You opened your Shopify admin this morning and the abandoned cart number looked wrong. Way wrong. Last month you sat around 65-70% (high but normal for ecommerce), and this week you’re seeing 88%, 92%, sometimes worse. The conversion rate chart looks like it fell off a cliff.
You did the obvious search. Every blog post tells you the same things. Fix your shipping costs. Reduce checkout steps. Add trust badges. Send a recovery email. Maybe offer a discount. None of it explains why your rate doubled in a week, because none of it changed in a week. Your shipping is the same. Your checkout is the same. Your prices are the same.
The thing nobody talks about: if your abandoned cart rate spiked overnight, the cause is probably not your store. It’s bots hitting your store, generating fake checkouts, and dragging the metric down. That’s a different problem with a different fix, and the rest of this post is about how to tell.
Why the generic advice doesn’t fit your situation
The standard abandoned cart advice (shipping, friction, trust signals, recovery emails) is calibrated for stores where the rate is gradually high. A 70% rate that’s been 70% for six months is probably a checkout-friction problem. There are real wins from optimizing shipping or reducing form fields.
But that advice was written before the 2025-2026 wave of bot traffic. It assumes the cart was abandoned by a human who got cold feet. If 30%, 50%, or 80% of your “abandoned” carts were never started by a human in the first place, no checkout tweak in the world is going to recover them. You’re trying to fix a leak in a pool that’s actually being filled by a hose at the other end.
This is the part the SEO playbook misses. Ranking-chasing posts about abandoned cart optimization don’t mention bots, because the keyword volume is in the generic advice, and the generic advice is what gets clicks. You only find the bot angle when you go deeper than the first page of Google.
The bot-traffic angle
When a bot hits your store, the most common path is direct cart URL abuse. The bot posts to /cart/<variant_id>:<quantity> without ever loading the product page or your homepage. Shopify dutifully creates a cart, the bot fills out checkout fields with garbage data, and then walks away. Your store records a “started checkout, did not complete.” That’s an abandoned cart.
Multiply by hundreds or thousands of bots per day, and your abandoned cart rate doesn’t just creep up. It spikes. The denominator (sessions that started checkout) inflates with bot sessions, the numerator (sessions that completed) stays the same because bots don’t buy. The rate climbs even though nothing about your real customer behavior changed.
Other patterns drive the same effect:
- Card testing bots that run stolen cards through your checkout, fail, and never come back
- Sequential email bots (
mail01@,mail02@,mail03@) generating burner profiles for downstream phishing - Address-pollution bots that drop “street 10 apt 2” or “Test Address” into the shipping form
All of them inflate the abandoned-checkout count without ever generating a real order.
A five-minute diagnostic
Before you spend a weekend “optimizing” your checkout, take five minutes and check whether bots are the actual cause. Open Shopify admin and look at three things.
1. Your abandoned checkouts list. Sort by date, look at the last 50. How many have:
- An email like
mail01@,xkrtbzn@, or12345678@gmail.com - A name like “John Doe”, “Test Test”, or repeating-character gibberish
- An address like “street 10 apt 2”, “123 Main”, or a city set literally to “City”
- A country that doesn’t match the IP (you’ll need a Shopify Flow with GeoIP for this, or just spot-check obvious mismatches)
If even 5 of the last 50 look like that, you have bot traffic. If 20+ do, bots are your primary abandoned-cart source, not real customers.
2. Your sessions report. Look at sessions over the last 30 days, segmented by source. Direct traffic that adds to cart at a much higher rate than your other channels is suspicious. Real direct traffic (people who typed your URL) generally browses before adding. Bots skip browsing.
3. Your conversion rate over time. If the abandoned cart rate climbed gradually over months, that’s probably a real checkout-friction issue. If it doubled in a week, that’s a traffic-source change, and bot waves are the most common cause in 2026.
Five minutes in and you’ll know which problem you have.
If it’s bots
The fix is different from the generic abandoned cart playbook. You don’t optimize checkout, because the bots will fail at checkout regardless and your real customers were already converting fine. You filter and you block.
Filter your reports first. Shopify shipped a “Human or bot session” filter in October 2025 that cleans up your Shopify-native reports. Toggle it on and your dashboards will show a more honest view. It doesn’t stop the bots from hitting your store, doesn’t clean your Klaviyo, and doesn’t unpoison your Meta pixel, but it gives you a real conversion rate to look at.
Clean Klaviyo (and any other ESP). Bot-sourced abandoned checkouts trigger your recovery flow, send to bounce-prone addresses, and tank your sender reputation. Three filter recipes (regex on email pattern, address signature match, behavior-based segment exclusion) catch most of it. We wrote those up in detail at How to filter bot abandoned carts out of Klaviyo.
Then decide on a block. This is where the playbook splits. You can route DNS through an edge proxy like Cloudflare WAF and block at the edge. Theory’s clean, practice is fragile, and DNS misconfigurations during sales are the kind of mistake that ends careers. Or you can block at the Shopify checkout layer, which keeps your DNS exactly where Shopify wants it and stops bots inside the session before any webhook fires, any pixel event records, or any abandoned checkout gets created. That’s the category Doorman lives in.
If it’s not bots
If the diagnostic shows mostly real-looking abandoned checkouts (real-seeming names, plausible addresses, varied browser sources), then the standard advice applies. Top causes for genuine abandonment, ranked by typical impact:
- Surprise shipping costs at the final step. This is still the #1 cause of real human abandonment in 2026. If your shipping shows for the first time on the checkout page, expect drop-off.
- Required account creation. Guest checkout converts 20-30% better for first-time buyers. If you’re forcing account creation, that’s where to start.
- Limited payment options. No Shop Pay, no Apple Pay, no PayPal? You’re filtering out a real chunk of buyers who have one default and won’t bother to enter card details.
- Slow checkout. Anything over 3 seconds to load each step bleeds conversions on mobile especially.
- Trust signals missing. Returns policy, contact info, security badges. Cheap to add, real impact on first-time buyers.
A recovery email flow is worth running regardless. Real abandoners often come back with a nudge. Just make sure the recovery emails aren’t going to bot-sourced addresses, because those are the ones tanking your sender reputation while you’re not looking.
FAQ
What’s a normal abandoned cart rate on Shopify?
The Baymard average across ecommerce is around 70%. Anything in the 60-75% range is normal-ish. Anything above 80% on a stable store is worth investigating. If it spiked above 80% recently, bots are the most likely cause.
How do I know my abandoned cart rate isn’t just seasonal?
Compare the same week year-over-year. Real seasonality shows up as a 5-15% relative shift, not a doubling. A doubling in a week is a traffic-mix change, and bot waves are the dominant cause of that pattern in 2026.
Will fixing this actually recover sales?
If your abandoned cart rate was inflated by bots, fixing the bot problem won’t recover any sales (the bots were never going to buy). What it will recover is your ability to read your own metrics, your sender reputation in Klaviyo, your pixel data quality, and your team’s confidence that conversion-rate decisions are based on real signal.
Does Shopify Plus have built-in bot protection?
Shopify Plus has Bot Protection that handles checkout-stage attacks (mostly card testing). It’s not a general bot blocker for cart abuse, customer account creation bots, or analytics pollution. If you’re on Plus and still seeing abandoned checkout spikes, the Plus tooling isn’t covering this category.
Where Doorman fits
Doorman is a Shopify checkout-layer bot blocker. It blocks bot checkouts inside Shopify’s own checkout and keeps your pixel, ESP, and customer list cleaner, without DNS changes. If your abandoned cart rate is being dragged down by bots, Doorman blocks the fraud orders and flags the fakes so your Klaviyo recovery flow skips them — it won’t erase the abandoned-checkout records Shopify creates, but it stops you emailing them.
If you want to try it, the founding cohort is open, no credit card… doormanapp.com.
For the related read on what Shopify’s own filter does (and doesn’t): What Shopify’s human or bot session filter actually does.