If you searched for Shopify captcha, add captcha to Shopify checkout, Shopify recaptcha not stopping bots, or Don’t allow bots to auto-complete checkouts, you already did the thing Community threads recommend: turn on a challenge and wait for the abandoned checkout list to clear.
It does not clear. That is not because captcha is broken. It is because the captcha Shopify gives you, and the one merchants ask for, are different layers — and abandoned checkout bots live on a layer captcha never sees.
How to add captcha to Shopify checkout
You cannot drop a captcha widget onto Shopify checkout the way you can onto a contact form. Checkout is a protected Shopify surface. Theme apps and custom Liquid do not run there, so a cart-page reCAPTCHA, a “spam buster” app, or a snippet you pasted into theme.liquid never fires against a bot that skipped the storefront.
What you can turn on:
1. Storefront hCaptcha (every plan). In Online Store → Preferences → Spam protection, Shopify’s hCaptcha is on by default for contact, newsletter, and comment forms, plus login, create-account, and password-recovery pages. This is the “Shopify captcha” most merchants already have. It is not a checkout captcha.
2. Shopify Plus bot protection (Plus only). Bot protection is not in Settings until Plus Support activates it. You then schedule an event of up to 60 minutes with a checkpoint challenge (hCaptcha or Google reCAPTCHA). Don’t allow bots to auto-complete checkouts is on by default for that event. Shopify built this as a fairness control for auto-checkout bots during drops and flash sales, and says it is not meant to combat fraud-related bot activity.
3. Require login before checkout. Settings → Checkout. Captcha on the login form then sits in front of checkout. That raises friction for crude scripts, and it also raises friction for real shoppers. Guest checkout exists because converting customers do not want an account.
If your symptom is fake abandoned checkouts, none of those three is the control you think you turned on.
What Shopify captcha actually protects
Shopify uses hCaptcha on storefront forms. A search for Shopify recaptcha is the same setting with last year’s name — Shopify finished moving storefront forms off reCAPTCHA in 2024. The challenge scores how a visitor behaves on the page. Suspicious or high-rate submissions get a /challenge interstitial. Quiet humans often never see a puzzle.
That is useful. It cuts contact-form spam, comment spam, and account-creation junk. Those are forms in your theme. The bot has to load the page, interact with the fields, and post through Shopify’s form endpoint.
Checkout is not one of those forms. Shopify’s theme captcha docs list customer, contact, and blog comment forms. There is no checkout row. Enabling spam protection does not wire a challenge to the payment step, to the contact step in checkout, or to a cart permalink.
So when a merchant says “captcha is on and we’re still getting bots,” both halves are usually true. Captcha is on. The bots are not using a form it covers.
Don’t allow bots to auto-complete checkouts
Don’t allow bots to auto-complete checkouts is not a standing checkout setting. It is a checkbox on a Shopify Plus bot-protection event — a scheduled window of up to 60 minutes that Plus Support has to activate for you. It is on by default when you schedule that event.
Shopify describes the whole feature as a fairness control for auto-checkout bots during flash sales: known bots get blocked or slowed so humans can buy scarce inventory. The same help page says it is not meant to combat fraud-related bot activity.
That is a different job from cleaning Abandoned checkouts. A bot can still create a checkout — name, email, cart permalink — without finishing an order. The checkbox only applies while the event is running, and only against bots Shopify already flags as trying to complete a purchase. All-day abandoned-checkout spam and card testing on ordinary SKUs sit outside that window and outside that purpose.
Why captcha misses abandoned checkout bots
Captcha is a browser challenge. It needs a page to render, JavaScript to run, and a visitor who will solve — or silently pass — a test. The bots filling Orders → Abandoned checkouts skip that path.
They do not browse. They do not click Add to cart. They do not sit on a shipping step long enough for a challenge to matter. They POST a name, email, and address into checkout, often from a residential IP in a country you sell to, using a normal-looking user agent. IP and country blockers miss the same traffic for the same reason: there is no storefront session to overlay.
Even a bot that does render checkout can look human enough that Shopify never shows a puzzle. Headless browsers, residential proxies, and stolen-cookie sessions are built to pass the tests captcha is good at. The giveaway is in the checkout payload — disposable email, fabricated address, missing visitor context, velocity no shopper matches — not in whether a widget appeared.
And none of this can un-create the record. Shopify writes an abandoned checkout the moment contact details land. Captcha, a theme app, and Cloudflare in front of your domain can all be working and you still get the row, the customer, and the Started Checkout in Klaviyo.
The cart permalink bots use instead
Shopify documents this URL because merchants use it on purpose. Bots use it because it is public.
A cart permalink looks like:
https://your-store.com/cart/VARIANT_ID:1
Visit it and Shopify adds that variant to a cart and sends you toward checkout. No homepage. No collection page. No theme app embed. No hCaptcha on a contact form. In a long-running Community thread about hundreds of bots abusing checkout every day, merchants keep landing on the same diagnosis: the bot never needed to pass captcha, because it never loaded a page that had one.
The permalink works on your custom domain and on yourstore.myshopify.com. Edge rules on the branded host do not cover the second address. Direct /cart/add.js posts are the same idea with less ceremony.
You cannot turn cart permalinks off. They are how Buy Buttons, some sales channels, and a lot of legit one-click flows work. Treating the URL as a bug is a dead end. Treating it as the reason storefront captcha never sees these bots is the useful part.
What to do instead of adding more captcha
Keep storefront hCaptcha on. It is free, default, and it does the job it was built for. If you are Plus and you run drops, schedule bot protection for the window. Neither is a substitute for scoring the checkouts that still appear.
The layer that can see those checkouts is the checkout itself:
- Score the payload when Shopify sends
checkouts/createandcheckouts/update— email, address, session context, velocity — instead of waiting for a widget the bot never loaded. - Stop mailing them. Tag the customer and suppress the address in Klaviyo, Omnisend, Mailchimp, or Drip before a recovery flow sends. That is the Klaviyo bill problem in every ESP — and in Mailchimp, unsubscribe is not enough, because unsubscribed contacts still bill.
- Refuse the payment if they do try to complete. Payment blocking (Shopify checkout validation) runs on Shopify’s servers, so a permalink bot cannot dismiss it the way it dismisses a theme overlay. That is the lever against card testing. It still will not delete the abandoned checkout row — nothing a third-party app can do will — but the order never completes and the processor never answers.
If you want the roundup of which app sits at which layer, we sorted that in best Shopify bot protection apps.
FAQ
Can I add reCAPTCHA or hCaptcha to Shopify checkout? Not as a theme widget. Storefront hCaptcha covers login, account, contact, and comment forms under Online Store → Preferences. Checkout captcha as a merchant-controlled checkpoint is Shopify Plus bot protection: a scheduled challenge, not an always-on checkout field.
Why is Shopify captcha not stopping bots? Because the bots creating abandoned checkouts are not submitting the forms captcha protects. They hit a cart permalink or checkout directly, skip your theme, and never see hCaptcha.
Does Don’t allow bots to auto-complete checkouts stop fake abandoned checkouts? No. It is a default option on a Plus bot-protection event (up to 60 minutes), aimed at auto-checkout bots buying limited inventory. Shopify says the feature is not for fraud. Creating an abandoned checkout does not require completing an order.
Does Shopify Plus bot protection stop checkout spam? It can slow known auto-checkout bots during a scheduled drop. It is not always-on, and Shopify does not position it as a fraud or abandoned-checkout tool.
Should I require customers to log in before checkout? It can slow crude bots because captcha then sits on the login form. It also costs real conversions. Use it as a temporary brake during an attack, not as the standing fix.
Will a captcha app on my cart page help? Only against bots that load that page. Permalinks and direct checkout requests never do. Cart-page captcha is extra friction for shoppers and a no-op for the attack you are probably seeing.
Captcha at the door, scoring at checkout. Keep the first. Add the second.
CartWatch scores every Shopify checkout as it arrives, tags likely bots on the customer record, and holds them out of your email flows before a send. On Standard, payment blocking refuses the payment when they attempt it so a scored bot never completes an order. Install CartWatch from the Shopify App Store and see which checkouts captcha never met.