How bots get into Klaviyo
- Signup forms and popups. Klaviyo calls it list bombing: a flood of fake submissions through a signup form or checkout page, filling a list with addresses that never consented or don't work.
- Other forms over the API. Third-party forms that sync to Klaviyo through its API can carry bot submissions with them.
- Shopify checkouts. A reply in a Klaviyo community thread explains that Shopify sends Klaviyo the profile whenever a checkout is started, signup or not, so double opt-in doesn't stop those profiles.
Why deleting them in Shopify doesn't help
Klaviyo says that deleting a profile in Klaviyo doesn't delete it in Shopify, and the reverse is also true. Clearing fake customers out of Shopify leaves their Klaviyo profiles in place. Any of those you can still email keeps counting toward your plan.
What bot profiles look like
The export check above flags these patterns. Each one means likely, not certain:
- Random-string address, such as long runs of consonants with no real word in them
- Throwaway email domain, from a list of well-known temporary inbox providers
- Link stuffed into the name field, a common sign of spam form fills
- Gmail dot-trick address, with dots scattered through a Gmail address
- Address can't receive mail
Klaviyo also suggests checking whether a burst of new subscribers all came through the same form, which points to the door the bots are using.
Block new ones
- Shopify forms: in Online Store > Preferences, check the Spam protection section. Shopify uses hCaptcha on contact, newsletter signup and comment forms, and on account pages. It's on by default, but confirm it hasn't been switched off.
- Klaviyo forms: Klaviyo shows a CAPTCHA to visitors whose activity looks suspicious. It's on automatically for forms that collect email or SMS or hand out a unique coupon.
- Double opt-in: new subscribers have to confirm by email. Klaviyo suggests checking each affected list's settings.
- Custom forms: add a hidden honeypot field that only bots fill in, and write it to a profile property you can segment on.
Clear out the ones you already have
Bots that never placed an order can be suppressed in bulk from a segment, before your renewal so the lower count is in place when Klaviyo checks your tier. Turn on auto-downgrade in Billing > Preferences too, or the smaller count won't change your plan. TierBrake runs this before every renewal: likely bots and cold profiles, never anyone with an order in the last 365 days, with a CSV backup of everyone suppressed.