What a VPN blocker can and cannot do for a store

What detection actually knows

A VPN check does not detect deception. It looks up the IP address a visitor connected from and asks a database what kind of network that address belongs to: a residential provider, a mobile carrier, a datacenter, a known commercial VPN exit, a public proxy, a Tor exit node.

That is a fact about infrastructure, not about a person. Everything you do with it afterwards is an inference, and it is the inference that goes wrong.

It is wrong in both directions

False positives. Plenty of ordinary shoppers sit behind a commercial VPN all day for reasons that have nothing to do with you: privacy habits, a work-issued laptop, an ad blocker that routes through one, a country where a VPN is simply how people use the internet. Corporate networks egress through datacenter ranges and look identical to a bot from the outside. Turn on "block datacenter traffic" and you have blocked some proportion of people browsing from an office.

False negatives. Anyone committing fraud deliberately has cheaper options than a commercial VPN: a residential proxy network, a compromised home router, a mobile connection. Those resolve as ordinary residential addresses and no detection database flags them. The category of attacker you most want to stop is the category least likely to be caught by this.

So the honest framing is not "VPN means fraud". It is that VPN traffic converts differently from your baseline, sometimes much worse, and the size of that gap is specific to your store.

Measure before you enforce

There is a number that settles this and it takes a week to get: how many of your completed orders came through a flagged network.

1. Turn detection on in watch-only mode. It records what it would have blocked and blocks nobody.
2. Wait a full week, including a weekend. Traffic mix on a Saturday is not the mix on a Tuesday.
3. Read two figures: how much traffic was flagged, and how many orders you actually received from flagged traffic.

If flagged traffic is a meaningful share of visits and produced no orders, you have your answer. If it produced real orders, blocking it costs you money and the right setting is to flag rather than block. Merchants who skip this step are guessing, and the guess is usually "VPN users do not buy from me", which is true for some stores and expensive for others.

Where the same signal is worth more

A network check at browse time forces a binary decision about somebody who has not done anything yet. The same check on an order that already exists carries the same information and costs nothing to be wrong about, because you can flag for review instead of refusing.

That is why Doorman treats the two as separate settings on separate screens. A merchant can leave browse-time VPN blocking off entirely, and still have every order's network checked with the verdict written onto the order, next to Shopify's own risk assessment, with the reason in plain words.

When the measurement is missing, say so

Reputation lookups depend on a data provider. If that provider is unreachable, or no key is configured, a check cannot be performed. The behaviour that matters is what an app does at that moment.

Two options: return a safe default and let traffic through unlabelled, or return a score anyway and let the merchant assume it means something. Doorman does the first, and records the absence explicitly on the order, in the same field where a verdict would have gone. An order that reads "the network could not be checked" is more useful than one that reads "low risk" because nobody asked.

The short version

• VPN detection classifies a network, not a person.
• It blocks real customers and misses determined attackers.
• Watch it for a week before enforcing, and read your own numbers.
• Flagging an order is usually worth more than refusing a visitor.
• An app that never says "unknown" is not measuring more, it is guessing more.