Decide who comes in.
Watch first.
Doorman turns away traffic you do not want, by country, network or IP, before your page is served. Then it checks the network behind every order that does get through.
Free plan, no card. Paid plans from $5.99 a month.
| Time | Network | Verdict |
|---|---|---|
| 21:04 | Deutsche Telekom | Admitted |
| 21:04 | 198.51.100.0/24 | Turned away |
| 21:05 | Orange | Admitted |
| 21:06 | Datacenter, VPN exit | Turned away |
| 21:06 | Googlebot, verified | Admitted |
| 21:07 | Tor exit node | Turned away |
See it decide, before you decide.
A rule on watch, the report it produces, and what happens to an order that gets through. No install needed to judge it.
Nothing loads from YouTube until you press play.
Two moments, two different facts.
A visitor can connect from one country and type another into an address. Doorman checks both, at the moment each one is knowable, and the two are configured separately on purpose.
The door
Block or allow by country, region, city, IP address, CIDR range, ASN, referrer, user agent or device, and catch VPN, proxy, datacenter, Tor and bot traffic. The decision runs at the network edge, so an unwanted visitor never reaches your theme. Restrict individual products by location, and hand bypass links to staff and wholesale buyers so they always get through.
The guest list
Every order's network is checked and the verdict is written onto the order itself, beside Shopify's own risk assessment, with the reason stated in plain words. Set a score and Doorman will hold the shipment or cancel automatically past it. Cash on delivery and the shipping countries you flag are recorded on the order too. Where a measurement is missing, it says so rather than guessing.
Rules that fit a real storefront.
Watch before you block
Run any rule in watch-only mode against your live traffic. It records who it would have turned away, and turns away nobody, until you say so.
Search engines keep working
Google and Bing crawlers are verified by IP against the ranges those companies publish, and verified crawlers stay on the allow list on every plan, Free included.
Your own block page
Write what a turned-away visitor sees, in your own words, with your own CSS and HTML on Pro. Or redirect them somewhere else entirely, per country.
Bypass links
Send a private link to staff, a supplier or a wholesale buyer and they walk straight through a rule that would otherwise stop them.
Rules on a schedule
Turn a rule on for a weekend sale, a regional launch or a fraud wave, and have it switch itself off again.
Sanctions screening
Screen against the OFAC list on Pro, with a compliance log you can read on screen and export, showing which list covered each decision.
Start free. Pay when a rule earns it.
Billed by Shopify, on your existing invoice. Yearly is ten months for twelve.
Block the obvious.
- 5 countries and 3 IP addresses
- Simulation mode, in full
- Verified Google and Bing allow list
- Deter casual copying of text and images
- 7 days of analytics
$59.90 a year. 7-day free trial.
- Unlimited countries, regions, cities, IPs and ranges
- VPN, proxy, datacenter, Tor and bot detection
- ASN, referrer, user agent, device and UTM rules
- Whitelist mode, per-country redirects, scheduling
- Restrict single products and collections by location
- Bypass links
- 10 block pages, 90 days of analytics, CSV export
$179.90 a year. 14-day free trial.
- Everything in Standard
- Every order's network checked, verdict on the order
- Hold or cancel automatically past a score you set
- Cash on delivery and flagged countries recorded
- Unlimited block pages, your own CSS and HTML
- OFAC screening with a readable compliance log
- 365 days of analytics
The three asked most.
Does blocking a country hurt my SEO?
Not if search crawlers keep getting through. Doorman verifies Google and Bing crawlers by IP against the ranges those companies publish, rather than trusting a user agent anyone can copy, and verified crawlers stay on the allow list on every plan.
What if I block a real customer by mistake?
Run the rule in simulation first. It records everyone it would have turned away and turns nobody away, so you read the list before deciding. A bypass link fixes an individual case without changing the rule.
Can it stop card testing?
No. No app can intercept a payment attempt on Shopify's checkout, so none can stop a card-testing flood. Any app claiming otherwise is describing something the platform does not allow.
Three things Doorman does not do
- It cannot stop card testing.
- No app can reach inside Shopify's checkout to intercept a payment attempt. If a card-testing wave hits you, this app is not the fix, and neither is any other one in this category.
- It cannot clean up Shopify's own analytics.
- Shopify counts the pageview before any app runs. Blocked traffic still appears in Shopify's reports. What you get is a clean picture in Doorman's dashboard, and fewer of the orders that follow bad traffic.
- It cannot stop someone copying your catalog.
- A storefront's product feed is served by Shopify and no app sits in front of it. Content protection here deters casual copying; it is a speed bump, and the setting says so.
Open the door on your terms.
Install free, put every rule in simulation, and read a week of your own traffic before anything is turned away.