OrderGate FAQ: plans, what buyers see, and what it cannot do
OrderGate runs merchant-defined rules inside Shopify's checkout validation, so a matching checkout is refused and no order is created. It matches what checkout actually has: email, phone, name, street address, delivery location and customer tags. It cannot see IP addresses, does not detect bots, and is not a card-testing defence.
Does OrderGate work on the Basic plan?
Yes. OrderGate is a public app built on Shopify's checkout validation function, which runs on every plan: Basic, Shopify, Advanced and Plus. Nothing in it depends on Plus-only checkout customisation.
Is there a free plan?
Yes. The Free plan runs up to five rules at a time, every rule type, in log-only or enforce mode, with your own rejection messages. Standard is $9 a month after a 7-day free trial and adds up to 1,500 rules and hiding cash on delivery from matching buyers. You can move between the two from inside the app; your rules stay saved either way.
What does a blocked buyer see?
Your message, shown next to the checkout field that triggered the rule: the email box for an email rule, the phone box for a phone rule, the address line or country for a location rule. The checkout does not complete. No order and no payment authorisation is created, so there is nothing to cancel, refund or restock.
I am worried about blocking real customers.
Start in log-only mode, which is the default. The first scan covers your last seven days of orders and reports exactly which of them the current rules would have blocked, by rule type; after that each day adds the newest orders. Switch to enforce when the report looks right. The rule tester on the dashboard also tells you which rule a sample email would hit.
Does it work with Shop Pay, Apple Pay and Google Pay?
Yes: validation runs on accelerated checkouts too, and a matching buyer cannot complete the purchase. One platform limit is worth knowing. Inside a wallet sheet Shopify does not display the rejection text, so the buyer is returned to checkout without your message; the block itself holds.
Can I block entire countries, states or cities?
Yes, by delivery address rather than IP address. A location rule takes country codes and can be narrowed to state or province codes, cities and postal-code prefixes. Because it checks where the order would actually ship, not where the buyer's network says they are, a VPN does not get around it.
Can I block IP addresses?
No, and be careful with apps that promise it. Shopify's checkout validation input contains no IP address and functions have no network access, so nothing evaluated inside checkout can act on one. IP-based tools work in the storefront layer, which a script talking to checkout directly never touches, or after the order is placed. OrderGate blocks before the order exists, with the data checkout actually has.
What about someone who keeps coming back with a new email address?
That is what the phone, name and street-address rules are for. A new mailbox takes ten seconds; the phone number, the name on the parcel and the doorstep usually stay the same. Phone rules ignore spacing, dashes and the country code, name rules ignore case and extra spaces, and a street rule matches when the checkout address line contains the text you give it.
Does it stop bot checkouts?
OrderGate does not guess who is a bot. It blocks what bots tend to use: disposable email domains, generated address patterns such as firstname.lastname123@…, and the same phone number or street across many attempts. Large-scale bot mitigation happens on Shopify's own platform layer on every store, and at the edge in front of your storefront.
Does it stop card-testing attacks?
Mostly no, and our guide on card testing says so at length. A card-testing script rotates every field a rule could match. Shopify's own fraud analysis and your payment provider's controls do the bulk of that work. When a wave gets through and you can see a pattern in the attempts, one wildcard or domain rule stops that pattern in minutes, and because the checkout is refused, no payment attempt runs. The abandoned-checkout entries still appear: OrderGate prevents the damage, not the noise.
Will this clean up my visitor statistics?
No, and no checkout app can. Shopify filters bot sessions from analytics itself. OrderGate's job is the other bot problem: the ones trying to order.
What data does OrderGate access?
The checkout fields your rules match on (email, phone, name, delivery address) are read inside Shopify's checkout runtime and never leave it. The log-only report reads your recent orders through the Admin API, counts them and keeps only the counts. Your rules live in your own shop's metafields. A checkout-funnel pixel sends anonymous event names (checkout started, payment submitted, completed) with no buyer data, so the dashboard can show approximate totals.
How do I cancel?
From the plan card on the dashboard, in one click. Billing stops immediately, the unused part of the month is refunded by Shopify, and the app continues on the Free plan with your rules intact.