Spam bots aren't new to the digital marketing world. But over the past few months there's been an unprecedented rise in spam bot attacks, and if they aren't managed properly they can damage both your website and your deliverability.
So what are these bots, why do the attacks happen, and what can you do to limit the damage they leave behind? We've laid out everything you need to know below, so you can stay savvy if bots decide to target your website.
What are spam bot attacks?
These attacks happen when a scammer sends bots to your website to verify stolen credit card details. They usually try to place orders for small-value products, which makes businesses with lower-value or heavily discounted items the typical target.
For business owners, this often means fraudulent orders going out, sometimes needing refunds once a dispute is lodged. It also floods your Klaviyo account with invalid emails, pushing up your bounce rate and harming deliverability and account health if it isn't dealt with quickly.
How to tell if an order is fraudulent
Shopify Plus includes more advanced bot protection that can catch suspicious activity before checkout, and without a Plus plan some apps can do a similar job. Either way, it pays to review orders carefully when something feels off. Here's what to watch for:
Fake email address
Addresses that look random or are obviously falsified are a common giveaway.
Repeated CVV attempts
Shopify may flag an order based on how many times a CVV was submitted.
Look-alike carts
Similar abandoned carts appearing close together can reveal a pattern.
One product, repeatedly
The same product added to cart again and again is a classic attack sign.
What to do if you suspect an attack
Bots move much faster than we can, so you can't always get ahead of them. If you suspect an attack, work through this plan to soften the blow, especially on your deliverability.
Enable bot protection
Either through Shopify Plus or a trusted Shopify app (check the reviews and verify the provider). This cuts the number of bots reaching your site, and a CAPTCHA before checkout helps stop them slipping through.
Temporarily hide target products
If one product is being singled out and your business can cope without it for a while, hide it until the attack subsides. It won't guarantee the attack won't return, so stay alert.
Isolate the product from your abandonment flows
If invalid emails keep flowing through your abandonment flows, deliverability can drop sharply during a large attack. A split that excludes those products for a short period may mean a few real customers miss out, but it protects your inbox placement long term.
Segment your potential bots
You may spot trends: shared email domains, the same products, or attacks at certain times of day. Building segments around those patterns lets you quickly suppress deliverability-threatening bots and keep your database healthy.
Let's protect your database from spam bots.
If bots are affecting the quality of your email marketing database, our team is more than happy to help you.
Book a free 15-minute consult
