How to Stop Scalpers, Bots, and Resellers on Shopify (Anti-Scalping Guide 2026)

To stop scalpers and bots on Shopify, combine three checkout-level controls: strict login enforcement (no guest checkout), tight per-customer purchase limits (often 1–2 units), and Shopify Functions checkout validation that also runs on Shop Pay, Apple Pay, and other express checkouts. OrderRules ships all three in one feature (Pro plan and up). Limits are tracked by Shopify customer ID, so a buyer can't dodge them by switching emails at checkout.

This guide focuses specifically on the scalper, bot, and reseller threat — the adversarial side of per-customer enforcement. If you want a broader walkthrough of per-customer order limits for everyday use cases like fair distribution, handmade-shop fairness, or B2B account caps, the complete per-customer order limits guide is the canonical resource. And if you're trying to understand why your "2 per order" rule still let a reseller buy 10 units, start with Per-Checkout vs Per-Customer Limits on Shopify — that explainer covers the conceptual gap this entire guide depends on.

Scalping is a real problem for limited-product merchants. When a single buyer purchases 50 units of your limited sneaker drop or exclusive collectible, legitimate customers are locked out, and those units often end up resold at a markup on secondary markets. This guide explains how the adversarial threat model works on Shopify and how to configure OrderRules to defeat it.

Why Shopify Stores Are Vulnerable to Scalpers

Shopify has no native per-customer purchase limit feature. This creates three vulnerabilities that scalpers and resellers exploit:

No Built-In Per-Customer Tracking

Shopify's standard checkout doesn't track or limit purchases by individual customer. A reseller can place multiple orders under different identities, and Shopify's system treats each as independent. Your only option without an app is to manually monitor orders and cancel suspicious ones — a time-consuming, reactive approach.

Guest Checkout Allows Anonymous Purchases

By default, Shopify allows guest checkout without requiring account creation. A determined reseller can place 10 guest orders with 10 different email addresses and still avoid detection by any per-customer system that relies on email matching. That's why OrderRules requires login for customer limits.

Bot Activity Exploits Speed

Sophisticated scalpers use bots to place orders faster than humans can click. A bot programmed to buy 50 units of a new product release can complete the purchase in milliseconds, before even a single real customer has a chance to proceed to checkout.

The result: on a hot drop, a large share of your stock can end up with resellers and bots. This is the core reason why limited drops often feel impossible to manage on Shopify — you're fighting an asymmetric battle against automation.

How Per-Customer Purchase Limits Work

OrderRules enforces per-customer limits through two mechanisms: customer identification and server-side checkout validation.

Customer Identification Strategy

OrderRules tracks customers using two methods simultaneously to catch repeat buyers regardless of how they access checkout:

Shopify Customer ID (Logged-In Customers)

When a customer logs into their Shopify account before checkout, OrderRules reads the unique Shopify Customer ID from the checkout session. This ID is:

• Unforgeable — Tied to the customer's account; cannot be spoofed
• Persistent — Doesn't change if the customer clears cookies or uses incognito mode
• Consistent — The same ID on every order the account places

For a logged-in customer, changing email, using a VPN, or refreshing the browser doesn't reset the limit.

No Guest Checkout While Limits Are On

Email matching is easy to beat with a fresh address, so OrderRules doesn't rely on it. While customer limits are on, guest checkout is blocked and every buyer checks out on an account — so every counted order is tied to a Customer ID.

Time-Based Limit Periods

OrderRules supports six limit periods:

You can also combine limits by adding more than one rule. For example: "2 per day AND 5 per month" — both rules are checked at checkout.

Server-Side Enforcement via Shopify Functions

This is the technical detail that makes per-customer limits hard to dodge. OrderRules enforces limits through Shopify Functions, which run server-side within Shopify's own checkout infrastructure.

Unlike theme JavaScript (which a buyer can skip), Shopify Functions validate the cart when the buyer tries to complete checkout:

1. Customer adds items to cart
2. Customer proceeds to checkout
3. Shopify Functions validate the order against your per-customer limit
4. If the limit is exceeded, Shopify returns a validation error and the order is rejected
5. The customer sees your custom error message

This check isn't skipped by:

• Refreshing the page
• Disabling JavaScript
• Using VPNs or proxy services
• Express checkouts (Shop Pay, Apple Pay, Google Pay, PayPal) and Buy it now
• Running checkout bots through the storefront

The validation happens on Shopify's servers, not in the browser. Know the gaps, though: POS sales, subscription renewals, order edits and orders created through the Admin API aren't validated by Shopify Functions. And the check reads a snapshot of past orders, so two checkouts from the same account at the same moment can both pass.

Setting Up Anti-Scalping Rules in OrderRules

Here is the step-by-step process to configure per-customer limits for your store:

Step 1: Install OrderRules

1. Visit OrderRules on the Shopify App Store
2. Click Add app and authorize access
3. Complete installation in under 2 minutes

Step 2: Create a Per-Customer Limit Rule

In OrderRules, open Customer Limits:

1. Turn on Enable per-customer limits and save
2. Click + Add Rule
3. Set Limit Type to Total Quantity (units) and the Max Count (e.g., 1 unit per customer for a sneaker drop)
4. Choose the Period:
   • Lifetime for true one-per-customer items
   • Daily for recurring limited releases
   • Weekly for inventory with weekly refresh cycles

Step 3: Scope to Your Products

Decide what the limit applies to:

• Entire store — All products share one limit (rarely needed for anti-scalping)
• Specific collection — Products in that collection share the limit
• Individual product — Each product has its own independent limit

For a sneaker drop, create a collection called "Limited Drop" and scope the per-customer limit to that collection.

Step 4: Write Your Limit Message

When a customer hits the limit, they see your message at checkout. You edit it in Settings → Customer Limit Messages. Good examples:

"This item is limited to 1 per customer to ensure fair access for all customers. You have already purchased 1."

"Limited to 2 units per person on this exclusive release. Thanks for respecting the limit and letting other sneaker heads have a chance!"

"Our limited drops are one per customer to prevent scalping. If you need bulk quantities for a business, contact us at wholesale@yourbrand.com."

The third example is a best practice: acknowledge the rule's purpose and offer a manual workaround for legitimate bulk buyers.

Step 5: Confirm Login Enforcement

This is critical for preventing guest checkout workarounds. You don't need a separate switch: while customer limits are on, OrderRules blocks guest checkout. Make sure customer accounts are enabled in Shopify and sign-up is easy to find.

Customers must now log in to their Shopify account before checkout. This closes the trick of using multiple guest email addresses to circumvent the limit. Each Shopify account needs its own email, so a reseller who wants more has to register and log in to separate accounts, which is slower and easier to spot.

Important: Requiring login can cost you some checkouts from shoppers who don't want an account. For limited drops, that tradeoff is usually worth it.

Step 6: Test the Rule

Place two test orders from the same customer account:

1. Complete the first order successfully
2. Attempt a second order and verify that the limit message appears
3. Confirm the second order is blocked (not just warned)
4. Check that the limit resets at the expected time (if using daily/weekly limits)

Step 7: Activate and Monitor

Save the rule and watch the drop closely:

• Orders — Check your Shopify orders for buyers who place repeat orders across several accounts (same address, same payment method). That's how you spot resellers for manual review.
• Support messages — A spike in "I can't check out" emails often means the limit or login step is confusing. Adjust the message.
• Product hot spots — OrderRules Analytics shows top products and daily order trends. Use them to plan stock for the next drop.

Strict Login Enforcement — Blocking Guest Checkout

Requiring customer login is the most effective anti-scalping measure because it eliminates email spoofing as a workaround.

Why It Matters

Without login enforcement, a determined reseller can:

1. Place a guest order with email1@gmail.com (1 unit)
2. Place a guest order with email2@gmail.com (1 unit)
3. Place a guest order with email3@gmail.com (1 unit)
4. Repeat until they have 50 units

Email-based per-customer limits (the approach some apps take) catch casual resellers but not ones who can generate multiple email addresses.

With login enforcement, the same reseller needs a separate account for every extra order. That's slower and easier for you to spot.

How It Works

Login enforcement comes with customer limits — there's nothing extra to switch on:

1. Create a per-customer rule in OrderRules
2. Guest checkout is blocked store-wide while customer limits are on
3. Keep customer account sign-up open in Shopify (recommended — this converts guest browsers into accounts)

Shoppers who aren't logged in are asked to log in or create an account before checkout. Customers without an account can create one in 30 seconds.

Expected Impact on Conversion

Requiring login will cost you some checkouts. Shoppers who won't create an account drop off. For a limited drop, that's usually a fair trade for closing the guest-email workaround.

For limited drops specifically, most traffic is already highly engaged customers who expect to log in, so the impact is minimal.

Combining Purchase Limits with Other Controls

Per-customer limits are most effective when combined with other OrderRules features and general best practices:

Per-Customer Limit + Daily Order Cap

Set a per-customer limit (e.g., 1 unit per customer) AND a daily store limit (e.g., 50 orders per day total). This provides:

• Individual fairness — No one customer can corner the market
• Overall capacity control — Your fulfillment team can keep up with demand

For example, a limited sneaker drop might use: "1 per customer" + "100 total orders per day"

Per-Customer Limit + Store Hours

Combine per-customer limits with automated store hours to prevent overnight scalping bot activity:

• Set store hours to open only during business hours (e.g., 10am-6pm)
• Combine with a per-customer limit of 1 unit per day
• Online checkout is blocked outside your hours, for bots and humans alike

Per-Customer Limit + Holiday Calendar

The holiday calendar closes your store on the dates you pick, including public holidays you import. Per-customer limits don't change on a schedule, so for a seasonal drop, edit the rule yourself before and after:

• Base limit: 2 units per customer per month
• Holiday season: raise it to 5, then set it back in January

This keeps holiday drops fair without leaving a loose limit in place all year.

Storefront Messaging with Dynamic Variables

Use OrderRules' message placeholders to show each logged-in shopper what they have left on the product page:

"{remaining} {type_plural} remaining this {period} for you (limit {value})"

This transparency builds trust and discourages customers from attempting multiple orders.

See our full guide on creating limited drops on Shopify without chaos for advanced configuration patterns.

Example Setups

These are illustrative examples, not real merchants.

Limited Sneaker Drop (Streetwear Brand)

A streetwear brand running a 500-unit sneaker drop could set up OrderRules with:

• Per-customer limit: 1 unit per customer, lifetime
• Login enforcement: Required
• Daily cap: 500 orders per day (with one pair per order, that matches the stock)
• Message: "One pair per customer. We're limiting quantities to prevent reselling and ensure sneaker lovers get a fair shot."

The goal: up to 500 different buyers instead of a handful of resellers buying dozens of pairs each.

Handmade Artisan Collectibles (Designer Toys)

A designer toy maker creates 100 limited figures per month. A possible setup:

• Per-customer limit: 2 per customer per month
• Product scope: Limited collection only
• Login enforcement: Automatic (guest checkout is blocked while customer limits are on)
• Message: "Limited to 2 per month. We release new designs frequently; collecting one this month means more for other collectors next month."

The goal: at least 50 different collectors each month instead of a few bulk resellers.

Cannabis Dispensary (Legal Market)

A licensed dispensary may need to follow per-customer purchase limits set by local law (e.g., 1 oz per day in some places). A possible setup:

• Per-customer limit: 28.35 g (1 oz) total weight per customer per day (weight limits apply store-wide or per collection)
• Login enforcement: Required (regulatory requirement anyway)
• Store hours: Automated business hours
• Message: "Per state law, limit is 1 ounce per customer per day. Purchase resets tomorrow at midnight."

The goal: online orders that stay within the legal daily amount per account. Check your local rules and keep your own compliance process; an app setting isn't legal advice.

Frequently Asked Questions

Can customers bypass per-customer limits by using multiple email addresses?

Not at checkout — customer limits require login, so guest checkout is blocked and the email typed at checkout doesn't matter. The remaining gap is registering several separate accounts, each with its own email. That takes effort, and repeat shipping addresses or payment methods across accounts are easy to spot in your orders. Most casual resellers won't bother.

What if I accidentally set my limit too strict and customers complain?

You can adjust the limit in real-time. OrderRules recalculates based on existing purchase history:

• Raise the limit — Customers who were previously blocked can immediately place new orders
• Lower the limit — Customers who have already purchased more than the new limit cannot purchase again until the period resets

For a limited drop that sold out quickly, this is less of a concern. For ongoing products, test with a small limit first (e.g., 2 per customer) and adjust based on feedback.

How do I identify and manage legitimate wholesale buyers?

Per-customer limits block resellers, but sometimes you WANT certain customers to buy in bulk (e.g., a gift shop buying for resale). OrderRules applies the same per-customer limit to every logged-in customer — including Shopify B2B company buyers — and it can't exempt a buyer by customer tag. So keep bulk sales off the limited products:

1. Put the limit only on the drop products, and sell bulk or wholesale stock as separate products (or through a separate store) without that limit
2. Use Shopify B2B catalogs, available on all plans, to give approved buyers their own pricing and quantity rules on those bulk products

This keeps limits firm on the drop while approved bulk buyers purchase products the drop limit doesn't cover.

Do per-customer limits work with subscriptions?

Partly. The first subscription order goes through checkout, so it's checked like any other order. Renewal orders aren't blocked, because Shopify Functions don't run on them. But renewals still count toward the customer's usage. Size your limits with that in mind, or keep the drop products off subscription.

What if I use Shopify's draft orders or POS for manual sales?

OrderRules enforces limits through Shopify Functions. Draft orders are checked too, so an order for a customer at their limit is blocked there as well. POS sales aren't blocked, but they still count toward the customer's limit. If you need to sell past a limit for a good reason, such as a wholesale order or a customer who was blocked by mistake, ring it up in POS or raise the rule's limit for a moment.

Scalping Is Solvable

Per-customer purchase limits are one of the most effective tools against scalping and reselling on Shopify. Combined with strict login enforcement, they make it much harder for any one customer or bot to corner your limited inventory.

Whether you're running a sneaker drop, releasing limited collectibles, or managing a bakery's daily capacity, per-customer limits spread your stock across more buyers and protect your brand's reputation.

Try OrderRules free for 14 days — per-customer limits are on the Pro plan ($9.99/month). Set them up in minutes and stop scalpers at checkout.

For more strategies to control inventory and prevent fraud, see our guides on per-customer order limits, creating limited drops without chaos, and preventing overselling on Shopify.