When you write, include your store's myshopify.com domain and, for a session question, the time (UTC) and the first characters of the session id shown in the session log. Never send passwords or API tokens by email.
Shopify already filters bots. Why SessionSift? Since September 2026, Shopify Analytics leaves the bots it identifies out of session reports, and it is deliberately conservative. SessionSift adds three things:
No sessions appear.
A real customer was marked as suspicious.
Does the event gate stop all pixels?
No. It stops Shopify-managed pixels that need marketing (or analytics) consent, Google tags through consent mode, Meta Pixel code in your theme, and tags in Google Tag Manager that you set to wait for the sessionsift_verdict event. It cannot stop Shopify's own analytics or pixels that ignore consent, and events that fired before the verdict stay sent.
Is Cloudflare required? No. The Cloudflare page is optional and only for stores whose domain already runs through Cloudflare. Shopify does not support a Cloudflare proxy in front of a store.
How do I cancel? Choose Switch to Free on the Plan page, or uninstall the app. Shopify stops the subscription.