Install WebDecoy on Shopify

See bot detection evidence and observed AI referrals inside Shopify admin. Install the listed app for your store, enable its storefront embed, and confirm that a labeled test reaches the app before relying on traffic reports.

Add WebDecoy on Shopify → · Watch the setup walkthrough

Before you begin

• Use a Shopify account with permission to install apps and edit the published theme.
• Use the Shopify App Store installation path. You do not need a separate WebDecoy login or a browser snippet from the standalone WebDecoy dashboard.
• If the storefront has a password, be ready to unlock it when running the test.
• Start with observation and staff review. Installing WebDecoy does not automatically cancel orders or block checkout.

1. Install from the Shopify App Store

1. Open the WebDecoy App Store listing.
2. Choose Install, select the intended store if prompted, and review Shopify’s installation and permission screens.
3. Open WebDecoy from Apps in Shopify admin.

Manage the app in that store’s Shopify admin. Available plans and Shopify billing are shown in the app; check the current listing before choosing a paid plan.

2. Enable the storefront embed

1. Open Setup & health in WebDecoy.
2. Under Verify your installation, choose Open theme editor.
3. In App embeds, enable WebDecoy Bot Detection and Save.
4. Return to Setup & health and select Check again.

Check the published theme. Enabling an embed only in a draft theme does not enable it for your live storefront. If the app cannot check the theme, open the editor and verify the saved setting yourself.

3. Receive a labeled test detection

1. In Setup & health → Send a test detection, select Create test.
2. Open Open storefront test. The generated link is valid for ten minutes.
3. If the store is password protected, unlock it and reopen the test link.
4. Return to Setup & health and wait for Test detection received. Storefront collection verified.
5. Choose View test detection to inspect the received record.

The test checks the storefront script, Shopify proxy and detection storage. Test detections are labeled and excluded from traffic metrics, order review and enforcement. This verifies collection; it is not a fraud benchmark, a real shopper session, or proof that every bot will be detected.

4. Inspect traffic and orders

• Detections: inspect the evidence for suspicious activity.
• Flagged Orders: review available session and order evidence before deciding what to do.
• AI Referrals: inspect observed visits carrying AI referral information. A crawler request and a referral visit are different observations; neither proves a citation.
• Setup & health: check when storefront and checkout-pixel events last arrived.

The storefront embed and checkout pixel are separate collection paths. The checkout pixel can be connected while no events have arrived, and customer consent can affect delivery. A browser collection path cannot observe requests that never execute its JavaScript. See detection coverage for the distinction between browser, server and edge observations.

5. Choose your response workflow

In Settings, review Tag suspicious orders. WebDecoy can attach supporting evidence to order risk assessments so staff can investigate. It does not cancel an order or stop checkout on its own.

For staff review workflows, open Automations. The review and notification templates can be imported into Shopify Flow; imported workflows start inactive. Check the trigger, tag and staff email recipient before turning one on. They apply to new high-risk-order events after activation, not previous orders. Any cancellation workflow you build in Flow is your store’s rule and should be reviewed separately.

If nothing arrives

What you see	Next check
Embed is not enabled	Enable WebDecoy Bot Detection in the published theme and save.
Unable to check theme	Open the theme editor to inspect the saved embed state, then choose Check again.
Waiting for a test	Open the generated storefront test link, unlock the store if necessary, and reopen it.
Test expired	Create a fresh test and open its link within ten minutes.
Delivery failed	Retry with a fresh test. If it persists, contact support through the app’s Help page.
Checkout pixel has no events	Check its connection and consent conditions separately from the storefront test.
No recent traffic	Quiet traffic alone does not prove a broken installation. Run a storefront test.

For the product overview and demo, see WebDecoy for Shopify. For a different platform, choose an installation method.