Your Klaviyo bill keeps climbing. Your abandoned cart flow is firing to addresses that bounce. Your sender reputation is sliding and you can feel it, because legitimate customers are reporting that your emails are landing in spam.
That’s what bot-sourced contacts do to a Klaviyo account, and it happens quietly. Klaviyo is trusting Shopify, and Shopify is trusting whatever hit the cart URL. By the time the bot is in your flow, nobody upstream said anything was wrong.
The fix isn’t fancy, but it doesn’t show up in the obvious places either. There’s no toggle in Klaviyo settings called “block bots,” because Klaviyo’s anti-bot tooling is built for form submissions, not for webhook-sourced data coming from your store. So the work happens in three layers, all on the Klaviyo side, and all things you can ship today.
This applies to Omnisend, Mailchimp, and Shopify Email too. The mechanics are the same, the UI is different.
Why Klaviyo doesn’t catch them automatically
When a bot creates an abandoned checkout on your store, Shopify fires a checkouts/create webhook with whatever email the bot dropped into the form. Klaviyo’s Shopify integration ingests that webhook and creates or updates a profile, no questions asked. From Klaviyo’s perspective, this is a real customer who started a real checkout. The abandoned cart flow triggers, the recovery email goes out, the metrics counter ticks.
Klaviyo’s bot detection is real, but it’s built for form-submitted signups (like a popup or footer subscribe), not for what Shopify hands them. The signals Klaviyo would need to flag a bot (no scroll, no engagement, no real session context) live upstream of the webhook. By the time it reaches Klaviyo, the bot looks identical to a customer who hit the checkout in 30 seconds.
So you have to filter inside Klaviyo, manually, with rules you write yourself.
What gets polluted, in order of cost
The damage isn’t abstract. It compounds, and it costs real money.
- Sender reputation. Recovery emails to nonexistent or burner addresses bounce. Mailbox providers track your bounce rate, and once it climbs above the industry norm (most ESPs flag at 2%+), your domain reputation starts to slide. Spam complaint rate from real customers who don’t remember signing up makes it worse. Once you’re landing in spam, climbing back is slow.
- Your bill. Klaviyo, Omnisend, Mailchimp, all of them charge by contact count or active subscriber count. Bot contacts count. If you’re running 50,000 active profiles and 8,000 are bots, you’re paying for 8,000 bots every month.
- Engagement scoring and segmentation. Klaviyo’s predictive scores (RFM, engagement, lifetime value) get diluted by zero-engagement bot profiles. Your “high-value customers” segment gets noisier, your re-engagement flows fire to bots that never cared, and your real cohorts get harder to read.
- Flow analytics lie. If your abandoned cart flow has a 2% conversion rate but 30% of the trigger volume is bots, the real human conversion rate is much higher. You’re making decisions based on the wrong number.
Three filter recipes you can ship today
These are the three signatures that catch the most bot volume with the lowest false-positive risk. Apply them as flow filters first (so you stop the bleeding immediately), then as segment-based suppression filters (so the bot profiles get tagged and excluded from future sends).
Recipe 1: email pattern regex
The most prolific bot families use sequential or formulaic email handles. You’ll see them in your Klaviyo Profiles list if you sort by recently created.
Patterns to match:
mail01@,mail02@,mail03@and similar sequentials- All-numeric handles like
12345678@gmail.com - All-consonant or all-vowel gibberish:
xkrtbzn@,aeiouae@
In Klaviyo, build a flow filter on the abandoned cart trigger using regex match conditions on the Email property:
^(mail|test|user|spam)\d{1,4}@^[0-9]{6,}@^[bcdfghjklmnpqrstvwxyz]{6,}@
If you spot a same-domain burst (30+ handles all on one obscure domain showing up in under an hour), block the domain itself with a tail-match like @spam-domain\.example$ rather than trying to enumerate the handles.
Each store sees different patterns, so check your own Profiles list and adjust the regex to your local bot signature before turning it on. Don’t copy generic patterns blindly.
Recipe 2: address signature
Bots that go past the email step often dump generic or impossible address data. Common signatures:
- Street like “street 10 apt 2”, “123 Main”, “Test Address”
- City missing entirely, or set literally to “City”
- ZIP that doesn’t match country (US ZIP code with a non-US country code)
- Country set to a high-bot-volume origin while the IP suggests elsewhere (you’d need GeoIP enrichment for that one)
Filter on $shipping_address.address1 contains "street 10" or whatever signature is showing up in your own data. This catches the more committed bots that the email regex misses.
Recipe 3: behavior profile
The cleanest filter is behavior, because real customers don’t behave the way bots behave. Build a Klaviyo segment for “likely bot” with conditions like:
- Profile created less than 24 hours ago
- Started checkout
- Zero email opens, ever
- Zero clicks, ever
- No browse activity recorded (if you have the Klaviyo JS snippet installed)
That segment becomes the suppression target. Add it as a recipient filter on your abandoned cart flow: “Send to Started Checkout, AND NOT in Likely Bot segment.”
The behavior filter has the lowest false-positive risk because real customers eventually open something. Run it with a 24 to 48-hour lag between checkout and send, and you’ll catch nearly all bots without dropping real recovery messages.
What this fixes and what it doesn’t
These filters keep your Klaviyo account clean. They protect your sender reputation, they shrink your bill, they un-pollute your segments and engagement scores. That’s real and you’ll see it in 2-4 weeks of running.
What they don’t do is stop the bots from hitting your store in the first place. The bot still loads your product pages, fires your Meta pixel, creates a Shopify customer record, and shows up in your abandoned checkouts list. Klaviyo cleanup is downstream cleanup. The pollution is contained to one tool, but the source is still flowing.
If you want to stop the source, you’re choosing between two categories of tools. Edge-layer blocking (Cloudflare WAF or similar) reroutes your DNS through a third-party proxy and blocks bots before they reach Shopify. The theory is clean, the practice is fragile, and DNS misconfigurations can break legitimate customer traffic during sales. Shopify checkout-layer blocking keeps your DNS clean and stops bots at the session layer inside Shopify, before any webhook fires, before any pixel event, before any Klaviyo profile is created. Your downstream tools never see the bot at all.
FAQ
Will these filters block real customers?
The behavior filter has the lowest false-positive risk because it requires zero opens AND zero clicks AND profile age under 24 hours AND no browse activity. A real customer who’s checking out in 30 seconds without any prior engagement is rare, but it does happen. Run the filter with a 48-hour lag between checkout and send, so real customers who do open or click within that window get rescued.
What about Omnisend, Mailchimp, and Shopify Email?
Same mechanics, different UI. Omnisend has segment-based recipient filters and regex-capable conditions. Mailchimp’s audience cleanup tools handle some of this, but you’ll still want regex-based exclusions on your abandoned cart automation. Shopify Email has fewer filter options, so you’ll lean more on the customer-list cleanup approach (delete bot profiles in admin) than on flow filters.
Do I need to delete existing bot contacts or just filter going forward?
Both. Filters stop new bots from hitting your sender reputation. Deleting or suppressing existing bot profiles shrinks your bill and cleans your segments. Don’t delete one-by-one in the UI, that’s a nightmare. Export the Likely Bot segment, then bulk-suppress via Klaviyo’s CSV import, or use the Profiles API to remove them programmatically.
Where Doorman fits
Doorman is a Shopify checkout-layer bot blocker. It blocks bot checkouts inside Shopify’s own checkout and keeps your pixel, ESP, and customer list cleaner, without DNS changes. The Klaviyo filters in this post are the right manual move right now. Doorman sets the same kind of suppression flag automatically at the checkout layer, so you’re not maintaining it by hand — the bot’s abandoned checkout still exists in Shopify, but your flow stops emailing it.
If you want to try it, the founding cohort is open, no credit card… doormanapp.com.
For the related read on what Shopify’s own filter does (and doesn’t): What Shopify’s human or bot session filter actually does.