FAQ

Frequently asked questions

How CartWatch installs, scores checkouts, tags bots, and keeps fake profiles out of your recovery flows.

Getting Started

How do I install CartWatch?
CartWatch is available on the Shopify App Store. Search for CartWatch, click Install, and approve the requested permissions. CartWatch connects to your store via OAuth and begins monitoring checkouts immediately.
Do I need to configure anything after installing?
CartWatch works out of the box. Auto-tagging is enabled by default, so detected bots are tagged in Shopify automatically. You can optionally connect Klaviyo, Omnisend, Mailchimp, Drip, Brevo, Privy, or Constant Contact in Settings to enable automatic email suppression.
What Shopify permissions does CartWatch require?
CartWatch requests checkout access (to receive webhook events), customer read/write (to apply the CARTWATCH_FLAGGED_BOT tag and, if you turn it on, delete the customer records of very-high-risk bots), and order read access (to flag orders placed by known bots as high risk).
Will CartWatch slow down my checkout?
No. CartWatch processes checkout events asynchronously via webhooks. It has zero impact on your storefront's load time or checkout performance.

Bot Detection

What does CartWatch consider a bot?
CartWatch evaluates a combination of behavioral signals and, when configured, third-party enrichment data. Checkouts that score above the detection threshold are classified as bots.
How does CartWatch score checkouts?
Each checkout is scored in real time as webhooks arrive from Shopify. Multiple signals contribute to a composite score. If the total crosses the confidence threshold, the checkout is flagged as a bot.
What happens when CartWatch flags a checkout as a bot?
CartWatch tags the Shopify customer account with CARTWATCH_FLAGGED_BOT (auto-tagging is on by default and can be toggled in Settings), lists the checkout in your dashboard with its bot risk level and the actions taken, and — if Klaviyo, Omnisend, Mailchimp, Drip, Brevo, Privy, or Constant Contact is connected — suppresses the email address in those platforms. On Standard and above you can also have CartWatch delete the Shopify customer record of very-high-risk bots about an hour later (off by default).
What does the CARTWATCH_FLAGGED_BOT tag do?
The tag is applied to the Shopify customer record. You can use it to exclude tagged customers from abandoned cart flows, segments, and marketing lists. It acts as a persistent signal that the account was identified as a bot.
Can CartWatch delete bot customers from Shopify?
Yes, on the Standard plan and above. Turn on Auto-delete Shopify customer records of very-high-risk bots under Settings → Customer Record Cleanup (it is off by default) and choose the minimum bot score; the default is 100, the highest possible score. About an hour after a checkout is flagged at or above that score, CartWatch deletes the bot's Shopify customer record, so fake customers stop piling up in your customer list. The hour leaves time for a fresher checkout update or a whitelist entry to reverse the verdict first. Shopify only allows deleting customers with no orders, so a bot that completed an order keeps its record, and the abandoned checkout itself is never deleted — Shopify doesn't let apps remove those.
Can CartWatch stop bots before they reach my store?
Yes, with the firewall, on the Standard plan and above. You point one of your store's web addresses at CartWatch, and every visitor to that address is checked against your IP, network and country rules before they reach Shopify. Blocked visitors see a plain page; everyone else is sent on to your store in a fraction of a second. A bot stopped there never creates a checkout, an abandoned checkout, or a customer record. It works on scripts that never load a page, not just browsers, and search engines are always let through. Two limits: it protects one address, so bots that go straight to your other domain or to your myshopify.com address still reach the store (CartWatch still scores them and refuses their payment as usual), and it enforces your rules rather than the bot score, so it blocks only visitors who match one. The Firewall page shows which address your bots actually use before you set anything up. See the firewall guide for setup.
Can CartWatch make mistakes and flag real customers?
CartWatch is designed to be conservative, but no detection system is perfect. Every flagged checkout appears in your dashboard with its risk level and a link through to the checkout in your Shopify admin, so you can look at it yourself. If you believe a real customer was flagged, add their email to the Whitelist and remove the tag manually in Shopify — and if the checkout is later updated and scores below the threshold, CartWatch reverses its actions automatically. If auto-delete had already removed their customer record, CartWatch recreates it from the checkout details once the flag is cleared; only a store account login can't be brought back.
What if a flagged checkout is later updated by a real customer?
CartWatch monitors checkout updates. If a checkout that was previously flagged receives a fresher update that scores below the threshold, CartWatch automatically reverses its actions: it removes the Shopify tag, unsuppresses the profile in Klaviyo, Omnisend, Mailchimp, Drip, Brevo, and Privy, and cancels a customer record deletion that hasn't run yet. A customer record that was already deleted is recreated from the checkout details (name, email, phone, addresses, marketing consent, tags and note) within a few minutes; a store account login is not restored.

Klaviyo, Omnisend, Mailchimp, Drip, Brevo, Privy & Constant Contact

How do I connect Klaviyo?
In CartWatch Settings, click Connect Klaviyo. You'll be redirected through Klaviyo's OAuth flow. Once connected, CartWatch automatically suppresses detected bot profiles in Klaviyo whenever a bot is flagged.
How do I connect Omnisend?
In CartWatch Settings, click Connect Omnisend. You'll be redirected through Omnisend's OAuth flow. Once connected, CartWatch automatically marks detected bot profiles as unsubscribed in Omnisend whenever a bot is flagged.
How do I connect Mailchimp?
In CartWatch Settings, click Connect Mailchimp. You'll be redirected through Mailchimp's OAuth flow. Once connected, CartWatch automatically unsubscribes and archives detected bot contacts in every one of your Mailchimp audiences whenever a bot is flagged.
How do I connect Drip?
In CartWatch Settings, click Connect Drip. You'll be redirected through Drip's OAuth flow to approve access. Once connected, CartWatch automatically unsubscribes detected bot subscribers from all mailings in your Drip account and tags them so you can see which unsubscribes CartWatch performed.
How do I connect Brevo?
Brevo doesn't offer app authorization for third-party apps yet, so you connect with an API key. In Brevo, open Settings → SMTP & API → API Keys and generate a new key. Then in CartWatch Settings, paste it into the Brevo Integration card and click Connect Brevo. CartWatch verifies the key against your account, stores it encrypted, and from then on blocklists detected bot contacts for email and SMS in your Brevo account. One thing to check in Brevo: under Settings → Security → Authorised IPs, blocking of unknown IP addresses must be deactivated, because CartWatch's servers don't use fixed IP addresses.
How do I connect Privy?
Privy has no app-authorization screen for third-party apps, so you connect with an OAuth application you create in your own Privy account. In Privy, open Settings → API → API Tokens, create a new OAuth application, give it the contacts_read and contacts_write scopes, and copy its Client ID and Client Secret (Privy shows the secret only once). Then in CartWatch Settings, paste both into the Privy Integration card and click Connect Privy. CartWatch checks the credentials against Privy before saving them encrypted, and from then on unsubscribes detected bot contacts from email and SMS in your Privy account. CartWatch never creates contacts in Privy.
How do I connect Constant Contact?
In CartWatch Settings, click Connect Constant Contact. You'll be redirected to Constant Contact to approve access. Once connected, CartWatch unsubscribes detected bot contacts in your Constant Contact account and tags them CartWatch: bot. Constant Contact adds your Shopify customers once a day, so the unsubscribe can take up to a day after the checkout. Constant Contact doesn't let apps re-subscribe a contact, so if CartWatch later clears a shopper it unsubscribed, they need to sign up again through one of your sign-up forms.
Why does CartWatch archive Mailchimp contacts instead of just unsubscribing them?
Mailchimp bills on total contacts, and unsubscribed contacts still count toward your billing tier — only archived contacts drop out of it. CartWatch tags the contact as a CartWatch-flagged bot, unsubscribes it, then archives it, so the bot stops sending you a bill as well as stops receiving campaigns. The tag stays with the contact and is segmentable.
What does suppressing a profile in Klaviyo, Omnisend, Mailchimp, Drip, Brevo, Privy, or Constant Contact do?
In Klaviyo, CartWatch adds the email address to the suppression list, which prevents it from receiving any marketing sends. In Omnisend, CartWatch sets the contact's email status to unsubscribed. In Mailchimp, CartWatch unsubscribes and then archives the contact in every audience. In Drip, CartWatch unsubscribes the subscriber from all mailings. In Brevo, CartWatch blocklists the contact for email and SMS (Brevo doesn't charge for blocklisted contacts). In Privy, CartWatch unsubscribes the contact from email and SMS. In Constant Contact, CartWatch unsubscribes the contact (Constant Contact doesn't charge for unsubscribed contacts). Either way, the address is excluded from abandoned cart recovery flows and future campaigns.
Does CartWatch unsuppress profiles if a bot determination is reversed?
Yes. If CartWatch reverses a bot flag because a real customer updated the checkout, it automatically removes the suppression in Klaviyo, restores the subscribed status in Omnisend, unarchives and restores the contact in Mailchimp, reactivates the subscriber in Drip, removes the blocklist flags in Brevo, and resubscribes the contact in Privy. Constant Contact is the exception: it doesn't let apps re-subscribe a contact, so a cleared shopper there needs to sign up again through one of your sign-up forms. To make that rare, CartWatch waits before unsubscribing in Constant Contact and checks the verdict again first.

Billing & Plans

How much does CartWatch cost?
The Free plan detects and scores bot checkouts and lets you block visitors by IP or country. Each paid tier adds one more thing CartWatch does about the bots it finds: Basic ($9.99/mo) auto-tags bots in Shopify, suppresses them in Klaviyo, Omnisend, Mailchimp, Drip, Brevo, and Privy, and flags their orders as high risk; Standard ($19.99/mo) adds the firewall, which checks visitors against your IP, network and country rules before they reach your store, and payment blocking, which refuses a flagged bot’s payment so the order never completes and can discourage bots from returning once they can no longer test cards, plus optional blocking of shoppers who keep ordering the same free sample and optional auto-deletion of very-high-risk bot customer records; Pro ($39.99/mo) adds bot detection analytics. Pay yearly and every paid tier is 15% cheaper — Basic $91.80, Standard $193.80, Pro $397.80 per year. Every paid plan includes a 7-day free trial.
How are plans determined?
By features, not order volume. Every plan — including Free — covers unlimited orders and unlimited bot detections. You only move up a tier when you want CartWatch to take a further action on the bots it finds.
What happens if my store grows?
Nothing changes. There are no order limits, no overage charges, and no grace periods — CartWatch keeps scanning every checkout on whatever plan you're on.
How do I upgrade my CartWatch plan?
Go to the Plan page inside the CartWatch app. Select a plan and confirm — billing is handled through Shopify's standard app billing system.