Install WebDecoy on SHOPLINE

SHOPLINE has no WebDecoy app. You install the same browser detection script that works on any website, using SHOPLINE’s free Custom Code app, and you can add a hidden decoy link the same way.

Applies to

SHOPLINE stores managed from the admin described in SHOPLINE’s global help center (SHOPLINE: Custom Code guide). SHOPLINE also runs regional admins. If your admin has no Custom Code app under Apps, we have not confirmed where custom code goes in it; ask SHOPLINE support where to add a site-wide script, and paste the WebDecoy line there.

Before you begin

• The Custom Code app. It is free in the SHOPLINE App Store. SHOPLINE’s guide does not state a plan requirement, and we could not confirm whether any plan or region excludes it. SHOPLINE notes that “not every app or app feature is available to every SHOPLINE store”, depending on factors such as your plan and region (SHOPLINE: Getting started with apps).
• A WebDecoy account with this site added. Create a free account and add the store using the address your shoppers visit (for example https://www.example.com).

1. Copy your site’s line from WebDecoy

In the WebDecoy dashboard setup checklist, open Install the detection script and choose Copy. If the checklist is closed, open Detection Scripts for the selected site and choose Copy snippet. The line looks like this, with your own IDs:

<script
  async
  src="https://cdn.webdecoy.com/bot-detection/v1/bot-detection.min.js"
  data-aid="your-property-uuid"
  data-sid="your-scanner-uuid">
</script>

Always paste the copied line. data-aid is the site (property) ID and data-sid is the detection script ID; a hand-built line with the wrong ID can load fine and file its reports somewhere you are not looking.

2. Add it with the Custom Code app

1. In your SHOPLINE admin, go to Apps, then Custom Code. Install the app if it is not installed yet.
2. Choose Add code.
3. Code name: WebDecoy.
4. Page trigger: select every page template you want covered. Select all of them for full coverage.
5. Code content: paste the WebDecoy line.
6. Display options: Desktop and mobile.
7. Insert position: Bottom. SHOPLINE recommends Bottom for third-party scripts such as analytics tools, because Top can delay the first page load. The WebDecoy script loads async and does not need to run before your content.
8. Choose Add. The code takes effect immediately and is enabled by default.

SHOPLINE notes that custom codes apply to both published and unpublished themes, so switching themes does not remove the script.

3. Add a hidden decoy link (optional)

A decoy link is a URL that people never see and link-following crawlers do. When a client requests it, WebDecoy’s decoy server records the hit, whether or not that client runs JavaScript.

1. In WebDecoy, open Decoys, choose Create Decoy, keep Honeypot Link and the shared domain, and set the action to Log while you test.
2. From the decoy’s menu, choose Copy URL.
3. In the Custom Code app, add a second code named WebDecoy decoy link with the same page templates, Desktop and mobile, and Bottom, and paste this line as its content, using your decoy URL:

<a href="https://abc12345.d.webdecoy.com/admin/backup.zip" style="display:none" aria-hidden="true" tabindex="-1" rel="nofollow">Admin</a>

To prove the decoy works, open its URL once yourself and find the record in Detections, as described in Decoy links. That is your own setup check, not an attack.

4. Verify the install

1. Open a storefront page in a browser. In developer tools, open Network, reload, and find bot-detection.min.js. It must return 200.
2. In the WebDecoy dashboard setup checklist, enter the page address in the install verifier and choose Check my page. WebDecoy fetches the page from outside your browser and tells you whether this site’s tag is there. If the store is password protected, the check cannot see the page.
3. Open Sensors. After a page loads in a browser, the Detection Script row moves to Running, nothing automated seen or Reporting.

A browser script does not run for curl, so the WebDecoy-Test/1.0 user agent cannot prove this install. To prove the detection pipeline end to end, use Send a test detection on the dashboard. See Verify your installation for what each status means.

What this covers, and what it does not

• Covered: shoppers and clients whose browsers run JavaScript on the pages you selected, including headless browsers, browser automation, AI browser agents and AI browser extensions, plus LLM referrals.
• Not covered by the script: crawlers that fetch HTML without running JavaScript, such as Googlebot’s crawl pass, GPTBot, ClaudeBot, CCBot and curl. They only show up if they follow the hidden decoy link. To see every request you need an edge sensor such as the Cloudflare edge sensor, which requires your domain’s traffic to pass through Cloudflare. Check SHOPLINE’s own domain documentation before proxying a store domain.
• No order review. WebDecoy has no SHOPLINE app, so it cannot read, tag or flag orders, and it does not block checkout. Detections appear in the WebDecoy dashboard only.
• No blocking from the script. The browser script detects and reports; it does not refuse requests. See Response actions for what you can do with detections.

Read Detection coverage for the full comparison.

Remove

In Apps, then Custom Code, disable or delete the WebDecoy codes. Reporting stops on the next page load.