Skip to main content
Tick PowerMapper
 Try it now

429 Rate Limited in Shopify Technote TN-W21

In May 2026 Shopify notified their customers that scanners should use Web Bot Auth in future.

In late July 2026, scans of Shopify sites started showing 429 Rate Limited errors instead of the usual scan results. This is due to aggressive bot protection by Shopify aimed at uncontrolled AI bots cloning sites and flooding stores with abandoned checkouts.

In addition to AI bots, the bot protection blocks:

  • Real human customers using VPNs
  • QA tools and link checkers
  • SEO and accessibility scanners

Symptoms in OnDemand

  • Scans of Shopify stores have far fewer pages than expected
  • If the Errors tab is turned on, it shows 429 Rate Limited errors
  • If only the Accessibility tab is turned on, then no results are reported (the Diagnostics link on the report shows 429 Rate Limited errors)
  • The only content on the scanned pages is the text local_rate_limited
  • No other issues are detected

Resolution

Shopify now requires Web Bot Auth signatures to authorize crawler access — each connected domain has its own unique set of signatures. This is the only method Shopify supports for authorizing crawlers — they do not support IP allowlisting or alternative authorization methods, and changes to robots.txt will not bypass Shopify’s bot protection or rate limits.

Shopify’s crawling your store support page shows how to obtain the Web Bot Auth signatures for your store from your Shopify admin page.

To add Shopify signatures to an OnDemand site:

  1. Go to Options… for the site being rate limited
  2. Go to the Crawler tab in Scan Options
  3. Select Web Bot Auth, then enter the Signature-Input and Signature values from your Shopify admin and set Signature-Agent to "https://shopify.com" (including the quotes)
  4. Click Save

Shopify uses different Web Bot Auth signatures for each connected domain - even domains connected to the same store. The signature values must exactly match the domain being scanned - example.com and www.example.com are different domains and use different Web Bot Auth signatures. In most cases you want to scan your store’s primary domain, so use the primary domain as the start page in OnDemand Scan Options and enter the Shopify Web Bot Auth signatures for the primary domain in the Crawler tab.

When you create a signature in Shopify you choose how long it stays valid - the default is 30 days, and the maximum is 90 days. Web Bot Auth signatures can’t be renewed — once they expire you must create new signatures in your Shopify admin page and re-enter them in OnDemand Scan Options.

Applies To: OnDemand

Last Reviewed: August 21, 2026