Not if search crawlers keep getting through, and that is the part worth checking in any app you consider.

Doorman verifies Google and Bing crawlers by IP address against the ranges those companies publish, rather than trusting a user agent string, which anyone can copy. Verified crawlers stay on the allow list on every plan, Free included. Verification depends on those published ranges being synced, and the app states plainly when they are not, instead of leaving you to guess.

The decision runs at the network edge before your page is served, not inside your theme. There is almost no storefront JavaScript, so the work does not land in a shopper's browser and does not move Core Web Vitals.

Run the rule in simulation first. It watches your real traffic and records everyone it would have turned away, while turning nobody away. You read that list, then decide whether to enforce.

If someone is blocked in error later, a bypass link lets that person straight through without changing the rule for everybody else.

No. No app can reach inside Shopify's checkout to intercept a payment attempt, so no app can stop a card-testing flood. An app that claims otherwise is describing something the platform does not allow it to do. If you are being hit by one, the levers that exist are Shopify's own fraud controls and your payment provider, not an app in this category.

No. Shopify counts a pageview before any app runs, so blocked traffic still appears in Shopify's own reports. Doorman's own dashboard shows the filtered picture, and you get fewer of the orders that follow bad traffic, but Shopify's numbers are not something an app can clean. Anyone promising you clean analytics is promising something they do not control.

Not reliably. A storefront's product feed is served by Shopify and no app sits in front of it. Content protection deters casual copying with a right-click and selection block; it is a speed bump, not security, and the setting inside the app says exactly that.

Sometimes, and that is a real cost worth knowing before you switch it on. Plenty of legitimate shoppers use a VPN for ordinary privacy reasons, and corporate networks route through datacenters that look identical from the outside. Run VPN detection in simulation for a week and count how many of your actual orders came through one. Then decide, with a number rather than a hunch.

They are two different facts about two different moments. The country a visitor connects from is a network fact, known before the page loads. The country typed into a shipping address is a claim, made later, and a buyer can differ on both: connecting from one country and shipping to another is completely normal. Doorman keeps them as separate settings on purpose, because collapsing them into one switch is how a rule blocks somebody you meant to keep.

No. Free covers 5 countries, 3 IP addresses, one block page, the verified crawler allow list, 7 days of analytics, and simulation mode in full. It is a plan people stay on, not a trial with the door held half open.

Visit records including IP address, for as long as your plan's retention window says: 7, 90 or 365 days, after which they are deleted automatically rather than kept for as long as we happen to.

Reputation results are cached against a widened network rather than a single address, so the cache holds less about any one person than it could. The checkout layer stores nothing at all. Uninstalling erases everything tied to your store.