A complete guide: Block Checkout
Overview
Stop fraudsters at checkout, before they turn into orders you have to cancel or refund. When a shopper's details or connection match one of your rules, Shopify stops the checkout and shows your message instead of creating the order. You set the rules up in Block Checkout in the Blockify menu, on a page titled Checkout Protection. Shopify itself runs Blockify's checkout check, so your rules also cover express checkouts and shoppers who switch device.
What you'll learn
- How checkouts are checked
- Turn on Blockify's checkout rule in Shopify
- Add the Blockify block to your checkout
- Create a rule
- Turn on a built-in protection
- Manage your rules
- Change the message buyers see
- Keep your rules under the character limit
- What the numbers at the top mean
- Who can use this feature?
How checkouts are checked
The How checkouts are checked card at the top of the page shows the checks a shopper passes through, in the order Shopify runs them.
Step | When it runs | What it checks | Plan |
|---|---|---|---|
Checkout access | The moment the checkout page opens | Where the shopper connects from: IP address, Location, User agent, ISP, VPN/Proxy | Shopify Plus, and the Blockify block has to be added to your checkout |
Checkout fields | When the shopper pays | What the shopper typed into the form: Email, Phone number, Name, Address, Zip code, Customer tag, Country | Enterprise plan and above |
Order placed | After every check passes | Nothing. This is the checkout going through |
Each step shows how many of your rules are on. Click a step to show only that step's rules in the table below, and click Show all rules to go back to the full list. If your store is not on Shopify Plus, the Checkout access step is not shown, because Shopify only lets apps check the checkout page itself on Plus.
Neither step cancels or refunds an order that was already placed. To handle orders that are already in, use Fraud Filters. To stop many checkouts in a row that reuse one email, address, phone or name, use Stop repeated checkout attempts.
Turn on Blockify's checkout rule in Shopify
Before any rule can stop a checkout, Shopify needs Blockify's checkout rule turned on. You do this once.
Step 1: Open the Checkout rules section
In your Shopify admin go to Settings > Checkout and scroll down to Checkout rules, then click Add rule. If you already have rules from other apps, the list under it is paginated, so check the next pages before you add a second one.
Step 2: Add the Blockify rule
Click Add rule. The Add a checkout rule window lists what each of your apps can add, grouped by app name with a Validation tag. Scroll to BLOCKIFY: FRAUD FILTER and pick Block checkout.
Step 3: Set the rule to Active
Give the rule a Title you will recognise, set the dropdown next to it to Active, and save.
Leave Block checkout if app experiences a problem unticked unless you want checkout to stop whenever Blockify cannot be reached. Unticked, shoppers can still buy if the app has a problem. Ticked, Shopify rejects the checkout instead.
Add the Blockify block to your checkout
Checkout access rules run on Shopify's checkout page itself, so the Blockify - Checkout UI block has to be added to your checkout once. Without it, your access rules are saved but never stop anyone. Checkout fields rules do not need it.
Only Shopify Plus stores can edit the checkout. Create at least one Checkout access rule first, so you have something to test with afterwards.
Step 1: Open your theme
In your Shopify admin go to Online Store > Themes and click Edit theme on your live theme.
Step 2: Switch to the checkout
Open the page menu at the top of the editor and select Checkout and customer accounts.
Step 3: Add the Blockify block
In the left panel, under Main, click Add block. Under Blockify: Fraud Filter, pick Blockify - Checkout UI.
Step 4: Allow the app to block checkout
Click the Blockify - Checkout UI block you just added. Under Checkout behavior, turn Allow app to block checkout on.
Include block in Shop Pay is on by default and keeps the same protection on Shop Pay checkouts. Leave it on unless you have a reason not to.
Step 5: Save and test
Click Save. Open your store, start a checkout that matches one of your access rules, and check that your message appears.
Create a rule
Click Create rule at the top right of the Checkout Protection page. The Create a rule window groups what you can block by the step it runs in.
Pick the detail you want to block and Blockify opens the rule form.
Set the condition
The IF card, The visitor matches, is where you choose what to match on. Pick the condition, pick how to match it (an exact value or a partial match, depending on the condition), then enter the values. Most conditions accept several values at once, separated by commas.
Choose what happens
The THEN card, Stop checkout, is what Blockify does with a match.
A Checkout access rule gives you two choices. Block stops the checkout and shows your message. Whitelist overrides your block rules, which is what you want for your own office or warehouse IP. Write the message shoppers see in Error message.
A Checkout fields rule always blocks. Pick a ready-made message from Quick preset or write your own in Message text, then use Position to choose where it appears in the checkout.
Note is a private reminder of why you created the rule. Your shoppers never see it.
The right side of the form shows a Rule summary of what you have set and a Preview of what the buyer sees. Click Save when it reads the way you want.
Turn on a built-in protection
Built-in protections at the bottom of the page are ready-made rules. Tick one and it starts working, with no values to fill in. They run alongside the rules you create yourself.
Protection | What it blocks |
|---|---|
Auto-block creating orders with a subtotal of 0 and matching last name with first name. | Checkouts worth $0 before shipping and tax where the first and last name are the same. Typical of card-testing bots. |
Auto-block creating orders with a subtotal of 0 and different first and last name. | Checkouts worth $0 where the names differ, which catches bots that randomise buyer names. |
Auto-tag and block high-risk customers at checkout | Shoppers from orders Fraud Filter flagged as high-risk. Blockify tags them |
Auto-block IP from high-risk orders at checkout | Every new checkout from the IP of an order Fraud Filter flagged as high-risk. Needs Fraud Filter on, and Shopify Plus. |
Block checkout from disposable or temporary email addresses | Checkouts entered with an address from a disposable provider such as 10minutemail or mailinator. Shopify Plus. |
Manage your rules
Everything you have set up sits in one table, grouped by the step it runs in: Checkout access first, then Checkout fields.
Column | What it tells you |
|---|---|
Status | The switch that turns the rule on and off, without deleting it |
Rule | What the rule matches on, with the value underneath |
Action | Block or Allow |
Note | Your private reminder, if you wrote one |
Source | Manual if you created it, or the order it came from if a protection created it for you |
Created at and Last updated | When the rule was added and last changed |
Use the search box to find a rule by IP, country or email, and the filter icon next to it to narrow the list further. Tick several rules to turn them on, turn them off or delete them together. The pencil and bin icons at the end of a row edit or delete that one rule.
Change the message buyers see
Default message shown to blocked buyers sits under Built-in protections. It is the message a shopper gets when a built-in protection or a rule without its own message stops them. It starts as "Order cannot be placed due to suspected fraud." and cannot be left blank.
A rule with its own message in the Error message field uses that one instead, so you can tell a blocked region apart from a blocked email when a shopper contacts you about it.
Keep your rules under the character limit
Shopify limits how much rule content Blockify's checkout check can hold, counted in characters. The Checkout fields step shows how much you have used, as a bar and as x / 10,000 characters.
Bar colour | What it means | What to do |
|---|---|---|
Green | You have room | Keep creating rules |
Amber | You are close to the limit | Review the rules you no longer use and delete them |
Red | You have reached the limit | Delete rules to free up space. Create rule stays unavailable until you do |
What the numbers at the top mean
The row at the top of the page sums up what your rules stopped over the period in the date picker next to Create rule.
Card | How it is counted | How to read it |
|---|---|---|
Total blocked orders | Checkout attempts a rule stopped, not completed orders | Fake checkouts caught before they became orders you would have to refund |
Block rate | The share of all checkout attempts in the period that were blocked | A sudden jump means an attack. A slow climb means your rules may be too strict |
Estimated savings | Cart value of the blocked checkouts that were never completed | The most you could have lost. It assumes every blocked checkout would have been fraud |
Who can use this feature?
- Checkout fields rules and the built-in protections: Enterprise plan and above.
- Checkout access rules, the Blockify - Checkout UI block, Auto-block IP from high-risk orders at checkout and Block checkout from disposable or temporary email addresses: stores on the Shopify Plus plan.
FAQs
- A shopper matched a rule but the order still went through. Why?
Check three things. The Block checkout rule is Active in Settings > Checkout > Checkout rules. The character counter on the Checkout fields step is not red. And for a Checkout access rule, the Blockify - Checkout UI block is on your checkout with Allow app to block checkout turned on, and the rule's Status switch is on.
- Does Block Checkout cancel or refund orders?
No. It stops the checkout before the order exists and shows your message. Orders that were already placed are handled by Fraud Filters.
- Do Checkout fields rules need the checkout block too?
No. Email, phone, name, address, zip code, customer tag and country rules work through the Block checkout rule in Settings > Checkout. Only Checkout access rules need the block, which is why that step is missing on stores that are not on Shopify Plus.
- Does the checkout block change how my checkout looks?
No. Shoppers do not see it. It only lets Blockify stop a checkout and show your message.
- Can I block abandoned checkouts?
No. Shopify does not allow apps to act on abandoned checkouts.
- Where do I see which checkouts were blocked?
In the numbers at the top of the page: Total blocked orders, Block rate and Estimated savings, for the period you pick. There is no per-rule counter.
- I turned a rule off. Does it still count against the character limit?
Yes. Delete a rule to free up its space.
Updated on: 04/11/2026
Thank you!