Every Shopify Store Has a .myshopify.com Back Door. Bots Are Hitting It at 500 Carts an Hour.
Shopify routes every store's default *.myshopify.com subdomain through its own Enterprise Cloudflare account, which bypasses any WAF, hCaptcha, or bot-blocking app a merchant configures on their custom domain. One DTC store reported over 500 fake cart additions per hour through this back door in late April 2026.