5.2%. 0.09%. 20 of 4,471. Those are the three numbers in this post. The twist is the second one: the bots on a Shopify store are not coming from China.
Picture Shopify's Live View last November. The globe lit up over China, more visitors than the store had ever had, and no orders. That month r/shopify carried 17 threads about it, more than any other. Then on 21 September 2026 Shopify started filtering identified bots out of its reports by default, Live View included.source The globe went quiet. Conversion rates went up. Nothing about the customers changed.
Harvv is a pixel that sorts real visitors from automated ones and keeps both. Shopify now hides bots so the total looks right. Clarity and Fullstory record people so you can watch them. Harvv turns behaviour into data an AI can read, so you can ask it how many of last week's visitors were real, and where the rest came from.
How much, measured
On the median store in the sample, 5.2% of sessions were bots. The quietest store was at 1.5%. The loudest was at 29.8%: three in ten sessions for nine straight days. Bot traffic is not a steady tax on every store. It is one store having a bad week.
Where they come from
58% of bot sessions came from US addresses (7,284 of 12,598). China sent 135 sessions in total. Here is what the bots looked like.
| What we saw | How we know | Bot sessions |
|---|---|---|
| A proxy with the wrong clock | A small desktop window, no referrer, and a New York clock on a connection from another country. | 3,536 |
| A 400 by 400 window | One automated browser with a window exactly 400 by 400 pixels, no referrer and a Los Angeles clock. | 2,640 |
| Meta's own network | Visits from Facebook's address block. Every store in the sample got them. | 2,087 |
| Cloud servers | Addresses that belong to a hosting company, not a home or a phone. Paid clicks are not counted here. | 2,034 |
| Crowds that never move | Fifty or more one-time visitors landing on the same page, nearly all of them never scrolling or tapping. | 1,793 |
| AI assistants | ChatGPT, Claude or Perplexity reading a page for someone. | 259 |
| Automation flags | A browser that says it is being driven by a script. | 249 |
The Meta row matters if you run Facebook ads: some of those "visits" are Meta's own systems loading your page, not a shopper.
What they do
Almost nothing. Bots were 20 of 4,471 sessions that reached the cart or checkout, and 2 of 1,978 sessions with a purchase. They do not empty your stock. They empty your averages: on the median store, counting bots made the conversion rate read 6% low. On the hardest-hit store it read 30% low.
What Shopify changed
Between 21 and 23 September 2026 Shopify changed three things at once: identified bots are filtered out of session reports by default, sessions no longer end at midnight UTC, and some sessions without a page view now count.source Shopify calls its bot rules conservative, "better to miss some bots than incorrectly label real customers as bots".source On one store where we compared the same nine days, Shopify counted 7,018 sessions and Harvv counted 6,947 human ones, within 1%. On that store the two filters agree. Shopify's just does not tell you what it removed.
The pattern
Every store has a bot share. On most it is a few percent and steady. On one store in the sample it was three in ten sessions, and the report that would have shown it now hides it by design. The totals are right. The story is gone.
Do you know which week your store got hit?
Questions people search
How to stop bot traffic on Shopify?
Mostly you do not have to. Shopify puts Cloudflare in front of every store and turns on hCaptcha for forms by default; checkout bot protection is a Shopify Plus feature. Since 21 September 2026 Shopify also filters identified bots out of its reports. The bots left in our sample reached the cart in 20 of 4,471 cart sessions, so the cost is in your numbers, not your stock.
Why is my website getting traffic from China?
In our sample China was 135 of 153,128 sessions, under 0.1%. Posts about China traffic on r/shopify peaked in November 2025, before Shopify filtered identified bots out of Live View by default. If you still see a wave, check whether those sessions ever reach your cart.
Is bot traffic bad for your website?
For the store, rarely: bots were 2 of 1,978 sessions with a purchase. For your numbers, yes: on the median store, counting them made the conversion rate read 6% low, and on the hardest-hit store 30% low.
Why did my Shopify conversion rate change in September 2026?
Shopify changed how it measures sessions between 21 and 23 September 2026. Identified bots are filtered out by default, sessions no longer end at midnight UTC, and some sessions without a page view now count. Fewer bot sessions with the same orders means a higher conversion rate. Shopify says to treat it as a new baseline.
Method: sessions that ran the Harvv pixel on a sample of Shopify stores, 29 September to 7 October 2026, after our last bot-rule change on 28 September; staff, test and demo traffic excluded. Crawlers that announce themselves (Googlebot and the like) are dropped before they are counted, so these are the bots that behave like browsers. Per-store figures cover stores with at least 1,000 sessions in the window. Countries are the visitor's IP country. Shopify's changes are quoted from its help pages, read on 8 October 2026.source Related: what is a rage click, why people add to cart and do not buy.