Bot & fraud shield for Shopify stores
Brickmoat cleans the bot accounts out of your customer list, checks every new signup and order within seconds, turns away unwanted visitors by country, IP or network, and enforces your blocklist at checkout. It holds; you decide. It never cancels a real order on its own.
Four jobs, one app. Each walkthrough below plays what Brickmoat does, step by step, using sample data.
One scan reads your whole customer list and shows each likely bot with its reasons. A backup is saved before anything is deleted.
Install, press scan, and see every likely bot account with its reasons: throwaway emails, gibberish names, signup waves. Back them up and delete in bulk.
For the first week Brickmoat scores everything and changes nothing, so you can see exactly what it would do with your real traffic.
Turn it on. Bot signups get tagged and unsubscribed, risky orders get held with a risk note on the order page, your visitor rules and checkout blocklist go live, and your decisions train the wall.
Brickmoat does the work of a customer-list cleaner, a fraud filter and a country and IP blocker, in one install and on one bill.
Instead of a customer-list cleaner
A full scan of your customer list, with a score and the reasons for every account it flags.
Instead of a fraud filter
Every new signup and order is checked the moment Shopify records it, even when a bot skips your storefront.
Instead of a country and IP blocker
Block, redirect or allow storefront visitors through a theme app embed, and refuse blocklisted buyers at checkout.
Everything below is in the app today. The label shows which plan it needs.
All plans
Block a country list, exact IPs, IPv4 and IPv6 CIDR blocks, or start–end IP ranges. Free holds 10 rules, Starter 100, Pro has no limit. Allow entries always win over blocks.
Pro
Match by state or region, city, ISP name, network (ASN), user-agent text, referrer, or page, product and collection path. Each rule has its own outcome: block, redirect to its own URL, or allow. Country rules can also run allow-only.
VPN on Starter, Tor on Pro
One switch for VPN, proxy and hosting networks, a separate one for Tor. Turn on the one you mean without the other.
All plans
Google, Bing, Meta, Apple, Pinterest, LinkedIn and other search and social crawlers are let through. They are verified by network (ASN or forward-confirmed reverse DNS), not by user agent alone, so a fake “Googlebot” gets no free pass.
All plans
A rolling 30-day log (90 days on Plus) of visitor decisions with filters, overview numbers and CSV export. The full IP is stored only for visitors who were stopped; allowed visitors are kept with a truncated IP.
Starter and up
Blocked emails, email domains, phone numbers and addresses (and countries, if you choose) are refused at checkout by a Shopify validation Function, with an error message you write. The lists sync from your Rules page on their own.
Pro
Refuse an order by the buyer’s name or by the order subtotal: a name that keeps coming back on fake orders, tiny card-testing orders, or totals far above anything you sell. Each condition can show its own message, and your allowlist still wins.
Pro
Connect Klaviyo with an API key. Catches are recorded on the profile so you can segment on them, and bot signups can be suppressed so they never receive a campaign. Marking a catch Real lifts the suppression.
Starter and up
A honeypot and timing check on signup and newsletter forms, with an optional Cloudflare Turnstile human check.
Pro
Run visitor rules only inside a daily time window, give staff a bypass password, and write your own wall message (the message is on every plan). Soft content protection discourages right-click and text selection.
Pro for automation
Filter flagged orders and signups and export them as CSV. On Pro: opt-in auto-delete and auto-cancel, an opt-in auto-block of the order IP after an auto-cancel (labelled “Auto” so you can undo it), Shopify Flow triggers, Klaviyo, and one signed webhook (HMAC-SHA256) that tools like Zapier, Make and Slack can receive.
Nothing to host, no second login, no code pasted into your theme. Brickmoat plugs into five places Shopify provides for apps, and each one does a specific job.
Visitor rules and the form shield load with your theme. No theme code is edited.
Your blocklist is checked inside Shopify’s own checkout before the order is placed.
Shopify tells Brickmoat the moment one is recorded, and it is scored in seconds.
Review, rules and the visitor log open inside your Shopify admin. No extra login.
Blocks and catches can start a Flow or post to the tools you already use.
Brickmoat is an independent app made by a Shopify Partner. The names above describe the Shopify platform features it uses. Shopify is a trademark of Shopify Inc.
Better to read this here than to find out after you install.
Nothing does. Bots that post straight to Shopify’s endpoints never load your storefront, so the storefront shield cannot see them. Brickmoat catches those through webhook scoring: tagged, unsubscribed or held seconds after they appear, not before.
Checkout enforcement is a Shopify Function and nothing else. It checks email, domain, phone, address and optionally country against your blocklist. It cannot see a buyer’s IP address, so IP, VPN and Tor rules apply on the storefront, not inside checkout.
It discourages right-click and text selection. It is not DRM, and someone determined can still copy your content.
Location, VPN and network data come from an IP intelligence service. Some VPNs are missed and some real shoppers on shared networks look risky, which is why your first week runs in watch mode.
Card testing happens inside Shopify’s payment flow. Brickmoat cuts it down by stopping bots and holding repeat attempts, but it cannot see declined payments.
Geo rules are for traffic and fraud control. Brickmoat is not a sanctions-screening, age-verification or regulatory-compliance product, and what you block is your decision.
Single-purpose apps are cheap, and most stores end up running three of them. Here is what each kind covers.
| What you get | A country blocker | A fraud filter | Brickmoat |
|---|---|---|---|
| Block countries and IPs | Yes; free tiers often allow 2 to 4 rules | Yes; free tiers often allow 2 to 4 rules | Free, up to 10 rules |
| Search and social crawlers verified, not trusted by name | Rarely stated | Rarely stated | Every plan |
| Visitor log with reasons | Often capped by visit count | Often capped by visitor count | Every plan, no visitor cap |
| Clean bot accounts out of the customer list | No | No | Free scan, 100 deletes |
| Score new signups and orders, with reasons | No | Orders only, usually | Free, 50 checks a month |
| Hold a risky order instead of cancelling it | No | Varies | Starter |
| Refuse blocklisted buyers at checkout | Some do | Higher tiers, usually | Starter |
| Block VPN, proxy and hosting networks | Paid plans | Paid plans | Starter |
| Tor switch, region, network, referrer and page rules | Fewer rule types | Spread across tiers | Pro |
| Support around the clock, with tickets inside the app | Varies | Some offer live chat | Every plan |
| Klaviyo, Shopify Flow and a signed webhook | No | Top tier, usually | Pro |
| Watch mode: see what would happen before it does | Rare | Rare | Every plan |
The first two columns describe typical single-purpose apps, not any one product; check the listing of the app you are comparing. The Brickmoat column is what the app does today.
Billed through Shopify. Paid plans include a 14-day free trial. Pay yearly and two months are free. Every plan includes support 24 hours a day, 7 days a week. Cancel anytime.
Free
See what has been hiding in your customer list.
$6.99 / month
Every signup and order checked, risky ones held for you.
$14.99 / month
Full automation and every visitor rule, with no limits.
$29.99 / month
Everything in Pro, a longer record and support that answers first.
Brickmoat is a Shopify app that protects a store from bots and fraud. It scores every new signup and order and shows its reasons, holds risky orders for review, scans the customer list and deletes bot accounts, blocks storefront visitors by country, IP address, VPN or Tor, and enforces a blocklist at checkout through a Shopify Function.
Brickmoat has a Free plan. Starter is $6.99 a month, Pro is $14.99 a month, Plus is $29.99 a month, in US dollars, billed through Shopify. Paid plans start with a 14-day free trial, and paying yearly charges 10 months for 12.
Not on its own. Risky orders are held, never cancelled, until you decide. Auto-cancel exists on Pro, is off by default, and you can undo a hold with one click. Your first week runs in watch mode, where nothing changes at all.
The storefront piece is one small script, and every check fails open: if Brickmoat is unreachable, visitors browse and buy as normal. The scoring itself runs on our servers after Shopify records the signup or order, not in your shoppers' way.
The minimum for the job: risk verdicts with their reasons, short-lived pattern data (emails, IPs, phones) and the storefront visitor log, both deleted after 30 days (the Plus plan keeps the visitor log for 90). The visitor log keeps a full IP only for visitors who were stopped. Access tokens are encrypted, and the GDPR webhooks (data request, customer redact, shop redact) are implemented. The privacy policy lists every field.
No. Search and social crawlers such as Google, Bing, Meta, Apple, Pinterest and LinkedIn pass visitor rules unless you switch that off. Brickmoat checks that the visitor really comes from that company’s network before trusting it, so a scraper that only copies Googlebot’s user agent is treated like any other visitor.
On Starter and up, yes, through a Shopify validation Function: blocklisted emails, domains, phone numbers and addresses (and countries, if you turn that on) are refused with a message you write. No script runs in checkout, and the Function cannot see IP addresses, so IP and VPN rules stay on the storefront.
On Pro. Brickmoat sends Shopify Flow triggers when a visitor is blocked, an order or signup is flagged, or you mark a catch fake or real. The same events can go to one webhook URL, signed with HMAC-SHA256, which Zapier, Make and Slack workflows can receive. Klaviyo connects directly with an API key.
No. Blocking up to 10 countries or IPs is on the Free plan, with the visitor log and verified crawlers included, and you can ignore the rest. If bots or fake orders show up later, the scoring is already installed.
Support is open 24 hours a day, 7 days a week. Open a ticket from the Support page inside the app and a person answers within 24 hours; Plus tickets are answered first, within 12 hours. The Help page has setup guides and quick fixes, and you can email us if you prefer.
No. Chargeback guarantees are sold by fraud insurers that take a percentage of your sales. Brickmoat is prevention at a flat monthly price: it stops what it can before the order ships and shows you why.
No. Brickmoat works on every Shopify plan.
That message appears on the public install link before Shopify App Store approval. Merchants install from the listing once it is live. For development-store testing, open Shopify Partners / Dev Dashboard → Apps → Brickmoat → Test your app / Select store, and install on a development store in the same Partner account.
Many bots post straight to Shopify and skip every storefront defense, which is why captchas alone keep failing. Brickmoat cannot stop those at the door either. It hears about every new customer and order directly from Shopify, so they are scored and handled seconds after they appear.