Requiring sign-in at Shopify checkout, and what it does for blocking
Requiring sign-in is a blunt but free lever. It removes the guest checkout that most scripted order attempts use, and because every buyer is then a customer record, tag-based blocking applies to all of them instead of only the ones who happened to log in. The cost is friction for real first-time buyers, so it suits a wave, not a default.
What the setting is
In the Shopify admin, the customer accounts section of the checkout settings lets you choose whether accounts are optional or required at checkout; the exact wording changes between admin versions, but the required option is the one to look for. With it on, a buyer has to log in or create an account before reaching the payment step. The Help Center page on customer accounts covers how accounts sign in and what gets auto-filled at checkout.
What it changes for bot orders
Merchants on the Shopify Community describe order bots and card-testing scripts that submit checkouts as guests, in volume, with rotating details. Requiring an account puts a login or account-creation step in front of that, and the merchant reports in those threads are that the wave stopped or thinned out once guest checkout was off. Treat that as what it is: reports from merchants, not a guarantee. A determined script can create accounts; the point is that most do not bother.
What it changes for OrderGate
OrderGate's customer-tag rule matches a signed-in customer whose account carries the tag you name. A guest who types the same email is not a customer at that moment, so a tag rule cannot see them. With sign-in required, every buyer is signed in, and a tag you put on an account is honoured at every one of that person's checkouts.
Email, phone, name, street and location rules do not need sign-in; they read the checkout fields directly and work for guests and customers alike.
What it costs
Friction. A first-time buyer who has to create an account before paying is a first-time buyer who might not. How much that costs depends on your store, and the honest answer is to measure it: turn the setting on during a wave, watch checkout conversion in Shopify analytics for a week, and decide with the number in front of you.
A reasonable way to use it
- During a wave of unwanted orders, require sign-in and add an OrderGate rule for whatever the attempts share (a domain, a phone number, a street). The rule keeps working after you relax the setting.
- Tag the accounts you never want to see again, so a tag rule catches them even after they change email address.
- Once the wave passes, put accounts back to optional and keep the rules.