What are bots?
Bots are automated programs that visit websites and carry out actions without a person behind them. Some bots are useful, such as search engines that read your pages so they can show them in search results. Others are set up to misuse online stores, for example by testing stolen card details at checkout or entering email addresses taken from a list.
Most online stores receive some bot traffic. It often arrives in bursts, so you may see a sudden rise in checkouts or new shoppers over a few days, followed by a drop.
Why bots come to your store
Bots visit stores for different reasons. Shopify groups them by their intent:
- Beneficial bots. Many bots are useful. SEO indexer bots crawl your pages so your listings on search engines stay up to date, and the apps connected to your store use automated integrations to help manage it.
- Undesirable bots. These are not an immediate threat, but you may not want them on your store. Examples include scrapers that collect your product, price and stock information, restock bots that buy products as soon as they are back in stock, and spam bots that fill in sign-up and contact forms.
- Harmful bots. A smaller group of bots are set up to misuse your store, for example by creating fake customer sign-ups or testing whether payment card details work at checkout (often called card testing).
For the full list, see Shopify’s guide to bot types and intents.
Bots are created and run by third parties, so the exact reason a store is targeted is not usually visible to you or to Instant AI. Your store and your checkout are hosted and managed by Shopify, so Shopify is the best place to find out why your store is receiving bot traffic and what protection is available on your plan. See Shopify’s guide to protecting your store from bots.
Why checkout is usually where bots enter
Checkout is where a shopper types in their email address, so it is the main place a bot can leave one.
Many bots do not browse your store at all, which is why they rarely trigger other flows such as browse abandonment or cart abandonment. Instead, they usually go straight to your checkout, often by creating a checkout session directly from a checkout URL. This means they skip your home page, collection pages and product pages.
Why bot email addresses look real
Bots usually use email addresses that look like any other shopper’s, such as a name and number at Gmail, Outlook or Yahoo. The addresses may be generated automatically or taken from a list. It is often assumed that a bot is easy to recognise because it uses an obviously fake email address, but this is often not the case.
These addresses have a valid format and a valid email provider, and the checkout details that come with them look like normal shopper details. When the checkout arrives, there is no reliable way to tell a bot’s address apart from a real shopper’s address. Email providers do not confirm whether a mailbox exists before an email is sent, so in many cases the only way to find out an address does not exist is to send an email and receive a bounce.
How bots affect your email marketing
New shoppers that are bots
When an email address is entered at checkout, Shopify saves it and creates a customer profile. Shopify shares this with Instant AI through our integration, in the same way as a real shopper’s checkout. If no purchase is made, the checkout counts as abandoned and the profile enters your checkout abandonment flow. This is why most bot activity shows up in checkout abandonment flows. The same details are also shared with any other email platform connected to your store.
You may notice this as a sudden increase in new shoppers or checkout abandonment emails that does not match an increase in orders or site visits.
Bounces and delivery rate
When an email is sent to an address that does not exist, it hard bounces. A burst of bot checkouts can cause a burst of hard bounces, which lowers the delivery rate in your deliverability reporting.
These bounces happen because the address does not exist. They are not caused by your domain setup or your sender reputation.
Why Instant AI reporting can look different to your other platform
Checkout is the top of the funnel. It is often the first place a shopper’s email address enters your marketing. If you run your abandonment flows in Instant AI, and run your campaigns, welcome flow and other flows in another platform, Instant AI receives most of the bot activity.
This can make Instant AI’s delivery rate look lower than your other platform’s, because:
- Instant AI sends the flow that bots trigger most, so a larger share of its emails go to bot addresses.
- Your other platform usually sends far more emails overall, so the same bot addresses make up a smaller percentage of its total.
Your other platform receives the same checkout details from Shopify. If it also runs a checkout abandonment flow, or adds these addresses to its lists, it receives the same bot addresses.
How Instant AI handles bots
Skip checkout abandonment emails for likely bots
Before sending a checkout abandonment email, Instant AI checks the shopper’s activity on your store. A shopper who is new to your store needs to have viewed at least one page on your website, as well as starting checkout, to receive checkout abandonment emails.
If a new shopper’s only activity is a single checkout event, with no page views or other activity, Instant AI treats the profile as suspicious and does not send them checkout abandonment emails.
This check applies to checkout abandonment flows only. It does not change your other flows or your campaigns.
Immediately suppress emails that bounce
If an email hard bounces, Instant AI automatically suppresses that address. The remaining emails in the flow are cancelled, and the address is not emailed again. This means an invalid address receives one email attempt, rather than every email in the flow.
Exclude specific email domains
If you notice bot addresses coming from a specific email domain, you can exclude that domain so shoppers with that domain are skipped from your flows. See How to Exclude Certain Shoppers from Receiving Instant AI Emails.
How to check if your bounces may be from bots
There is no certain way to know whether a bounce came from a bot. However, you can check your bounce reasons in your Instant AI dashboard for common indicators of bot activity.
- Go to Settings in your Instant AI dashboard
- Select Deliverability
- Open Bounce reasons
- Check which flow each bounce came from and the reason for the bounce
If most of your bounces come from your checkout abandonment flow, and the reason is an invalid email address (the address does not exist), this is a common indicator of bot checkouts.
This is useful when you see a drop in your delivery rate. If your bounces follow this pattern, you can be confident the drop is caused by invalid addresses and not by your sender reputation or domain setup.
If your bounces come from a range of flows, or the reasons relate to your domain, authentication or emails being blocked, the cause is likely something else. See Why does Instant AI need to connect to my DNS provider? or contact support.
What you can do in Shopify
Bots enter through your store’s checkout, so Shopify is the most effective place to reduce them. Shopify’s recommendations include keeping hCaptcha turned on for your store’s forms and account pages, adding a CAPTCHA challenge to checkout (checkout bot protection is available on Shopify Plus), monitoring your traffic for unusual spikes, and reviewing the fraud analysis on your orders.
- Contact Shopify Support about the bot activity on your store and the protection available on your plan.
- Read Shopify’s guide to protecting your store from bots.
- Look at fraud and bot protection apps in the Shopify App Store. Test any app carefully, as some can block real shoppers and reduce sales.
FAQ
Can Instant AI stop bots from reaching my store? No. Bots visit your store and enter your checkout on Shopify, before any details are sent to Instant AI. Instant AI receives the checkout details from Shopify afterwards, in the same way as your other connected apps, so it cannot block the visit or the checkout itself. What Instant AI controls is who receives your emails: it skips checkout abandonment emails for likely bots and suppresses addresses as soon as they bounce. To reduce the bots reaching your store, see the steps in What you can do in Shopify above.
How do I know if a new shopper is a bot? There is usually no way to tell from a single profile, because the name, email address and checkout details look real. Patterns across many profiles are a better guide. Common indicators include a sudden rise in checkouts that does not match orders or site visits, many checkouts for the same low-value product, repeated names, addresses or phone numbers, and bounces from your checkout abandonment flow with an invalid email address as the reason. You can review your abandoned checkouts in your Shopify admin under Orders > Abandoned checkouts.
Why doesn’t Instant AI check whether an email address is real before sending? Instant AI checks that each address has a valid format and a valid email domain. Email providers such as Gmail and Outlook do not confirm whether a specific mailbox exists until an email is sent, so an address that looks valid can only be confirmed by sending to it. If the address does not exist, the email bounces and Instant AI suppresses the address straight away.
Could a real shopper miss a checkout abandonment email because of the bot check? Yes, in some cases. A new shopper who opens your checkout directly from a link, without viewing any page on your website, does not receive checkout abandonment emails. Shoppers who view at least one page on your website receive them as normal. The check only applies when a new shopper has no activity other than a single checkout, so most real shoppers, who view a product or page before checking out, are not affected.
Why is my delivery rate lower in Instant AI than in my other email platform? If Instant AI runs your checkout abandonment flow and your other platform runs everything else, Instant AI sends most of the emails to bot addresses. Your other platform also sends more emails overall, so the same bounces make up a smaller percentage of its total. You can check whether this applies to your store in Bounce reasons (see How to check if your bounces may be from bots above).
Will a bot address keep receiving emails after it bounces? No. After an address hard bounces, Instant AI suppresses it and cancels the remaining emails in the flow. This limits each invalid address to a single email attempt.
For more on bot activity in your reporting, see How to Make Sure Your Email and SMS Metrics Aren’t Inflated by Bots.