Articles on: [Shopify Platform] Blockify - Fraud IP Blocker

A complete guide: Fraud Filters

Overview

Fraud Filters helps you spot risky orders and decide what happens to them. Shopify checks every order for fraud and gives it a Fraud order score and an Order type (Low risk, Medium risk or High risk); Blockify adds what it knows about the IP address the order came from. You can review the list, act on one order at a time, or let Blockify cancel or flag high- and medium-risk orders for you. The switch and the automatic actions live under Fraud Filters in the sidebar; the order list lives under Analytics > Orders.

How to turn on Fraud Filters?

Step 1: Open the Blockify app and click Fraud Filters in the sidebar.

Step 2: Click Turn on. The first time, Blockify asks for permission to see your orders; approve it to continue.

From now on, new orders get a score as they come in and show up in the order list. The Risk-based actions card opens below the switch (see Automatic actions).

Important: If you later move to a plan that does not include Fraud Filters, Blockify turns the feature off for you. Orders already in the list stay there.

How risk scores work?

Field	Source	What it means
Fraud order score	Shopify	0 to 1. The closer to 1, the more likely the order is fraudulent.
Order type	Shopify	The score grouped into Low risk, Medium risk or High risk. Automatic actions use this tier.
Order from VPN/Proxy	Blockify	Yes or No: whether the order came through a VPN or proxy, a service that hides the shopper's real location. See The "Order from VPN/Proxy" field.
IP Risk Score	Blockify	How risky Blockify thinks the IP address is, from 0 to 100. It rates the connection, not the order.

A high-risk order is not always a VPN order, and a VPN order is not always high-risk, so look at the fields together.

Fraud order score starts at appears under Auto-block visitors placing fraud orders once that switch is on. Blockify blocks the IP address of new orders whose Fraud order score is at or above this value. It does not hide orders from the list, and Risk-based actions do not use it; they act on the Order type.

Note: Blockify does not score orders itself. If Shopify has not checked an order, it has no score and no Order type, and Blockify does nothing with it.

The fraud order list

Open Analytics > Orders. The summary shows Total order, Total high risk order, Total medium risk order and Total low risk order for the selected period. Each order below is a row with these columns:

Column	What it shows
Order	The order name, for example `#1100`. Click it to open the order details.
Created time	When the order was placed.
Order value	The order total in your store currency, as in Shopify.
Source	The sales channel or app the order came from, for example Online Store; Unknown when Shopify does not report one.
Fraud order score	Shopify's 0–1 score.
Order type	Low risk, Medium risk or High risk.
IP address	The IP address the order was placed from.
ISP	ISP (internet provider): the company that supplies that IP address, for example a home broadband or mobile provider.
IP Risk Score	How risky Blockify thinks that IP address is, 0–100.
Order from VPN/Proxy	Yes or No.
Action	The Block IP and Cancel order buttons (they read Blocked / Canceled once used) and the ... menu.

Note: ISP and IP Risk Score show Unknown and N/A for orders Blockify has not checked yet. Run Analyze old orders.

Copy an order name

Hover over a row to see the copy icon next to the order name and click it. You get the full name with #, the same as in Shopify; delete the # after pasting if you only need the number.

The order details window

Click an order name to open the Order details window inside Blockify. The copy icon next to the order name is always visible here. The left block shows Channel, Payment status (for example Paid, Pending, Authorized, Refunded, Voided, Canceled), Is VPN, Risk score and the payment gateway; the right block shows the customer's email, IP address, browser, device, country, province and city; below them is the Shipping address. Click Close to go back to the list. You can check the order without switching to Shopify.

The "Order from VPN/Proxy" field

Order from VPN/Proxy tells you whether the IP address an order was placed from belongs to a VPN or proxy service, so you have one more clue besides the score Shopify gives the order. It sits next to IP address, ISP and IP Risk Score in the list and shows one of two values:

Value	Meaning
Yes	The order came from an IP address that belongs to a VPN or proxy.
No	Blockify did not find a VPN or proxy behind the order's IP address.

Use the Order from VPN/Proxy filter under Manage filter to list only VPN orders, and combine it with Order type to find orders that are both high-risk and placed through a VPN.

Blockify checks the order's IP address (using the Proxycheck service) to fill in this value, while Fraud order score and Order type come from Shopify's own check of the order. Because they look at different things, the two do not always agree.

Case 1: A high-risk order is not necessarily a VPN/Proxy order

Shopify can rate an order High risk even when the customer is on a normal connection. Typical reasons:

Incorrect order information: customer or delivery details look inaccurate or inconsistent.
Payment issues: the card was declined or the payment attempt had problems.
Unusual shopping patterns: for example, many orders placed right after creating an account.
Linked to earlier fraud: the order shares details with orders already known to be fraud.

Case 2: A VPN/Proxy order is not necessarily high-risk

Plenty of real customers shop through a VPN, and Shopify may still rate their order Low risk. Common reasons:

Security and privacy: the customer uses a VPN for everyday privacy.
Country limits: the customer wants to reach websites or stores that are limited in their country.
Public Wi-Fi: the customer protects their connection in a café, hotel or airport.
Workplace or school networks: the customer gets around the limits on the internet where they work or study.
Hiding the IP address: the customer does not want websites and advertisers to follow them.

Tip: Treat Yes as one signal, not a verdict. A VPN order that is also High risk deserves a closer look before you ship; a VPN order with low scores is usually a normal customer.

How to find and filter orders?

The list has search, sort, a date range and filters. You can use them together, and Export downloads exactly what you narrowed the list to: see Export fraud orders.

Search: type an IP address or an order name in Searching by IP address, order.
Date range: pick a period with the date picker at the top of the page.
Sort: sort by Created time or Fraud order score, Ascending or Descending.
Tabs: the list has one tab, Order Analytics. While your store has no fraud orders yet, a second tab, Show data demo, fills the list with sample orders so you can see how it works.
Drill down from a total: click a number in the summary (for example Total high risk order) to open the list already filtered to that tier.

Click Manage filter to add filters. The most used ones also appear as shortcuts next to the search box.

Filter	Use it to
Per page	Choose how many orders each page shows.
Order type	Show Low risk, Medium risk and/or High risk orders.
Order from VPN/Proxy	Show orders where the value is Yes, No or Not Detected.
ISP	Show orders from one or more internet providers in your list.
IP Risk Score	Show orders whose IP address is a Low risk IP, High risk IP or Dangerous IP.
Risk score	Show orders with one or more exact Fraud order score values.
Action	Show orders already Blocked or Canceled.
IP address	Show every order placed from one or more IP addresses.
Country	Show orders from one or more countries.
City	Show orders from one or more cities.
Email	Show orders placed with the email you type.
Order value	Show orders whose value is Equal to, Greater than, Less than or Between the Min and Max you enter.

Each active filter shows as a tag above the list; click its x to remove it.

How to analyze old orders?

Orders placed before you turned Fraud Filters on, or before the ISP and IP Risk Score columns existed, are missing or show Unknown / N/A. Analyze old orders brings them in.

Step 1: In Analytics > Orders, click Analyze old orders at the top right.

Step 2: Enter The range for getting old orders (max 30 days) and confirm.

A banner shows the analysis is waiting to start, then "Analyzing past N days of orders" while it runs; you can leave the page. When it finishes, the banner reads Old order analysis completed and the orders appear with ISP and IP Risk Score filled in. If it fails, click Try again or contact support.

Note: Analyzing old orders only adds them to the list. Blockify does not go back and cancel or flag orders that were already placed.

How to act on a single order?

Every row has two buttons in the Action column, Block IP and Cancel order, plus a ... menu with Mark as legit and Mark as fraud. You do these by hand: Blockify does exactly what you click, nothing more.

Action	What it does
Block IP	Adds the order's IP address to Block & Re-director > Blacklist as a Block rule, so that IP address cannot visit your store again. The button then reads Blocked.
Cancel order	Cancels the order in Shopify, using the cancellation options you set in Risk-based actions. The button then reads Canceled.
Mark as legit	Opens a confirmation where you record that the order is genuine (optionally with a reason). A Legit badge appears next to the order name.
Mark as fraud	The same, for an order you have confirmed as fraud. A Fraud badge appears next to the order name.

Tip: Block IP stops future visits, not the current order. To stop the order as well, cancel it too.

Automatic actions

Under Fraud Filters > Risk-based actions you can tell Blockify to Cancel order automatically or Flag order per tier (High-risk orders and Medium-risk orders), choose the cancellation options and get an email each time Blockify takes one of these actions: see Configure risk-based actions for fraud orders. Auto-block visitors placing fraud orders adds the IP address of every new high-risk order to your Blacklist, and Stop repeated checkout attempts stops many checkouts in a row that reuse the same details. You set daily reports and instant alerts in Settings > General settings > Notifications: see Configure fraud order email notifications.

Export fraud orders

You can download the fraud order list as a CSV file to review it offline or share it with your team. The export uses your current filters, and you choose between every matching order or only the page in front of you.

Step 1: Open Analytics > Orders.

Step 2: (Optional) Narrow the list with the search box or Manage filter — for example Order type, Risk score, IP address or a date range. Skip this step to export everything.

Step 3: Click the Export icon at the top right of the list.

Step 4: Pick one of the two options. Both use your current filters and show how many orders the file will have.

Option	What it exports	Use it when
Export filtered results (X orders)	Every order matching your current filters, across all pages. With no filters, your whole fraud order list.	You have narrowed the list (for example, only High risk orders, or one IP address) and want all of them.
Export current page (X orders)	Only the filtered orders shown on the page you are viewing.	You just need what is on screen.

Your browser downloads the CSV file.

Note: If the list is empty, or your filters return no orders, the Export icon is disabled and shows No orders to export.

Who can use this feature?

Fraud order list and Shopify scores: available on all plans, including Free.
Export of the fraud order list: available on all plans, including Free.
Order from VPN/Proxy, ISP and IP Risk Score columns: available on the Premium plan and above.
Risk-based actions and Auto-block visitors placing fraud orders: available on the Enterprise plan and above.

FAQs

Does Blockify detect fraud on its own?

No. The Fraud order score and Order type come from Shopify's own fraud check. Blockify adds what it knows about the IP address (Order from VPN/Proxy, ISP, IP Risk Score) and lets you act on the result.

Why does an order show Unknown for ISP, N/A for IP Risk Score, or an empty Order from VPN/Proxy column?

It was placed before you turned Fraud Filters on, or before you upgraded to a plan that includes them, so Blockify did not check it. Run Analyze old orders to fill them in for orders from the last 30 days.

Does Blockify cancel orders placed through a VPN?

No. The Order from VPN/Proxy column is for your information only; automatic actions in Risk-based actions follow Shopify's Order type, not this column. To stop VPN visitors before they place an order, use the Proxy and VPN blocker in Settings > Risk Mitigator.

I cancelled an order by mistake. Can I get it back?

Yes. Blockify cancels the order in Shopify, and you can restore it from the order page in your Shopify admin.

Does Mark as fraud cancel the order?

No. Mark as legit and Mark as fraud only save your decision and add a badge in the list. To stop the order, click Cancel order; to keep that IP address out of your store, click Block IP.

The list is empty and the Export icon is greyed out even though Fraud Filters is on. Why?

Only orders Shopify has checked appear. Widen the date range or clear your filters, or run Analyze old orders. Export becomes active as soon as the list has orders.

Updated on: 16/10/2026

Was this article helpful?

Thank you!