Mint LabsMint Blockerby Mint Labs

Support

Questions or something not working? Email support@stickermint.com with your store's .myshopify.com address. If a visitor was blocked (or not) unexpectedly, include their country and, if you have it, the IP address — the app's Test page shows exactly which rule applies. We reply within one business day.

Getting started

  1. Install Mint Blocker from the Shopify App Store. The app home shows a setup checklist.
  2. Choose what to block on the Rules page: countries (block the ones you list, or allow only the ones you list), IP addresses and ranges, email addresses and domains, customer tags.
  3. Turn on the app embed: click Turn on the app embed on the app home. Your theme editor opens with the “Mint Blocker” embed switched on; click Save. Blocked visitors now see your block page (set its text on the Storefront page).
  4. Switch on the checkout rule (paid plan) on the Checkout and orders page, and optionally order checks.
  5. Use the Test page to try any country, IP address, email or customer tag against your live rules.

What each part does — and doesn't

  • Storefront blocking runs a small script in the visitor's browser that asks our service whether the visitor's country or IP address is blocked, then covers the page with your block page (or redirects). It can be bypassed: a visitor can turn off JavaScript, use a VPN, or send a search engine's user agent. Bots that don't run JavaScript never see it, and Shopify's analytics can still record visits from blocked countries (the block page appears as the page loads, after the visit can already be counted). It's useful to keep casual traffic out; it is not a firewall.
  • The checkout rule is a Shopify cart and checkout validation: Shopify runs it on its servers for every checkout, including Shop Pay, Apple Pay, Google Pay and PayPal express checkouts, and it can't be switched off by the buyer. It checks the shipping address country (store pickup is skipped), the billing address country, the email and — for signed-in customers — customer tags. It checks what the buyer enters, not where they are. Adding to the cart is never blocked.
  • Order checks look at each new order after it's placed: its IP address (which checkout can't see) and email. Matching orders get the tag mint-blocked. Automatic cancelling is off by default.
  • The app doesn't detect VPNs, proxies or bots by itself, and no app can stop every unwanted visitor or order. Mint Blocker blocks what you tell it to.

How rules are applied on the storefront

  1. Search engine crawlers (Googlebot, Bingbot, Applebot, DuckDuckBot, YandexBot, Baiduspider and others, recognised by their user agent) are let through while “Let search engines through” is on (default).
  2. An IP address on your always-allowed list is let through.
  3. An IP address on your blocked list is blocked.
  4. A location Cloudflare can't determine (including the Tor network) is let through, unless you turned on “Also block visitors whose location can't be determined”.
  5. The country rule: blocked if the country is on your list (block mode), or not on it (allow-only mode).

The visitor's country comes from Cloudflare's IP geolocation, which is usually right but not always, and follows a VPN. The answer is remembered in the visitor's browser for 2 hours, or until you change your rules.

IP addresses and ranges

  • One per line: a single address (203.0.113.7, 2001:db8::7) or a CIDR range (203.0.113.0/24, 2001:db8::/32). Text after # is a note. If you enter an address inside a range, like 203.0.113.7/24, it's saved as the range's start, 203.0.113.0/24.
  • IPv4 addresses written the IPv6 way (::ffff:203.0.113.7) are the same address as 203.0.113.7. An IPv6 range shorter than /96 that covers ::ffff:0:0/96 also covers IPv4 addresses — the app warns you when that happens.
  • Many phone networks share one IPv4 address among many customers; blocking a mobile network's range can block genuine shoppers.
  • The Activity page lists blocked visits by network (IPv4 /24, IPv6 /48); “Block this network” adds that range.

Emails, domains and customer tags

  • An address such as ann@example.com also matches Ann+anything@Example.com; for Gmail, dots don't matter and googlemail.com is gmail.com. A domain such as @example.com (or just example.com) blocks every address at that domain and its subdomains.
  • Customer tags apply to signed-in customers only. Guests have no tags, so pair tags with email rules.

Order checks and cancelling

  • Matching orders are tagged mint-blocked and listed under Checkout and orders. Filter your Orders page by that tag to review them before fulfilling.
  • If you switch on automatic cancelling, the app asks Shopify to cancel matching orders with the reason “Fraud”, and applies your choices: refund to the original payment method (payments that were only authorized are released either way), restock the items, and email the customer Shopify's cancellation notice. Cancelling can't be undone. Shopify refuses to cancel some orders (for example with a payment still processing or items already fulfilled); those stay tagged and the app shows Shopify's reason.
  • Order checks need Shopify's approval for the app to read order emails (protected customer data). Until it's granted on your store, the app shows a notice and retries every hour; the storefront and checkout rule work regardless.

Limits

  • Free: up to 3 blocked countries on the storefront, default block page.
  • Paid plan ($4.99 per month, 7-day free trial): unlimited countries, allow-only mode, up to 2,000 blocked and 200 always-allowed IP ranges, up to 1,000 email addresses and domains, up to 100 customer tags (a Shopify limit for checkout rules), custom block page or redirect, checkout rule, order checks.
  • A store can have up to 25 checkout rules from all apps (a Shopify limit). Mint Blocker uses one.
  • Very long email lists must fit Shopify's size limit for checkout rules (about 57 KB of text — roughly 1,000 addresses of up to 50 characters); the app tells you if they don't.

Performance and search engines

  • The embed adds an inline script of about 2 KB. With nothing to block it makes no request at all. Otherwise each visitor's browser makes one small request (a few bytes back) at most every 2 hours, which doesn't hold up the page. The block page itself (under 2 KB) is only downloaded by blocked visitors.
  • If the check fails, times out (4 seconds) or our service is down, the visitor sees your store — the app fails open. The optional “hide the page while the first check runs” setting never hides it for more than 1 second.
  • The block page is drawn in the browser; your page HTML is unchanged. Search engine crawlers that identify themselves are skipped, so they index your normal pages. We can't verify that a visitor claiming to be a crawler really is one (we don't check crawler IP addresses), so anyone sending a crawler's user agent is let through.

Troubleshooting

  • I can't see the block page from a blocked country. Check that the app embed is on (the app home shows when your store last checked a visitor) and try a private window: the answer is remembered for 2 hours. The theme editor never shows the block page.
  • I blocked myself. Open the app from the Shopify admin (the admin is never blocked), then Rules → IP addresses → “Add my IP to the allowed list”, and save.
  • Checkout isn't stopped. Check the checkout rule is on in the app and in Settings → Checkout → Checkout rules. The Test page shows which check applies to a given buyer.

Uninstalling

When you uninstall, Shopify removes the app embed and the checkout rule, and we remove your storefront rules right away. Tags already added to orders stay. Your data is deleted 48 hours after uninstall, when Shopify sends the shop deletion request. Mint Blocker is made by Mint Labs.