> For the complete documentation index, see [llms.txt](https://fraud-block-ip.labxapp.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fraud-block-ip.labxapp.com/documentation/core-concepts/how-traffic-is-evaluated.md).

# How Traffic Is Evaluated

The order rules are checked in, and how allow always wins.

Every storefront page load is evaluated against your ruleset in this order:

1. **Bypass link** — if the visitor presents a valid bypass token, every other rule is skipped and they're let through
2. **Good bots** — known search engine and platform crawlers (Googlebot, Bingbot, Applebot, etc.) are always allowed if *Allow good bots* is on, so you never accidentally de-index your store
3. **Allow rules** — an explicit *Allow* on any rule type wins over every block rule
4. **Bot protection** — if enabled: unknown/automated user agents, Tor exit nodes, and datacenter/hosting IPs are blocked
5. **Suspicious signals** (opt-in) — headless browser tells and unrecognized user agents
6. **Redirect rules** — a block with a destination URL
7. **Block rules** — IP, country, region, ISP, user agent, referrer, or product/page rules
8. **Default: allow** — if nothing matches, the visitor gets your store as normal

**The guard fails open.** If a lookup fails, times out, or a rule can't be evaluated, the visitor is let through rather than blocked — a real customer should never be locked out by a technical issue.

## Storefront rules vs. Checkout Protection

|                                          | Storefront rules (Blocking Rules)                     | Checkout Protection                           |
| ---------------------------------------- | ----------------------------------------------------- | --------------------------------------------- |
| Runs                                     | In the shopper's browser, on page load                | On Shopify's servers, during checkout         |
| Can be bypassed by disabling JavaScript? | Rules depend on browser signals                       | No — it's a Shopify Function, always enforced |
| Best for                                 | Keeping unwanted traffic off your storefront entirely | Stopping a fraudulent order at the final step |

Most stores use both: storefront rules to keep bad traffic out early, and Checkout Protection as a last line of defense at checkout.