Shopify guide · Hosted e-commerce

Marech for Shopify Stores

See which AI bots are scraping your product descriptions and prices — and block them for real if your store runs on a custom domain.

PlatformHosted e-commerceSetup~3 minutesBlockingSupported

How Marech protects a Shopify site

Shopify is fully hosted, so the snippet alone monitors your storefront — product pages, collections, and all. If your store is on a custom domain (not *.myshopify.com), you can also route it through Cloudflare and block scrapers at the edge, before they ever reach Shopify.

Mode 1

Monitoring — the snippet

One line of JavaScript in your <head>. It reports scraper traffic to your dashboard and overlays JS-running bots. Works on Shopify in ~3 minutes.

Mode 2

Blocking — the edge check

A server-side check (a Cloudflare Worker on your custom domain) returns a 403 to scrapers before your content is served — the only thing that stops non-JS scrapers.

Before you begin

You'll need a couple of things ready. The monitoring step needs only the first two.

A Marech account — start a free trial (no credit card).
Access to edit your Shopify site's theme, settings, or code.

Install the monitoring snippet

One line of JavaScript that reports scraper traffic to your dashboard. Works on every Shopify plan and takes about ~3 minutes.

Shopify → Online Store → Themes → Edit code → theme.liquid

Copy your Marech snippet

Go to Online Store → Themes

In your Shopify admin panel, navigate to Online Store, then click Themes.

Click the three dots → Edit code

Next to your active theme, click the three-dot menu and select Edit code.

Open theme.liquid

In the Layout folder, click on theme.liquid to open the main template file.

Paste the snippet inside <head>

Find the closing </head> tag and paste your Marech snippet just before it.

Save

Click Save. Monitoring is now active across your storefront and traffic starts appearing in your dashboard.

Verify monitoring is live

Visit a product page in a normal browser and watch it appear in the dashboard traffic feed. Because theme.liquid wraps every storefront page, one paste covers your whole store — no need to edit individual templates.

Monitoring vs. blocking — the honest version

The snippet above reports traffic and overlays JS-running bots — but non-JS scrapers (curl, python-requests, GPTBot…) download your HTML directly and never run it, so it can't block those. Shopify is fully hosted, so the snippet alone can only monitor. If your store uses a custom domain (not *.myshopify.com), you can get real blocking by routing that domain through Cloudflare and running the BlockMe Worker at the edge. Full details in the integration guide.

Turn on real blocking (optional)

Stops non-JS scrapers before your content is served, using a Cloudflare Worker on your custom domain. Needs a Marech API key and a block policy.

Route your custom domain through Cloudflare

Add your store's custom domain to Cloudflare and set the DNS records that point at Shopify to Proxied (orange cloud). This only works on a custom domain — not a *.myshopify.com address.

Create an API key and a block policy

In the Marech dashboard, create an API key (shown once — copy it) and add a block policy (e.g. bot types scraper and ai_tool).

Deploy the BlockMe Cloudflare Worker

Follow the Shopify integration guide to deploy the Worker with your API key and API URL, routed to your store domain. It checks each request before it reaches Shopify and returns a 403 to scrapers (failing open on any outage).

Optional: add robots.txt.liquid

Add the provided robots.txt.liquid template to also ask well-behaved AI crawlers (GPTBot, ClaudeBot…) not to crawl. It won't stop a determined scraper, but the major crawlers honor it.

Verify it's blocking. Once the Worker is live on your custom domain, a fake GPTBot request returns a 403 while a real browser loads your storefront normally.

verify blocking

curl -A "GPTBot/1.0" -I https://yourstore.com/

Troubleshooting & FAQ

I'm on a myshopify.com address — can I block?

Not at the edge. Blocking needs a checkpoint in front of Shopify, which requires a custom domain you can route through Cloudflare. On a *.myshopify.com URL you get monitoring only. Connecting a custom domain (which most stores do anyway) unlocks blocking.

Does this work with the checkout pages?

The snippet covers storefront pages rendered by your theme. Shopify's checkout is served on its own hardened infrastructure and isn't something Marech (or any theme code) hooks into — which is fine, since scrapers target your public product and content pages, not checkout.

Does the snippet slow down my site?

No. The script is tiny and loads asynchronously, so it never blocks your page from rendering. Server-side blocking adds a single fast check in front of your origin and fails open, so it can't slow down or take down your site.

Will it block real visitors or hurt SEO?

No. Marech targets automated scrapers, not people, and search engines you care about are allowed by default — you decide exactly what gets blocked with policies. See how detection works.

Next steps

How detection works

The signals Marech uses to tell scrapers from real visitors.

All platform guides

Compare setup and blocking support across every platform.

Write a block policy

Decide exactly which bots get stopped and where.

Plans & pricing

Free 7-day trial, then pick the plan that fits your traffic.

Ready to protect your Shopify site?

Free 7-day trial. No credit card required.