Frequently Asked Questions

IP & Fake Order Blocker · Last updated September 2026

What the app does

What does IP & Fake Order Blocker do?

It gives you two things: a rule-based storefront blocker (block, allow, or redirect visitors by IP address, IP range, country, or province) and a fraud-order risk engine that scores incoming orders and lets you tag, hold, or auto-cancel the risky ones. Both run automatically once set up — you don’t review every visit or every order by hand.

What happens when a blocked visitor tries to view my store?

Depending on the rule that matched, they either see a block page (the default one, or your own custom text and colour on Premium and above) or are redirected to a path you choose. A redirect rule sends them to any path on your own store; it doesn’t send them anywhere off your domain.

Does the app affect my store’s speed?

The storefront check runs as a single background request the moment a page loads. If that request is slow or fails for any reason, the app fails open — your page is shown normally rather than left blank or stuck waiting. A blocked page is only ever replaced after a decision actually comes back.

IP and country blocking

How do I block visitors by IP address?

Go to Block & Re-director and create an IP rule with the address you want to match, choosing Block, Allow, or Redirect as the action.

How do I block an entire country or province?

Create a Location rule and choose a country (using its standard country code) or, for finer control, a specific province/state within that country. You can also choose “Block all except” a list of countries or provinces — everywhere not on your list is blocked, everywhere on it stays open.

Can I block a range of IPs, or a whole prefix?

Yes. IP rules accept a single address or a CIDR range (e.g. 203.0.113.0/24) for a contiguous block of addresses. Separately, an IP-prefix rule matches any address that starts with a given prefix (e.g. every address beginning 203.0.113.), useful when a range isn’t a clean CIDR block.

What’s the difference between block, allow, and redirect?

Block shows the visitor a block page and stops them from browsing further. Redirect sends them to a different path on your own store instead of showing a block page. Allow explicitly lets a visitor through — used to carve out exceptions inside a broader block (see below).

How do allow rules override block rules? (the precedence order)

Rules are checked most-specific-first: an exact IP or IP-range match is checked before a province match, which is checked before a country match, which is checked before a country-wide “block all” rule. An explicit allow rule at a more specific tier always wins over a block at a broader tier — that’s exactly how “block this country except these provinces” or “block everywhere except this list of countries” works: your exceptions are stored as allow rules, and allow rules at their own tier are always checked before the wider block/wildcard rule beneath them, regardless of when either rule was created.

Does blocking apply to Tor visitors? (Enterprise)

On the Enterprise plan, turning on Tor blocking blocks visitors browsing through the Tor network, checked against a regularly refreshed list of known Tor exit addresses. A merchant-created IP rule (allow or block) for that same address still takes priority over the blanket Tor toggle, but Tor blocking is otherwise checked ahead of country/province rules, so it catches exit-node traffic regardless of what country it appears to be browsing from.

Fraud order detection

How does the app detect risky orders?

Every new order is scored 0–100 based on real, explainable signals — things like the same customer identity or address appearing on multiple recent orders, unusually fast order velocity, and prior cancellations tied to the same identity. Email and phone are never compared or stored in raw form: they’re converted to one-way cryptographic hashes first, so the matching works without the app ever holding your customers’ actual contact details. Each score comes with the specific reasons behind it, visible on the order in the Fraud Orders list.

Can the app automatically cancel high-risk orders?

On the Enterprise plan, yes — turn on auto-cancel and any order that crosses your risk threshold is cancelled automatically, without you needing to review it first. On every other plan, high-risk orders are flagged for you to review and cancel yourself.

Can I set my own rules for tagging or holding risky orders?

Yes. You can create your own risk-action rules that apply a Shopify order tag or place a fulfillment hold once an order’s score crosses a threshold you choose — useful if you want risky orders flagged for manual review rather than cancelled outright.

Content protection

What does content protection do (right-click, inspect, copy)?

On Basic and above, you can independently turn on: disabling right-click on your storefront, disabling common browser devtools/inspect shortcuts, and disabling text and image selection/copying. Each is a deterrent aimed at casual copying, not absolute protection — like any storefront app offering this, it can’t stop a visitor who disables JavaScript or uses their browser’s own bypasses.

Plans, limits, and trial

What are the paid plans and what do they include?

What counts toward my visitor tracking limit?

Each new visit to your storefront counts once toward your plan’s monthly visitor limit. Repeat page views from the same visitor within a short return window count as the same visit, not a new one each time, so the number reflects real traffic rather than every single page load.

What happens when I hit my visitor limit?

Blocking, redirecting, and allowing continue to work exactly as configured — your rules are never turned off. What stops is new visitor tracking data being logged for the rest of that billing period, so your Analytics tabs will have a gap until the limit resets or you upgrade.

How many block/redirect rules can I create per plan?

Free: 5. Basic: 50. Premium: 1,000. Enterprise: unlimited.

What happens to my rules if I go over my plan’s rule limit?

Nothing is deleted. If you have more enabled rules than your current plan allows (for example after downgrading), the rules beyond your limit simply stop being applied and are shown greyed out in your rules list until you either remove some or upgrade.

How does the free trial work?

Basic, Premium, and Enterprise each include a free trial before your first charge — the exact number of trial days is shown on the plan you select at checkout. The Free plan has no trial because there’s nothing to charge for.

Will I be charged automatically after my trial?

Yes. Once your trial ends, Shopify automatically starts billing your selected plan with no extra approval step required from you — see Billing below for exactly how that charge reaches you.

Billing

How does billing work — do I pay Shopify or the app developer directly?

Billing runs entirely through Shopify’s own app-billing system. You choose a plan on Shopify’s own hosted pricing page, and Shopify bills you directly — the charge appears on your regular Shopify invoice alongside your Shopify subscription and any other app charges, not as a separate transaction from us. We never see or store your payment details.

Can I change or cancel my plan anytime?

Yes, at any time, from the same Shopify-hosted pricing page linked from the app’s Pricing tab. Upgrades, downgrades, and cancellations are all handled entirely by Shopify.

What happens to my data/rules if I downgrade my plan?

Nothing is deleted on downgrade. Rules, custom block templates, and settings beyond your new plan’s limits are kept as-is but simply stop being served or enforced until you’re back on a plan that includes them — so upgrading again brings everything back exactly as you left it.

Installation and setup

How do I install and activate the app on my storefront?

Installing the app from the Shopify App Store is only the first step. Blocking only takes effect once you also turn on the app embed in your theme: from the app’s Dashboard, use the “Activate in theme” link, which opens your Shopify Theme Editor with the app embed ready to enable, then save your theme.

Why isn’t blocking working after I installed the app?

The most common cause is the theme app embed not being turned on yet — installing the app alone doesn’t activate storefront blocking. Check the Dashboard’s setup checklist for the embed’s status, and confirm the app’s own on/off toggle (Order Shield status) is switched on.

Data and privacy

What data does the app collect?

Order-level fields needed for fraud scoring (IP address, customer locale, financial/fulfillment status, price, and Shopify’s own order/customer IDs), and storefront visitor data (IP address, resolved country, and the resulting allow/block/redirect decision) when storefront protection is turned on. Full detail is in our Privacy Policy.

Does the app store my customers’ emails, phone numbers, or addresses?

Never in raw form. Email, phone, and address are converted to one-way cryptographic hashes before anything is written to our database, and the original values are discarded immediately — we use the hashes only to detect the same identity recurring across orders.

What happens to my data if I uninstall the app?

Shopify notifies us automatically when you uninstall, and we erase your store’s stored data, including every order and visitor record tied to your shop.

Support

How do I contact support?

Use the in-app Contact support page, or email devmind.pk@gmail.com directly.