How to block a customer on Shopify (and why the native options don't hold)

Every few weeks someone asks the Shopify Community the same question. A customer leaves one-star reviews, files chargebacks, or orders the trial kit for the fourth time, and keeps buying. Here is one version, from a thread that has been running for years:

"Problematic customer means a customer that has problem with products and leaves poor reviews that damage my business... but still returns to buy again & again. I want to stop this person from making purchases."

The honest answer is that Shopify has no block button. There are four things that look like one. Each stops working the moment the buyer checks out as a guest with a fresh email. This post goes through what each option does, why guest checkout defeats it, and what a block that holds actually looks like.

What Shopify lets you do today: disable the account, cancel the order, Fraud Filter

Delete or disable the customer record. In the Shopify admin you can delete a customer, and on stores still using classic customer accounts you can disable the account so the login stops working. Neither one touches checkout. Checkout does not require an account. The same person types their email into the guest form and the order goes through. Shopify then creates a brand new customer record for them.

Cancel the order. You can cancel any order after it is placed, refund it, and restock. This is a manual step every time, it happens after your payment processor has already charged a fee, and it does nothing about the next order.

Fraud Filter. Shopify's free Fraud Filter app lets you write rules on order fields: email, IP address, shipping address, name, and a few others. A matching order can be flagged or cancelled automatically. It runs after the order exists, so the buyer still gets an order confirmation and you still pay the processing fee on the cancel. It matches on exact strings, so [email protected] and [email protected] are two different people to it, and so are 123 Main St Apt 4B and 123 Main Street #4B.

Shopify Flow. Flow can tag an order or customer, add a note, hold fulfillment, or cancel, based on conditions you write. It has the same two limits as Fraud Filter: it fires after the order is placed, and it matches on the fields the buyer typed.

Shopify Protect does not belong on this list, but it comes up. It covers you against fraud chargebacks on eligible Shop Pay orders. It does not block anyone.

None of these is a bad tool. They are the wrong layer. The customer you want to block has a shipping address, a phone, a device, and a habit of ordering the same products. Their email is the one thing that changes.

Why a blocked customer comes back in guest checkout with a new email

Shopify's identity model is the email address. The discount limit "one use per customer" checks the email. The "specific customers" eligibility on a discount checks the login. Fraud Filter matches the email string you typed into the rule. Delete the account and the email is free again.

Guest checkout is the default on most stores because forcing a login costs conversion. It also means the buyer is never asked to prove they are the same person as last time. A new Gmail address takes thirty seconds. A plus-alias like [email protected] takes five. The Gmail dot trick, [email protected], takes none, because Gmail delivers it to the same inbox while Shopify treats it as a new customer.

An experienced merchant in the same Community thread put the technical side plainly:

"Do not treat frontend customizations as a reliable solution for this problem. Savvy users could bypass frontend blocks using AJAX APIs or permalinks. YOU MUST have validation on the backend."

That rules out the other popular workaround: a theme snippet that hides the checkout button when a customer tag is present. Tags only exist on logged-in customers, and anyone can add to cart and reach checkout through a permalink without touching your theme at all.

So the two requirements for a block that holds are: it has to match the person rather than the email, and it has to run on the server inside checkout, before the order exists.

Block by identity, not by email: phone, address, device, visitor cookie

This is what OfferGuard does. Every checkout on a protected product is compared against your order history on up to seven signals, server-side, through Shopify's Checkout Extensions API, in under 100ms:

• Email, normalized. Dots stripped and plus-aliases removed for Gmail, googlemail.com folded into gmail.com, disposable domains rejected outright.
• Phone, reduced to digits and matched on the last ten.
• Shipping address, canonicalized so abbreviations, unit designators, and ZIP+4 suffixes do not create a false new address.
• Billing address, matched independently against both the shipping and billing addresses of past orders.
• IP address.
• Device signature, collected by a web pixel from the first page view, so it exists before the buyer reaches checkout and survives a logout.
• Visitor cookie, a 365-day first-party cookie that is stored against each completed order.

A rule sets a cap per signal: how many completed purchases of the protected product a single email, phone, address, IP, device, or visitor cookie is allowed. Set the caps to one and the rule reads as "one per person, ever." The buyer who comes back with a new email still has the same phone number, the same door, and usually the same device. Two matching signals is enough to fail the check.

One thing to say plainly: OfferGuard rules are attached to products, variants, collections, or selling plans. There is no "block this person from buying anything in the store" switch today. In practice the problem customer is almost always ordering the same few things, and a rule on those products with lifetime caps of one catches them on every new email they try. Here is how to set that up.

Block repeat purchases of specific products

Create a checkout rule and pick the products the problem buyer keeps ordering. The "One per customer" template sets one purchase per email and one per shipping address. Add caps of one for phone, device, and visitor cookie. Set the action to Block.

When someone who has already bought those products reaches checkout, the check runs, two or more signals match their earlier orders, and checkout stops with the message you wrote. Nothing is charged, no order is created, no fee is paid. They can still buy anything else in your store. The customer-facing message is yours to write. Most merchants say something like "This item is limited to one per household" rather than anything that sounds like an accusation.

If you would rather they simply pay full price, use the same rule with a reward attached instead of a block. New buyers get the offer applied automatically. Returning buyers are allowed through at list price.

Hold or cancel the order automatically after checkout

Post-purchase rules run when the order is created. The "Hold for review" template pauses fulfillment on any order that matched a checkout rule, adds an order tag and a customer tag, writes a note listing which signals matched, and can notify you. You look at it, and either release it or cancel it.

If you want no human in the loop, the same rule can cancel the order outright, void or refund the payment, and restock the items. Post-purchase rules can also create a Shopify risk assessment on the order so it shows as high risk in the admin, which matters if you use Shopify's own risk views for anything.

For a buyer who has caused chargebacks, post-purchase rules can also match on payment details: the same card appearing under several emails, or an AVS or CVV result you do not accept.

Warn instead of block

Sometimes the right answer is not a hard stop. The "Soft warning" template lets the order through but shows the buyer a message, tags the order, and logs the match. Use it when you are not yet sure who you are dealing with, or for a product where a false block would cost more than a repeat purchase.

There is also a quiet version. Turn off the customer-facing message and the rule still tags, holds, and scores the order without the buyer seeing anything. That is useful for the reviewer who leaves one-star ratings: you do not want to confront them at checkout, you want their order held until someone looks at it.

Can you block an IP address on Shopify?

Not natively. Shopify has no IP blocklist for the storefront or checkout. Fraud Filter can flag or cancel an order after the fact if the IP matches a rule. A few theme-level apps hide the storefront from listed IPs, which is a frontend block and fails the test above.

IP is also a weak signal on its own. A household behind one router, a whole office, or a mobile carrier's shared address space can all present the same IP. A VPN gives a new one in seconds. OfferGuard records IP and lets you cap purchases per IP, and it is useful when it agrees with a phone or address match. On its own it should warn, not block.

FAQ: does deleting a customer account block them?

Does deleting a customer account on Shopify block them? No. Deleting the record removes their order history from the customer view and frees the email. The same person can check out as a guest immediately, and Shopify creates a new customer for them.

Can you block a customer on Shopify from ordering? Not with a built-in setting. Fraud Filter and Flow can cancel matching orders after they are placed. Blocking before the order exists requires a checkout app that runs server-side and matches on more than the email.

Can OfferGuard block one person from buying anything at all? Not yet. Rules attach to products, variants, collections, or selling plans. A rule on the products the buyer keeps ordering, with lifetime caps of one across email, phone, address, device, and visitor cookie, is the closest configuration and catches the repeat pattern in practice.

Will this block legitimate customers who share an address or device? It can, which is why the action is yours to choose. Blocking needs two or more signals to agree, and a warn or hold action lets a human decide when one household legitimately has two buyers.

Does it work if they never log in? Yes. Every signal except the account itself is collected in guest checkout, and the device signature and visitor cookie are set before checkout begins.

Related: how to block a product at checkout based on purchase history, the guest checkout security trade-off, pattern 7 on the solutions page, and the full list of checkout rules and actions.