How do I stop a specific customer from ordering again? Shopify won't let me just block their email or IP.
Shopify doesn't offer a simple block button for a specific customer, but risk analysis, Flow automation, and account deactivation can get you most of the way there.
What's going on
A customer places a fraudulent order, tries to abuse your return policy, or is outright harassing your staff, and your instinct is to just block them — their email, their IP address, whatever it takes to keep them from ordering again. You go looking in Shopify admin for a "block this customer" button and it isn't there, at least not in the form you expect.
That's not an oversight. Shopify checkout runs on shared infrastructure and doesn't expose raw IP-level blocking to individual merchant admins, and a hard email block is trivial for anyone determined to get around it — they just use a different address or check out as a guest. What Shopify does give you is a set of signals (order risk scores, customer account status, order history) and automation tools (Flow, checkout functions on Plus) that let you catch and stop repeat bad actors without pretending a static identifier is a permanent lock.
Why it happens
Shopify checkout runs on shared, PCI-compliant infrastructure across every store on the platform. Merchants don't get raw network-level controls like IP blocklists for their storefront the way you'd configure a firewall, partly because IP addresses are a poor identifier anyway — they're reassigned constantly by ISPs and mobile carriers, shared across offices and households, and trivially hidden behind a VPN.
Email is a slightly better signal but still weak on its own: creating a new address costs nothing, and blocking one outright can misfire if a legitimate customer's email is later reused or spoofed. So instead of a single block switch, Shopify's approach is layered — automatic risk scoring on each order, customer account controls, and (on Shopify Plus) custom checkout logic — leaving merchants to combine those signals into a process rather than relying on one blunt filter.
5 ways to fix it
Automate detection and cancellation with Shopify Flow (free, native)
Shopify's built-in fraud/risk analysis flags each order as low, medium, or high risk based on signals like mismatched billing/shipping, unusual order value, and proxy/VPN use. Pair that with Shopify Flow (available on most current plans) to build a workflow that watches for orders matching a known bad actor's email, name, shipping address, or phone number and automatically tags the order, cancels it, or holds it for manual review before you ship anything. This is the most durable fix because it works off account and order data Shopify actually verifies, rather than a network address that changes every session.
Deactivate the customer's account and require manual review on repeat orders
If the person has a customer account, you can deactivate it from Customers in your admin, which stops them from logging in and reusing saved details, though it does not stop a guest checkout under a different email. Combine this with turning on manual payment capture or an order-review step so nothing ships until you've eyeballed it against your list of known problem customers.
Use a checkout validation function if you're on Shopify Plus
Plus merchants can write a checkout validation function (the modern replacement for Shopify Scripts) that blocks checkout for specific email domains, patterns, or other custom conditions you define. This is the closest thing Shopify offers to a real-time block at the point of purchase, but it requires Plus and developer setup, so it's not accessible to most merchants.
Add a storefront-level blocking app only if abuse is ongoing and severe
Several Shopify App Store apps focus specifically on blocking checkout by email, IP range, or shipping address, and can be a reasonable option if a bad actor keeps circumventing your manual process. Treat this as a supplement to your own review process, not a silver bullet: IP blocking in particular is easy to defeat with a VPN, a new device, or simply a different Wi-Fi network, and legitimate customers on shared IPs (offices, mobile carriers, campus networks) can get caught in the net.
Fall back on a clear refusal-of-service policy plus manual cancellation
For most one-off fraud or harassment cases, the most reliable approach is procedural, not technical: state in your terms/policies that you reserve the right to refuse service or cancel orders at your discretion, then manually cancel and refund orders from that person as they come in. It's less automated than a hard block, but it doesn't rely on brittle identifiers a determined bad actor can just change.
Bottom line
There's no single Shopify switch that permanently locks out a specific person the way you'd block a number on a phone — Shopify's fraud tools work off risk signals and account data, not network-level bans, because IP addresses and even emails are too easy to change. The most durable setup combines native risk analysis and Flow automation with a clear cancellation policy, escalating to a checkout-blocking app only if the abuse is persistent enough to justify it; if you want that automation built out end-to-end, that's the kind of workflow a fraud/order-review app or a short agency engagement can set up correctly the first time.
Browse the rest of the problem library, run a free storefront scan to catch issues like this automatically, or email us and we'll work out a custom solution for it.