What it does

The firewall stands in front of one of your store's web addresses, usually the main domain bots already use. Every visitor to that address is checked against the rules from your IP Blocking page before they reach Shopify:

Blocked visitors see a plain page. They never reach Shopify, so no checkout, no abandoned checkout and no customer record is created for them.
Everyone else is sent on to your store in a fraction of a second. Real shoppers notice nothing.

The check happens on CartWatch's servers, not in the browser, so it works against browser-less bots too: a script that posts straight to /cart/add.js or opens a cart permalink on the protected address is checked the same way as a shopper loading your homepage. Stores with the firewall do not need the theme app embed for their IP and country rules.

Search engines are always let through. Visits from Google's, Bing's, Apple's and DuckDuckGo's own crawler networks skip the rules, so a country rule never hides your products from Google Shopping or search results.

Can bots be stopped before the checkout is created?

With the firewall, yes, for bots that arrive through the protected address and match one of your rules. This is the only CartWatch feature that stops a checkout from being created at all. Every other action (flagging, tagging, email suppression, customer record deletion and payment blocking) happens after Shopify has created the checkout.

Two limits:

Bots that go straight to your other domain or to your *.myshopify.com address bypass the firewall. Shopify serves every store on its myshopify.com address and nobody can put anything in front of that. Those bots still create checkouts, and CartWatch still scores, tags, suppresses and refuses payment for them as usual. Payment blocking covers those paths because it runs inside Shopify checkout whatever the address.
Only visitors who match a rule are blocked. The firewall enforces your IP, network and country rules; it does not use the bot score. With no rules, or with Enable IP blocking off, it checks every visitor and lets everyone through. The Firewall page's Analytics tab shows which data-center networks the bots come from so you can add them as rules.

Which address do the bots use?

The Firewall page shows it. The card Where your bot checkouts come in lists your store's web addresses with how many of your flagged checkouts started on each one over the last 30 days, and says what that means:

Most start at your *.myshopify.com address: the firewall would not see them. Payment blocking still refuses their payments.
Most start at your current main domain: make another address the main domain in Shopify first, then protect this one.
Most start at an address that is not your main domain: protect that address as it is.

Counting began on 22 October 2026 and only covers checkouts flagged after that, so a store that just installed CartWatch sees an empty card for the first few days.

What you need

A custom domain connected to your Shopify store (Settings → Domains). Stores that only have a myshopify.com address cannot use the firewall.
Two addresses: the one to protect and a different one to use as Shopify's main domain. Visitors who pass the check are sent to the main domain, so the two must differ. Most stores protect their current main domain (for example www.yourstore.com) and make the other one (yourstore.com) the main domain in Shopify, or the other way round.
Access to your domain's DNS records. For Shopify-managed domains that is Settings → Domains → your domain → DNS settings.

Setting it up

The Firewall page walks you through four steps and updates itself as each one completes.

Choose the address to protect. Protect the address bots already use, usually your current main domain.
Set a different main domain in Shopify. In Settings → Domains, pick another domain and choose Change primary domain. Come back to CartWatch and click Check again.
Add the certificate record. Add the CNAME record shown on the page to your DNS. It lets Google issue the security certificate for the protected address before any traffic moves, so no visitor ever sees a warning. The certificate usually arrives 15 to 30 minutes after the record is added. Keep this record in place afterwards: it is used to renew the certificate every few months.
Point the address at CartWatch. Once the certificate is ready, replace the address's current A or CNAME record with the A record shown on the page, and leave no other A or CNAME record on the same name, or some visitors will keep going straight to Shopify. The AAAA record is optional; Shopify's DNS editor doesn't accept it next to an A record with the same name, so skip it there. CartWatch checks public DNS every ten minutes and the firewall turns on at the first check that sees your records.

Once it is running

The Firewall page has two tabs:

Analytics shows how many visitors were let through and how many were blocked over the last 7 or 30 days, who came through (browsers, crawlers, scripts), where browser visits came from, and the busiest data-center networks, each with the bot checkouts CartWatch flagged from it. A + next to a network adds it to your IP-blocking rules in one click.
Settings shows the firewall's status, links to your IP-blocking rules, and lets you disconnect.

Rules are shared with the IP Blocking page. Saving a rule there reaches the firewall within seconds. Visitors on your allowed-IP list are never blocked by the firewall.

Disconnecting

Click Disconnect on the Settings tab. CartWatch shows the DNS records the address had before you set the firewall up, so you can put them back; once the address no longer points at CartWatch, the certificate and the firewall entry are removed. Change the records first: if the address still points at CartWatch after the firewall is torn down, it answers with an error page until you do.

Troubleshooting

Step 3 is stuck on "waiting for the certificate" — DNS changes can take a few minutes to show up, and Google usually issues the certificate within 20 minutes after it sees the record. If it has been more than an hour, check the record's name and value for typos, then contact support.
Some visitors still skip the firewall — a second A, AAAA or CNAME record on the same name sends part of your traffic straight to Shopify. Remove every other record on that name.
Nothing is being blocked — the firewall enforces your IP, network and country rules only. Check that Enable IP blocking is on and that you have rules; the Analytics tab shows which networks to add.
Bot checkouts keep arriving — check the "Where your bot checkouts come in" card. Bots that use your myshopify.com address or your other domain never pass through the firewall; payment blocking still refuses their payments.
You changed your DNS and the firewall stopped — CartWatch emails you when an active address stops pointing at it. Restore the records from the Firewall page, or disconnect properly.