs your traffic isn't human

You don't need special tools to get suspicious. These are the patterns owners describe again and again in the Shopify Community, and the ones we look for first:

• A sudden spike with no cause. Sessions jump overnight, but you didn't launch a campaign, get press or post anything new.
• Visits from places you don't sell to. Singapore and China come up most in owner reports. If you only ship to the US and a third of your sessions come from another continent, that's a clue.
• Visits that land and leave. A bounce rate close to 100% for one location or one day, with sessions lasting under a second.
• Hundreds of visits to the same page at once. Real shoppers spread out. Crawlers often hit one product or collection page over and over, or work through every page in order.
• Odd abandoned checkouts. A run of checkouts with fake-looking names or junk email addresses. Shopify's own help pages say it leaves suspected bot and card-testing checkouts off the abandoned checkouts list, but some can still get through.

To check, go to Analytics → Reports and open Sessions by location. Look at where your sessions come from over the last 30 days, and compare that with where your orders come from. A country with lots of sessions and zero orders is worth a closer look.

One sign on its own proves nothing. A spike might be a TikTok video doing well. Two or three signs together, from a place you don't ship to, usually mean bots.

How to filter bot traffic out of your reports

Shopify added a filter for this in October 2025. It lives inside each report, not on the reports list, so it's easy to miss.

1. Go to Analytics → Reports.
2. Open Conversion rate breakdown (any sessions report works, but this one is the most useful).
3. If the panel on the right is hidden, click Controls at the top right.
4. Under Filters, click + and choose Human or bot session.
5. Set it to Human.

Now look at your sessions and conversion rate again.

A few things to know about this filter:

• It isn't applied for you. Shopify says that since 21 September 2026 its default sessions view focuses on human visitors where it can. But the filter itself isn't switched on when you open a report, so add it and you know exactly what you're looking at. If the numbers change when you add it, bots were in your default view.
• It doesn't carry over everywhere. Owners report that the filter can't be applied to the Home dashboard, and that a filtered report is saved per user. If your team checks numbers on the Home screen, they're looking at a different figure from yours. Save the filtered report and agree that it's the one everyone uses.
• It cleans your reports, not your store. Bots still visit. The filter only stops them from skewing the numbers you make decisions with.

What about blocking them?

This is where owners get frustrated. Shopify runs your storefront on its own infrastructure, so you can't block countries or IP ranges the way you might on a self-hosted site. Owners in the Community report that country-blocking apps don't stop these sessions from being recorded. Our view: don't pay for an app that promises to fix this until you've seen proof it works on Shopify.

What you can check is your spam protection. Go to Online Store → Preferences and scroll to Spam protection. Shopify uses hCaptcha on contact forms, newsletter sign-ups, comments and account pages, and it's on by default. Make sure nobody has switched it off. It won't stop bots from browsing, but it stops them filling your inbox and your customer list with junk.

A second opinion helps too. If you use Google Analytics 4, Google says traffic from known bots and spiders is excluded automatically. If Shopify says 20,000 sessions and Google Analytics says 9,000 for the same dates, that gap is a rough sense of how much automated traffic you're getting. The two tools count sessions differently, so treat it as a clue, not a measurement.

Re-measure: your real conversion rate

With the human filter on, you get a new set of numbers. Read them carefully, because they can go either way.

If your conversion rate goes up a lot, good news: your store was doing better than you thought. Bots made it look broken. Before you spend money on a redesign, look again at what the real numbers say. You may only need small fixes, or none.

If it barely moves, bots weren't your problem. Your visitors are real, and they aren't buying. That's useful to know too, because now you can look at the store itself with confidence that the data is true.

Either way, this is the moment to look at where people drop out. The Conversion rate breakdown report shows a funnel: sessions, added to cart, reached checkout, completed checkout. With bots filtered out, the biggest drop tells you what to fix:

• Few people add to cart: look at the product page.
• They add to cart but don't reach checkout: something in the cart puts them off, often a cost they didn't expect.
• They reach checkout but don't finish: look at payment options, delivery times and anything that makes paying feel risky.

Compare like with like

One more trap. Shopify changed how sessions are measured from 21 September 2026. Its changelog says sessions, conversion rate, add-to-cart rate, bounce rate and other session-based numbers may look different after that date, even if nothing about your customers changed. Orders and sales aren't affected.

So if your conversion rate jumped in late September, check the date before you celebrate or panic. Shopify's own advice is to treat it as a new baseline. When you compare periods, keep both after 21 September 2026, and use the human filter on both.

Why this matters before you spend money

Bad data leads to expensive decisions. It's easy to plan a full redesign, a new theme or a bigger ad budget based on a conversion rate that had bots baked into it. If the real number is fine, the redesign was never needed. If the real number is poor, at least you now know where to look.

It also changes how you judge any work you pay for. If an agency, freelancer or app promises to lift your conversion rate, ask which number they'll measure against. If it's the unfiltered one, a change in bot traffic can make any result look better or worse than it really was.

What to do next

1. Look for the warning signs: spikes, locations you don't ship to, near-100% bounce, junk checkouts.
2. Open Conversion rate breakdown, add the Human or bot session filter set to Human, and save it as the report your team uses.
3. Check Online Store → Preferences → Spam protection is still on.
4. Re-read your funnel with bots removed and find the biggest drop.
5. Only compare periods that both fall after 21 September 2026.

Do this before you redesign anything. And if the clean numbers still don't make sense, send us your store link and we'll tell you the first thing we'd fix.