Shopify's native quantity limit resets with every new checkout. Place an order at the limit, complete it, start another — and the counter is back to zero. For limited drops, this is the single biggest gap in Shopify's order management. Resellers know it. Bots know it. Merchants often discover it the hard way, right after a drop sells out to a handful of buyers.
This piece explains what "per checkout" really means in practice, why Shopify's native limit works that way, which apps in the order-limits category offer per-customer rules, and how cross-order tracking actually works.
Already know you need per-customer limits and want the setup steps? Skip to the per-customer order limits guide for the configuration walkthrough. This piece is the conceptual explainer behind it.
The Problem: Shopify's Native Limit Resets Per Checkout
Shopify lets you set a per-variant add-to-cart limit (for inventory-tracked variants) — for example, "maximum 2 per order." That rule is attached to the variant and applied to the cart. As long as a single checkout has 2 or fewer of that item, the order proceeds. When the order completes, the customer can start a new checkout. The product still allows 2 per order. So they buy 2 more.
There is no built-in cross-checkout aggregation. Shopify's checkout layer has access to the current cart, the current customer (if logged in), and the products in the cart. It does not, by default, have access to "how many of this product has this customer bought in the last 30 days." That information lives in the orders table — which Shopify does not query during checkout validation.
This isn't a bug. Shopify's native limit was designed for inventory protection and high-volume safety: stop the cart from accepting 10,000 units at once. It was never designed as an anti-reseller feature.
What "Per Checkout" Means in Practice — A Reseller's Playbook
If you sell limited drops on Shopify with the native limit of "2 per order," here is the playbook a reseller runs:
- 9:59 AM — drop announced for 10:00 AM
- 10:00:00 — opens product page, adds 2 to cart, checks out, pays
- 10:00:45 — same browser, opens product page again, adds 2, checks out, pays
- 10:01:30 — third checkout, same drill
- 10:02:15 — fourth checkout
- 10:03:00 — fifth checkout
In three minutes, one person bought 10 units of a drop that was supposed to be "2 per customer." Same Shopify customer account. Same email. Same shipping address. Same credit card. The native limit fired correctly on each checkout — and let all five through. By the time the genuine fan refreshes their browser at 10:05, the drop is sold out.
It's a common frustration for merchants running sneaker drops, streetwear releases, and collectible launches: "I set 2 per customer, why did one customer buy 10?" The answer is that the rule said "2 per checkout," not "2 per customer."
What "Per Customer" Means — Tracking Across Orders
A per-customer limit caps the cumulative purchase total for a single shopper, across all their orders, over a configured time period. The rule is no longer "2 per checkout" — it's "2 per customer per drop" or "2 per customer ever" or "1 per customer per week."
For this to work, the app has to do three things Shopify's native limit doesn't:
- Identify the customer across multiple checkouts
- Maintain a ledger of how many units each customer has purchased over the configured period
- Validate against the ledger at every checkout — server-side, so direct checkout URLs and express checkouts hit the same check
This is the architectural difference between a per-checkout app and a per-customer app. It's also why older or simpler order-limit apps are per-cart only: they check the cart in front of them and never keep a customer ledger.
Which Shopify Apps Are Per-Checkout vs Per-Customer
Per-customer limits used to be rare. Today several order limit apps list them, often on paid plans. The breakdown, based on each app's Shopify App Store listing (checked October 12, 2026). OrderRules is our app; we haven't tested how each competitor identifies customers:
| App | Per-Customer Enforcement | Notes |
|---|---|---|
| OrderRules | Yes — at checkout via Shopify Functions | Keyed to Shopify Customer ID. Login required; guest checkout blocked while customer limits are on. |
| DC Customer Order Limits | Yes — lifetime, by quantity or spend | Lifetime purchase tracking on Pro ($14/mo). Free plan capped at 10 orders/month. |
| KOR Order Limits | Yes — per customer by duration (PRO plan) | Also customer-tag limits on PRO ($5.99/mo). |
| Avada Order Limits | Yes — "limit re-purchase order" (paid plans) | Day, month, year or lifetime; paid from $9.99/mo. |
| MinMaxify | No — per cart | Per-product and cart min/max — same gap as native. |
| MinCart | No — per cart | Cart-level rules, no customer ledger. |
| Pareto Order Limits | Yes — max quantity per customer | Day, month and lifetime limits from Basic ($8.99/mo); free plan has 100 block actions/month, up to 5 products. |
| LIMITER (MageComp) | Not listed | $3.99/mo or $39.99/yr, no free plan, only 4 reviews. |
See the full hub comparison of Shopify order limit apps for ratings, pricing, and use-case recommendations across all eight. For a head-to-head with another app built around cross-order customer limits, see OrderRules vs DC Customer Order Limits.
There is also a category of niche, single-purpose apps — Limit Once (Wandelic) and UR: Limit 1 Item Per Customer (UnReact) — that handle the per-customer rule type but only the per-customer rule type. They suit a simple one-per-customer rule. For anything more complex, you'll outgrow them.
The Three Ways Per-Customer Limits Are Identified
When an app says it enforces per-customer limits, the next question is: how does it know the customer? The answer determines how bypass-proof the rule is.
Shopify Customer ID — for logged-in shoppers, the customer ID is the strongest identifier. Clearing cookies, switching browsers, or using incognito mode doesn't change it. A customer who logs in is uniquely identified, and OrderRules' ledger keys off this ID.
Email address — for guest checkouts, some apps fall back to the email entered at checkout. A reseller running multiple guest checkouts on the same email gets caught. The bypass is using different emails per checkout — which is easy enough to be a real concern for adversarial drops.
Shipping address — even with different emails, repeat orders to the same shipping address are detectable, and some merchants review for this pattern ("10 fake email accounts, all shipping to the reseller's apartment") after the fact.
OrderRules takes the strictest route: customer limits require login, so guest checkout is blocked while they're on and every counted order is tied to a customer ID. That's the right call for adversarial use cases (sneaker drops, collectibles, scalper-bait products) — see the anti-scalping playbook for the full threat model.
Why Guest Checkout Breaks Per-Customer (and How to Fix It)
The most common source of "the per-customer limit didn't work" complaints is guest checkout abuse. A reseller using different email addresses on each guest checkout looks like a different person every time — unless the app forces login.
OrderRules forces login: while customer limits are on, guest checkout is blocked and the customer must sign in. The customer ID becomes the source of truth. This is the right setting for limited drops, exclusive collections, and any scenario where reseller arbitrage is the dominant threat. Because it applies store-wide, weigh it against checkout friction on a general-retail store.
If you're evaluating another per-customer app, ask how it handles guests: does it fall back to email, or require login? Per-cart apps don't track across orders at all, so guest checkout is irrelevant to them.
When Per-Checkout Is Actually OK
Not every limit needs to be per-customer. For some use cases, per-checkout is appropriate and per-customer is overkill:
- Inventory safety caps — "no more than 100 of this SKU in one order" to prevent accidental bulk orders. Per-checkout is the right rule — Shopify B2B catalogs can set a per-variant max for company buyers. (OrderRules product caps are different: a shared total across all shoppers per day, week, or month.)
- B2B case-pack quantities — "must order in multiples of 6" or "minimum 12 per SKU." Per-checkout is fine because the rule is about the order shape, not the customer history.
- Minimum order value for wholesale — "$500 minimum cart total." Per-checkout makes sense — the rule is on cart total, not per buyer. OrderRules doesn't set cart-total minimums; Shopify's Checkout Blocks app handles order value limits on every plan, for all customers or B2B only.
The decision point is whether the rule cares about who is buying or what is in the cart. If "who" matters, you need per-customer. If only "what" matters, per-checkout is sufficient.
Setting Up True Per-Customer Limits on OrderRules
The configuration steps are documented in the per-customer order limits guide, but the short version:
- Install OrderRules from the Shopify App Store
- Go to Customer Limits, turn on Enable per-customer limits, and click + Add Rule
- Pick the limit type — number of orders, total quantity, total spend, or total weight
- Pick the period — daily, weekly, monthly, yearly, rolling 30 days, or lifetime
- Confirm login is required — guest checkout is blocked while customer limits are on
- Test with a customer account — place one order at the limit, then try a second
The enforcement happens through Shopify Functions, which validates checkout server-side. Shop Pay, Apple Pay, Google Pay, and direct checkout URLs all hit the same validation — meaning there's no client-side bypass. POS sales, subscription renewals and order edits aren't validated, though they still count toward the limit. For the technical detail on how Shopify Functions checkout validation works, see how OrderRules uses checkout validation functions.
The Bottom Line
If your problem is "one person bought 10 of something I set to 2 per order," the issue isn't that your limit failed — it's that you set a per-checkout rule when you needed a per-customer rule. Shopify's native limit is per-checkout. Some order-limit apps are per-cart only. Pick one that tracks the customer across orders, and check how it identifies them.
For limited drops, anti-reseller setups, exclusive releases, and any product where fair distribution is part of the brand promise, per-customer is the rule type that matches the merchant intent. For everything else — inventory caps, B2B case packs, cart minimums — per-checkout is fine.
Want to see the full app-by-app breakdown? Read the Shopify order limit apps comparison hub. For a head-to-head with another per-customer app, see OrderRules vs DC Customer Order Limits. And for the broader anti-scalping framework that uses per-customer limits as one layer of defense, see the anti-scalping guide.