Shopify Checkout Validation: How to Block Risky Orders Before They Are Placed

Why risky orders are cheaper to stop at checkout

Every Shopify store eventually ships an order it should never have accepted. A parcel goes to a freight forwarder in a country you don't serve. A bot clears out a limited drop with 40 units on one order. A wholesale buyer checks out without the PO number your finance team needs to invoice them.

The usual fix happens after the fact: someone spots the order, cancels it, refunds it, and writes an apology email. By then you've paid transaction fees, sometimes a chargeback fee, and a few minutes of staff time per order. During a busy week like BFCM, those minutes add up fast.

Shopify checkout validation moves that work to the front of the funnel. Instead of cleaning up bad orders, you set rules that stop them before the customer can click Pay now. This guide covers how checkout validation works on Shopify today, which risky orders are worth blocking, how to set up rules step by step, and how to do it without turning away good customers.

What is Shopify checkout validation?

Shopify checkout validation is a set of server-side rules that check a cart and checkout against your conditions and block the purchase, with an error message, when a condition fails. The customer sees the message, fixes the problem (or can't), and no order is created.

It is easy to confuse validation with fraud analysis, but they do different jobs:

The two work best together. Validation filters out orders you already know you don't want, which leaves your fraud review queue smaller and easier to work through. Validation can't tell you whether a card is stolen. It can make sure an order matches the way your business sells.

How checkout validation works on Shopify today

On Shopify, checkout validation runs on Shopify Functions, specifically the Cart and Checkout Validation Function API. A validation function reads the cart, runs your logic on Shopify's servers, and returns an error when a rule fails. Because it runs server-side, a customer can't get around it by editing theme code or disabling JavaScript.

A few details matter when you plan your rules:

• Validation also runs on express checkouts such as Shop Pay, PayPal, Google Pay and Apple Pay. Checks added in theme code often miss these.
• A function knows where the buyer is: in the cart, moving through checkout, or completing the purchase. You can choose the step where each rule fires.
• An error can sit next to a specific field, such as the shipping address or phone number, or show as a general message for the whole cart.
• Each store can have up to 25 validation functions active at once.
• Subscription renewals, POS orders and orders created through the API are outside checkout validation, so those need separate controls.

According to Shopify's Help Center, public apps built with Shopify Functions work on Basic Shopify and above, while custom apps built with Functions need Shopify Plus. In practice, most merchants on any plan can add validation by installing an app from the Shopify App Store. Plus merchants with unusual logic can also have an agency build a custom function.

Let’s work together to build your store

We are one of the world’s most trusted and experienced Shopify Plus Partners.

Get in touch

7 risky order patterns worth blocking

The best validation rules come from your own order history. Pull the last few months of cancelled, refunded and charged-back orders, and look for patterns you could have spotted at checkout. These seven come up again and again.

1. Undeliverable or high-risk addresses

Think PO boxes for carriers that can't deliver to them, addresses with no house or unit number, and freight forwarders you've had trouble with before. A rule on the address fields stops these before you pay for a failed delivery.

2. Countries or regions you don't serve

Your shipping zones may already cover this, but gaps appear when you add a market or a carrier. A rule on country or province gives you a backup for regions with high chargeback rates or legal restrictions.

3. Bulk buying on limited stock

Resellers and bots go after drops, collabs and discounted items. A maximum quantity per product, per order, keeps stock with real customers.

4. Orders below or above your limits

Wholesale orders under your minimum value are one case. Retail orders far above your normal basket size are another, and a very large first order from a new customer is a common fraud signal.

5. Restricted products sent to the wrong place

Some products can't ship to certain states or countries, and some need an age check before sale. Validation can block a specific product and address combination, or stop checkout until the age requirement is met.

6. B2B orders without a PO number

If you sell wholesale on Shopify, a missing purchase order number means your finance team has to chase the buyer before they can invoice. A validation rule can stop a B2B checkout until the PO number is filled in or matches the format you expect.

7. Repeat offenders

Some customers have a history of chargebacks or return abuse. Tag them in Shopify admin and block checkout for that tag, so you don't have to keep a manual list.

You won't need all seven. Start with the two or three that cost you the most last quarter.

Let's Build Your Custom Shopify Store

We help you build a Shopify store that fits your brand perfectly.

Get in touch

How to set up checkout validation rules

Setting up validation takes an afternoon for most stores. The steps below assume you're using an app from the Shopify App Store, which is the route that works on every plan.

1. List the problems you want to stop. Write each one as a plain sentence, such as "No orders to PO boxes" or "No more than 2 units of any product in the Limited collection." One sentence per rule keeps your logic easy to audit later.

2. Pick the tool. Look for an app that runs on Shopify Functions, supports the conditions on your list and lets you edit error messages per language. If you also want to control payment and delivery methods, an app that handles both saves you from managing two rule sets. Qikify Checkout Customizer, for example, includes checkout validation and payment and delivery method rules on its free plan for every Shopify plan. Plus merchants with logic no app covers can have a developer build a custom function instead.

3. Build each rule from conditions. Most rules combine a target (product, collection, customer tag, address field, cart total) with an operator and a value. Keep each rule focused on one problem so you can switch it off without side effects.

4. Write the error message. Tell the customer what went wrong and what they can do next. The next section covers this in detail.

5. Test before you go live. Use a development store or a test product, and try to break the rule: test the edge values, express checkout buttons, a logged-in customer and a guest.

6. Activate the rule in Shopify admin. Go to Settings > Checkout, open Checkout rules, and turn the rule on. You can edit, turn off or remove it from the same place.

7. Review the results after 2 to 4 weeks. Compare cancellations, refunds and support tickets with the period before. If a rule never fires, remove it. If it fires on good customers, loosen it.

Write error messages that keep good customers

A validation rule blocks the order, but the error message decides whether the customer fixes the problem or leaves. Most blocked checkouts come from honest buyers who typed an address wrong or didn't know your limit, so write the message for them.

Good messages follow three rules: say what's wrong, say how to fix it, and stay polite. Here's the difference in practice:

A few more tips help:

• Attach the message to the field it's about. An error next to the address line is easier to act on than a banner at the top of the page.

• If you sell in several markets, write the message in each checkout language.

• For rules aimed at abuse, such as blocked customer tags, keep the message neutral and point to support. A detailed reason only tells bad actors what to change.

Common checkout validation mistakes to avoid

Validation is a strong tool, which is why a bad rule can hurt conversion as much as a good one protects margin. Watch for these mistakes.

• Blocking a whole country to stop a handful of bad orders also blocks every real customer there. Add a second condition, such as order value or a customer tag, before you reach for a blanket ban.

• Two apps, or two rules in one app, can block the same cart for different reasons and show two messages. Keep validation in one place and review all active rules together.

• If you only test the standard checkout, you won't see how a rule behaves when someone pays with Shop Pay or Apple Pay. Test every payment button you offer.

• Rules outlive the problem that created them. Give each rule an owner and a review date, and write down why it exists.

• Validation can't detect a stolen card or check a customer's IP history. Keep Shopify's fraud analysis or a dedicated fraud app running alongside your rules.

• A rule that misfires during BFCM costs far more than one that misfires on a quiet Tuesday. Set up and test new rules a few weeks before your code freeze.

FAQ

Q: Do I need Shopify Plus for checkout validation? 

No. Public apps built with Shopify Functions work on Basic Shopify and above. You need Shopify Plus only if you want a custom app with its own validation function.

Q: Does checkout validation work with Shop Pay and other express checkouts?

Yes. Validation functions run server-side, so they also apply to accelerated checkouts such as Shop Pay, PayPal, Google Pay and Apple Pay.

Q: How many validation rules can I run? 

Shopify allows up to 25 active validation functions per store. One app can hold many rules inside a single function, so this limit rarely matters in practice.

Q: Will validation rules slow down my checkout? 

Shopify Functions run on Shopify's own servers and have to finish within strict execution limits, so a simple rule shouldn't add a delay customers notice.

Q: Can checkout validation replace my fraud app? 

No. Validation enforces rules you define before an order is placed. Fraud tools score risk signals after the order is placed. Use both.

Final thoughts

Shopify checkout validation won't stop every bad order, but it stops the predictable ones: the undeliverable addresses, the bulk buyers on limited stock, the wholesale orders missing details. Those orders eat into your margin and your support team's time.

Start small. Pick the two or three problems that cost you the most last quarter, turn each into one clear rule with a helpful error message, test it across every checkout button, and review the results after a few weeks. Once those rules earn their place, add the next one.

If your store needs logic that goes beyond what an app offers, such as custom B2B rules or validation tied to an external system, a Shopify Plus partner can help you scope and build it so your checkout stays fast and your rules stay easy to manage.