Start with the store action.
A page view, a form submission, a cart change and an order are different events. Write down the unwanted action first. Then identify the system that accepts it and the point where a decision could prevent it. Seeing a browser event after the action is useful evidence, but it is not that intervention point.
Shopify’s native feature has a defined purpose.
Shopify describes its Plus bot-protection feature as a fairness control for scarce inventory during flash sales. It is activated through Plus Support, applies to the Online Store channel and is scheduled for a bounded period. Shopify explicitly distinguishes this from protection against bot-related fraud. Check those conditions before assuming it addresses a different problem. Shopify’s native bot-protection documentation.
Theme code sees the page where it runs.
A theme app embed can supply storefront JavaScript after the merchant activates it. Shopify does not render theme app embeds on checkout pages. A browser overlay or redirect therefore cannot establish server-side protection of every checkout or direct platform request. It also cannot retract product content already sent to a client. Theme extension configuration and restrictions.
Pixels observe commerce events.
App Web Pixels run with controlled APIs in a strict sandbox. Their event stream can help explain a journey, but it is not a synchronous checkout gate. Privacy settings can delay or prevent observations. A session without pixel events may reflect consent or script availability; absence alone does not establish automation. Web Pixels API and pixel privacy.
A real checkout gate needs an eligible hook.
Cart and Checkout Validation Functions can return errors at supported cart and checkout steps, including documented express-checkout paths. Distribution and plan requirements matter, and some other ordering paths are excluded. Network access is separately restricted: do not assume an ordinary public app can call its own detector synchronously during every checkout. Validation Function reference and Function availability.
Ask for a coverage demonstration.
- Confirm the surface, plan, activation and privacy prerequisites.
- Check ordinary shoppers, keyboard navigation and missing telemetry.
- Test the supported action and alternative paths in an authorised development store.
- Inspect an authoritative executed effect, not only an app’s rule match.
- Test how to reverse the policy and what happens during an outage.
Keep unknown coverage visible. It is more useful than a universal “protected” badge whose meaning changes between surfaces.