Shopify stores: letting SeoSwiftBot in

A Shopify store sits behind Shopify's own bot protection. It has no allowlist: the merchant cannot let an IP address or a user-agent through, and Shopify support will not do it on request. Since 2025 the way in is a Crawler access signature — three HTTP headers the store generates for a specific tool, valid for up to three months. SeoSwift sends them with every request to that site, and the store answers normally.

How you notice

The site's crawls fail with “blocked most requests with HTTP 403”, the red banner on the site says the crawl was blocked, and you receive an “Action needed” e-mail. Health score, page counts and metadata changes stop updating; Search Console data (clicks, queries) keeps flowing, because it comes from Google, not from the crawl. A store that worked for months and then starts answering 403 has usually had its protection tightened by Shopify, not by anyone at the store.

Create the signature (the store owner, 2 minutes)

1. 1In the Shopify admin open Online Store → Preferences and scroll to Crawler access.
2. 2Click Create signature. Name it SeoSwift and set the longest expiry offered (3 months).
3. 3Shopify shows three values with copy buttons, in this order: Signature, Signature-Input and Signature-Agent — the SeoSwift fields are in the same order. Copy each one exactly — including the quotes around "https://shopify.com".
4. 4Send them to whoever manages the site in SeoSwift, or paste them yourself if you have access.

Paste it into SeoSwift (the agency, 1 minute)

1. 1Open the site in SeoSwift → Settings → Crawler access.
2. 2Paste the three values into the matching fields and click Save signature. The card shows the expiry date read from the signature.
3. 3Click Crawl now. The next crawl carries the headers on every request — pages, robots.txt, sitemaps and linked files alike.

Before it expires

The signature stops working on its expiry date and the store goes back to answering 403. The settings card turns amber two weeks ahead and red once expired. Create a new signature in the Shopify admin, paste it over the old one, done — the old signature can be deleted in Shopify afterwards.

Good to know

• The signature is specific to one store and to the tool it was made for. Treat it like a password: it lets whoever holds it crawl that store without throttling until it expires.
• It does not change what SeoSwiftBot does — still one request per second, still read-only, still obeying robots.txt. It only tells Shopify who is asking.
• HTTP 429 (rate-limited) is a different thing: for that, lower the site's Crawl speed instead — see Sites & Crawling.
• Other platforms with a firewall or bot protection usually do have an allowlist: add the SeoSwiftBot user-agent or the IPs published at seoswift.io/bot/ips.json — see Meet SeoSwiftBot.

Still stuck? Email hello@seoswift.io; a person reads it. Or see what SeoSwift costs.