Why Bot Traffic Was Corrupting Your Shopify Ad Data — and How Converlay Fixed It

Server-side tracking solves a well-understood problem: ad blockers, iOS restrictions, and cookie expiry cause client-side pixels to miss conversions, so merchants under-report to their ad platforms and lose bidding signal. But there is a quieter problem on the other side of that equation. When a server-side tracking layer forwards events too faithfully, it can send data that should never have been sent at all — including events triggered by bots and automated crawlers that visit your store but will never make a purchase.

With Converlay v2.22.0, that silent data pollution ends. Bot requests are now detected and dropped at the moment they arrive at Converlay's event collection endpoint — before any quota is counted, before anything is written to the database, and before a single event is forwarded to Meta Conversions API, Google Analytics 4, TikTok Events API, or any of the other 26 destinations Converlay supports.

How Bots Were Corrupting Your Conversion Data

When a bot crawls a Shopify storefront, it loads pages. In many setups, loading a page triggers a PageView event, and sometimes also adds items to a cart or reaches a checkout page before stopping. If that pixel event is being collected server-side, the server has no way to know the session was a bot — it just sees an incoming event with a user-agent string that looks like a browser.

Those events then flow through the normal forwarding pipeline: they reach Meta Conversions API, they show up in GA4, they are counted in TikTok's Events Manager. The ad platforms treat these events as real signal. Their bidding algorithms incorporate them. Audience models are updated. And if a crawl happens to trigger a checkout event on an automated run, it gets logged as a purchase that never happened.

The practical effect ranges from subtle to significant depending on how much bot activity your store sees. At minimum, inflated page view and session counts cause ad platforms to over-estimate reach and under-estimate cost per real visit. At worst, phantom checkout and purchase events directly distort the conversion rate your campaigns are optimizing toward, causing platforms to bid less efficiently against real buyers.

What Changed in v2.22.0

Converlay now runs every incoming event request through bot detection before processing it. The detection uses isbot, a maintained open-source package that recognizes the user-agent strings of known crawlers, scrapers, monitoring tools, and automated browsers — including Googlebot, Bingbot, SEO crawlers, uptime monitors, and headless browser frameworks commonly used in automated testing.

When a request is identified as a bot, it is dropped immediately. The event never reaches the quota check, never writes a row to the database, and never enters the destination routing logic. From a data perspective, the bot visit does not exist.

There is one deliberate design choice worth understanding: bots still receive a 200 OK response. This is not a loophole — it is intentional. If the collection endpoint returned a non-2xx status, the storefront pixel would interpret it as a delivery failure and attempt to retry, generating additional requests. By acknowledging the request as delivered, Converlay stops the retry loop without any of the data consequences that would follow a retry chain.

The Fail-Open Safety Guarantee

One concern that comes up whenever bot filtering is discussed is false positives: what happens if a legitimate conversion event is incorrectly classified as a bot? The cost of a false positive — dropping a real purchase event — is higher than the cost of a false negative — forwarding one bot event.

Converlay's implementation accounts for this with a deliberate fail-open rule. If an incoming event has a missing or empty user-agent header, the bot check is bypassed and the event is treated as a real conversion. A missing user-agent is ambiguous: it could be an unusual bot, but it could equally be a real purchase from a browser or app that does not send a user-agent. Converlay errs on the side of forwarding it, because a missed real conversion is worse than a forwarded ambiguous one.

The filter only acts when there is enough information to be confident: a user-agent string that positively matches a known bot signature. In all other cases, the event flows through normally.

What This Means for Your Ad Platform Data

The most immediate effect is that your event counts in Meta Events Manager, GA4, TikTok Events Manager, and other destinations will be slightly lower — and more accurate. If your store receives significant crawler traffic (common for stores with large catalogs, frequently indexed products, or third-party SEO monitoring running against the storefront), the drop may be noticeable.

That reduction in volume is a feature, not a problem. Ad platform bidding algorithms perform better when the conversion signal they receive reflects real user behavior. An algorithm that has been trained on a data set containing bot-triggered events has been optimizing toward the wrong target. Removing that noise gives the algorithm a cleaner signal, which tends to improve cost-per-conversion over time as campaigns re-optimize against the cleaner data.

Match quality scores — visible in Meta's Events Manager as Event Match Quality (EMQ) and in GA4 as conversion modeling quality — may also improve. Bot events typically carry weaker identity signals (no click IDs, no authenticated user data) than real purchase events, so removing them raises the average quality of the events the platform receives.

No Configuration Required

Bot filtering is active automatically for all Converlay merchants starting with v2.22.0. There is nothing to enable, no threshold to configure, and no allowlist to manage. The isbot package that powers the detection is actively maintained and updated as new crawlers emerge, so the filter stays current without requiring any action on your part.

If you are curious whether bot filtering is affecting your event counts, you can compare the event volume in your Converlay dashboard against the numbers in each destination's reporting interface. The Converlay dashboard counts all events received (before filtering), while destination platforms will only show events that were actually forwarded (after filtering). Any difference between the two reflects traffic that Converlay determined should not reach your ad platforms.

Accurate Data Is the Foundation of Everything Else

Every other capability in a server-side tracking stack — match quality, event deduplication, consent enforcement, audience sync — depends on the underlying event data being accurate. Filtering bot traffic is a foundational fix that makes every downstream metric more trustworthy.

This is the kind of infrastructure improvement that does not always get a headline but has a compounding effect: cleaner data means better attribution, better attribution means better bidding, and better bidding means your ad spend works harder for every real buyer who visits your store.

Converlay connects your Shopify store to 26 destinations — including Meta, Google Analytics 4, TikTok, Pinterest, and more — via server-side event forwarding that bypasses ad blockers, iOS restrictions, and cookie expiry. Bot filtering is now part of that pipeline by default.

Install Converlay from the Shopify App Store and start forwarding cleaner, more accurate conversion data to your ad platforms today.