Skip to main content
Tick PowerMapper
 Try it now

403 Forbidden or 429 Rate Limited in Shopify Technote TN-W21

In May 2026 Shopify notified their customers that scanners should use Web Bot Auth in future.

In late July 2026, scans of Shopify sites started showing 429 Rate Limited errors instead of the usual scan results. This is due to aggressive bot protection by Shopify aimed at uncontrolled AI bots cloning sites and flooding stores with abandoned checkouts.

In addition to AI bots, the bot protection blocks:

  • Real human customers using VPNs
  • QA tools and link checkers
  • SEO and accessibility scanners

Symptoms

  • Scans of Shopify stores have far fewer pages than expected
  • If the Errors tab is turned on, it shows 403 Forbidden or 429 Rate Limited errors
  • If only the Accessibility tab is turned on, then no results are reported (the Diagnostics link on the report shows 429 Rate Limited errors)
  • The only content on the scanned pages is the text local_rate_limited
  • No other issues are detected

If scans show 403 Forbidden with a Cloudflare “Sorry, you have been blocked” page instead, see Shopify stores behind Cloudflare below.

Resolution

Shopify now requires Web Bot Auth signatures to authorize crawler access — each connected domain has its own unique set of signatures. This is the only method Shopify supports for authorizing crawlers — they do not support IP allowlisting or alternative authorization methods, and changes to robots.txt will not bypass Shopify’s bot protection or rate limits.

Shopify’s crawling your store support page shows how to obtain the Web Bot Auth signatures for your store from your Shopify admin page.

To add Shopify signatures to an OnDemand site:

  1. Go to Options… for the site being rate limited
  2. Go to the Crawler tab in Scan Options
  3. Select Web Bot Auth, then enter the Signature-Input and Signature values from your Shopify admin. Leave Signature-Agent as "https://shopify.com" - the quotes are part of the value
  4. Click Save

To add Shopify signatures in SortSite Desktop Professional or Developer Edition:

  1. Go to View Replays on the Check menu
  2. Click the Add Web Bot Auth… button
  3. Add the site origin - your site address without any path e.g. https://example.com
  4. Enter the Signature-Input and Signature values from your Shopify admin. Leave Signature-Agent as "https://shopify.com" - the quotes are part of the value
  5. Click Save

Shopify uses different Web Bot Auth signatures for each connected domain - even domains connected to the same store. The signature values must exactly match the domain being scanned - example.com and www.example.com are different domains and use different Web Bot Auth signatures. In most cases you want to scan your store’s primary domain, so use the primary domain as the start page in OnDemand Scan Options and enter the Shopify Web Bot Auth signatures for the primary domain in the Crawler tab.

When you create a signature in Shopify you choose how long it stays valid - the default is 30 days, and the maximum is 90 days. Web Bot Auth signatures can’t be renewed — once they expire you must create new signatures in your Shopify admin page and re-enter them. Once a signature has been saved, OnDemand and the desktop app both show its expiry date under Signature-Input, turning red once the signature has expired.

Shopify stores behind Cloudflare

Some stores route their domain through their own Cloudflare account before it reaches Shopify. Cloudflare then blocks scans before Shopify ever sees the Web Bot Auth signatures, so adding signatures has no effect. Signs of this are:

  • 403 Forbidden errors on the home page and robots.txt, rather than 429 Rate Limited
  • Scanned pages show a Cloudflare “Sorry, you have been blocked” page, not local_rate_limited
  • Response headers show server: cloudflare and a cf-ray header, with no powered-by: Shopify header

To fix this, add a Cloudflare rule that lets scans through, as described in Technote TN-W22, and keep the Shopify Web Bot Auth signatures in place - Shopify’s own bot protection still applies once requests get past Cloudflare.

Applies To: OnDemand, SortSite Professional and Developer Edition 2026.61 and later

Last Reviewed: October 9, 2026