What Shopify Webhooks does
Shopify webhooks deliver near-real-time data to apps when events occur in a Shopify store, identified by topics such as orders/create and products/create. Deliveries can be sent to an HTTPS URL, a Google Pub/Sub URI, or an Amazon EventBridge ARN, and are used to keep apps in sync with Shopify data or to trigger follow-up actions. Shopify notes that webhook delivery is not always guaranteed and recommends apps run reconciliation jobs rather than relying on webhooks alone.
How to control Shopify Webhooks
Target Shopify Webhooks in your robots.txt with the Shopify-Captain-Hook token. Rules apply per bot, so you can allow this one while blocking others, or the reverse.
Allow Shopify Webhooks
User-agent: Shopify-Captain-Hook
Allow: /Block Shopify Webhooks
User-agent: Shopify-Captain-Hook
Disallow: /Each delivery carries an HMAC signature and an X-Shopify-Webhook-Id header that receiving apps can use to verify authenticity and ignore duplicate deliveries.
How to identify Shopify Webhooks
Temso identifies Shopify Webhookstraffic by matching the request's User-Agent header against this pattern. User-agent strings can be spoofed, so treat a match as an indication, not proof.
Shopify-Captain-HookShopify Webhooks FAQ
What is Shopify Webhooks?
Shopify Webhooks is Shopify's event notification system: when a subscribed event such as an order or product creation occurs in a store, Shopify sends the event data to a URL, Google Pub/Sub URI, or Amazon EventBridge ARN that an app registered.
How do I block Shopify Webhooks?
You can add a robots.txt group with "User-agent: Shopify-Captain-Hook" followed by "Disallow: /", but Shopify's webhook documentation does not state that deliveries check robots.txt. Webhooks are only sent to endpoints an app subscribed to, so removing the webhook subscription is the reliable way to stop them.
About Operational Bots
Monitoring, security scanning, link previews, webhooks, and feed fetchers: the utility traffic that keeps integrations and shared links working.
Most of this traffic is service-critical or user-triggered. Webhooks and previews don't follow robots.txt, and blocking them tends to break things you rely on.
