Storefront Sentry Documentation

Setup, configuration, behavior, compatibility, and troubleshooting for Storefront Sentry. Use this page to understand what each protection changes, how the pieces fit together, and what to check when something does not behave as expected.

Setup & configuration Protection reference Troubleshooting

Getting Started

Storefront Sentry has three relevant parts: the app embed that runs on your website, the in-app settings that enable the protections, and the Shopify checkout validation rule used by Storefront Guard. Understanding how those pieces relate is more important than memorizing a setup checklist.

App embed Runs on the live storefront and prepares normal customer sessions for the protections you enable.

In-app settings Control which Sentry protections are active and how the app should treat storefront traffic.

Shopify checkout rule Used by Storefront Guard to enforce checkout validation once the storefront side is ready.

Do not enable the Shopify checkout rule by itself. If the Storefront Sentry app embed and Storefront Guard are not ready first, legitimate checkout attempts can be blocked.

Protection Overview

Sentry protects different parts of the shopper journey. The controls are intentionally separate because blocking unwanted traffic, controlling storefront interactions, and validating a shopping session at cart and checkout solve different problems.

Access Controls

Restrict unwanted traffic before it moves deeper into the store. This is where VPN, proxy, Tor, regional, and other traffic-based controls belong.

Interaction Controls

Limit unwanted behavior while a visitor is browsing, including common copying, right-click, and source-scraping behavior.

Storefront Guard

Validate the shopping session again around cart and checkout so automated or nonstandard attempts can be stopped before they become an order.

Access Controls

Access Controls are traffic-level decisions. They are useful when a connection characteristic is genuinely relevant to the abuse you are dealing with. They are intentionally blunt controls, so the important question is not only whether they can block traffic, but whether that tradeoff makes sense for your store.

VPN, proxy, and Tor controls

These controls deny storefront traffic that Sentry identifies as coming through the selected anonymous or relayed network types. They are most useful when that infrastructure is repeatedly showing up in the abuse you are trying to stop.

Use it when

Card testing or automated abuse repeatedly arrives through VPN, proxy, Tor, or hosted network traffic.
Your store has little legitimate customer traffic from those connection types.
You are responding to an active attack and want to reduce the anonymous paths reaching the storefront.

Be careful when

Corporate customers commonly browse behind company VPNs.
Your audience is unusually privacy-conscious or technically inclined.
Staff, agencies, or partners routinely access the storefront through hosted or relayed networks.

Shopper experience

A shopper whose connection matches a blocked network type can be denied before moving farther into the store. A real customer using a VPN can therefore be affected even when nothing else about the session is suspicious.

What it does not mean

A VPN, proxy, or Tor connection is not proof of fraud. This is an access policy, not a fraud verdict.

After enabling

Watch the resulting blocked activity and test the storefront from the kinds of networks your real customers use. If legitimate traffic matters more than the signal, loosen the access rule rather than assuming every block is desirable.

Country restrictions

Country restrictions allow you to deny traffic from regions you choose. They make the most sense when the store already has a real business reason not to accept that traffic.

Use it when

You do not sell, ship, or provide service to the region anyway.
Legal, licensing, or operational requirements make traffic from that region unusable to the business.
A sustained attack is concentrated in a region that has no legitimate value to the store.

Be careful when

You have international customers or customers who regularly travel.
Your shipping footprint is broader than your recent order history suggests.
You are reacting to one suspicious order rather than a real pattern.

What it solves

It removes traffic from regions you have decided not to serve. That can reduce attack surface when the restriction matches the way the business already operates.

What it does not solve

Country blocking is coarse. It does not distinguish a legitimate customer from an attacker inside the same region, and it should not be treated as a substitute for Storefront Guard or order review.

After enabling

Compare the restriction against your real fulfillment area and support channels. If you enable several Access Controls at once, diagnosing an unexpected block becomes much harder.

Interaction Controls

Interaction Controls add friction to common browser actions used for casual copying and low-effort scraping. They protect storefront content and interactions; they are not a checkout-fraud system and they do not make browser-delivered content impossible to retrieve.

Content and browser interaction protection

Use it when

Product images or written content are being casually copied from the storefront.
Right-click or common browser interactions are part of low-effort abuse you want to discourage.
You want to raise the effort required for ordinary scraping without changing checkout behavior.

Be careful when

Your theme or another app depends on an interaction you are restricting.
Customers rely on browser accessibility or assistive workflows that the control interferes with.
You are expecting the control to stop determined scraping or protect information that must remain secret.

What it helps with

Low-effort copying, unwanted right-click behavior, and common browser-based extraction where adding friction is useful.

What it does not do

It is not DRM. Content delivered to a browser can still be inspected by a determined user. Interaction Controls should be treated as friction, not as a guarantee that storefront content cannot be copied.

After enabling

Test the storefront on desktop and mobile using the interactions real customers need. If the control gets in the way of legitimate shopping, turn that specific interaction control off.

Storefront Guard

Storefront Guard connects the storefront side of Sentry with Shopify checkout validation. It is the protection to use when the problem has reached cart or checkout and you need more than traffic filtering alone.

Use it when

Card testing, direct checkout bots, scalpers, or other automated checkout abuse is reaching the store.
You need to validate the shopping session again around cart and checkout instead of relying only on storefront traffic controls.
You want checkout attempts that do not satisfy the storefront protection to be stopped before they become orders.

Pause before enabling when

The storefront is headless.
Shop App is important and you plan to use Aggressive mode.
Draft-order checkout is part of normal operations and the bypass has not been configured.
A cart, bundle, subscription, or product-options app materially changes how customers reach checkout and has not been tested.

How to think about Guard: the app embed prepares the normal storefront session, the in-app Guard setting turns the protection on, and Shopify's checkout rule enforces the decision at checkout. The checkout rule can remain active even when the storefront side is not ready, which is why enablement order matters.

Safe enablement order

1.Enable the Storefront Sentry app embed on the live theme.
2.Enable Storefront Guard inside the app.
3.Enable the Storefront Sentry checkout validation rule in Shopify.
4.Run a normal checkout from the live storefront and confirm the path works as expected.

Normal shopper

On a standard Shopify storefront that is configured correctly, most legitimate shoppers should not see an extra step. Guard works in the background until a session fails the protection.

Draft orders

Draft-order checkout links do not always follow the normal storefront path. Configure the draft-order bypass before relying on Guard if draft orders are part of your workflow.

Shop App

Shop App does not behave exactly like a customer browsing the Online Store. Aggressive mode is not compatible with Shop App checkout behavior, so leave Aggressive mode off when Shop App matters unless you have tested the exact flow.

Headless

Standard Storefront Guard is not intended for headless storefronts because the normal Online Store flow is not present. Do not enable the Shopify checkout rule expecting the standard Guard setup to prepare headless sessions.

Third-party cart apps

Apps that replace or heavily modify product forms, carts, subscriptions, bundles, cart drawers, or checkout handoff can change the path Guard expects. Test every important path before leaving Guard enabled for live traffic.

After enabling

Run a normal live checkout, then test the alternative flows your store actually uses. Recheck Guard after publishing a new theme or adding something that changes cart or checkout behavior.

If checkout breaks, restore checkout first. Disable the Storefront Sentry checkout validation rule in Shopify, verify the app embed and Guard configuration, test the live storefront, and only then turn the checkout rule back on.

Activity & Logging

Traffic Logging is optional. It does not make the protections stronger or change a protection decision; it gives you a history of Sentry activity so you can understand what happened after the fact.

When to use Traffic Logging

Investigating abuse

Turn it on when you need to see whether the same behavior is repeating, changing, or moving between protections.

After changing a setting

Use the activity history to confirm that the new setting is affecting the traffic you expected without creating a new legitimate-customer problem.

Customer reports a block

Look at the event around the reported time to see which protection fired and whether the block was isolated or part of a larger pattern.

How to read activity

Blocked

A protection stopped the request. Check which protection made the decision and whether similar events are repeating.

Allowed

The request passed the protections that were active at that moment. It is not a statement that the customer or eventual order is safe.

Repeated events

A cluster of similar attempts is usually more useful than one event by itself. Read the pattern, not just the individual line.

Activity is context, not a fraud verdict. Use it to understand what Sentry did and why. Shopify fraud analysis and your own order review answer a different question after an order exists.

Compatibility

Storefront Sentry is designed around Shopify's standard Online Store flow. The table below covers the cases most likely to need extra attention.

Environment	What to know	Recommended action
Standard Shopify theme	Supported when the Storefront Sentry app embed is enabled on the live theme.	Enable the embed, then Guard, then the checkout rule. Test the live storefront.
Newly published theme	A theme change can leave the new live theme without the embed state you expected.	Recheck App embeds immediately after publishing a theme.
Draft orders	Draft-order checkout links can enter checkout outside the normal storefront path.	Use the draft-order bypass when your workflow requires it.
Shop App	Shop App is a different sales channel and does not behave exactly like the Online Store.	Do not use Aggressive mode with Shop App. Test the channel you actually sell through.
Headless storefront	The standard Guard setup depends on the Online Store flow and is not intended for headless storefronts.	Do not enable the checkout rule expecting standard Guard behavior. Contact support before rollout.
Custom cart, bundle, option, or subscription apps	These apps can alter how a shopper reaches cart or checkout.	Test every important cart and checkout path after enabling Guard.

Troubleshooting

Start with the symptom you can observe. Do not change several protections at once unless the priority is restoring checkout immediately.

All checkout attempts are being blocked

Restore checkout first. Disable the Storefront Sentry checkout validation rule in Shopify. Then confirm the app embed is enabled on the live theme and Storefront Guard is enabled inside the app. Test the live storefront before turning the Shopify rule back on.

Guard is enabled, but the protection test still gets through

→Confirm the app embed is enabled on the currently published theme.
→Confirm Storefront Guard is enabled in Sentry.
→Confirm the Storefront Sentry checkout rule is enabled in Shopify.
→Test the live storefront, not only a theme preview or editor preview.
→If the store uses a custom cart or nonstandard storefront flow, review the compatibility section.

A legitimate customer was blocked

→Check whether Access Controls blocked the customer because of VPN, proxy, Tor, or regional policy.
→Check whether the customer used Shop App, a draft-order link, or another path that did not follow the normal storefront flow.
→If a third-party cart or option app is involved, reproduce that exact path yourself.
→Disable the narrowest control that explains the block instead of turning off the entire protection stack.

Problems started after publishing a theme

Reopen the live theme in Shopify's theme editor and confirm the Storefront Sentry app embed is enabled and saved. Treat every live-theme change as a reason to retest checkout.

Draft-order checkout is blocked

Enable the draft-order bypass for the workflow that needs it. Draft orders can enter checkout without the same storefront preparation as a normal customer.

Shop App behaves differently

Leave Aggressive mode off when Shop App matters to your store. Test Shop App separately from the Online Store because they are different sales channels.

You are not sure whether the current setup works

Use the Shopify protection tester to check what your current setup actually stops. The tester is useful for verification, but a successful result still does not replace testing your own normal customer checkout flow.

Common Questions

Do customers have to complete a CAPTCHA or challenge?

Not as part of the normal Storefront Guard flow. On a standard storefront, Guard is intended to work in the background. Access Controls can still deny or interrupt a shopper whose connection matches a rule you enabled.

Can I turn every protection on at once?

You can, but it is usually a poor rollout strategy. Enable the protection you actually need, verify the result, then add another. Staged changes make legitimate-customer impact much easier to diagnose.

Does Storefront Guard prove that every allowed order is legitimate?

No. Guard is designed to stop checkout activity that does not satisfy its session validation. Shopify fraud analysis, payment behavior, customer history, and your own order review still matter after an order exists.

Does a blocked event prove the visitor was fraudulent?

No. It proves a configured protection blocked the request. That can happen to an abusive bot, a customer on a VPN, a blocked region, a nonstandard checkout path, or another session that did not meet the rule.

Will Storefront Sentry work with my theme?

For a standard Shopify Online Store, the important requirement is that the live theme supports Shopify app embeds and that the Storefront Sentry embed is enabled. If your store is headless or heavily customizes cart and checkout handoff, review compatibility before enabling Guard.

Can I use Storefront Sentry with a headless storefront?

Standard Storefront Guard is not intended for headless storefronts. Contact support before enabling the Shopify checkout rule on a headless build.

What data does Storefront Sentry process?

Sentry processes the traffic and session information needed to apply the protections you enable and, when logging is enabled, to show relevant activity in the dashboard. The Privacy Policy is the authoritative reference for data handling and retention.

What is the safest way to uninstall?

Disable the Storefront Sentry checkout rule in Shopify first, then disable Storefront Guard and the app embed, confirm checkout behaves normally, and remove the app. This sequence makes it easy to verify that checkout is restored before the app is gone.

Where can I see product changes?

See the Storefront Sentry changelog for product updates. For questions about a specific store or compatibility issue, email baystacks@proton.me.

Something on your store does not match the docs?

Send us the storefront type, the protection you enabled, and the exact path that is failing. We can help you work through the configuration without guessing.

Contact support