SG-traffic anomaly analysis & remediation plan

1 · Executive summary

Between [DATE-RANGE] the client's Shopify storefront recorded ~[N]K daily sessions with an unusually low conversion rate of [X.XX]%. Pixel and GA4 dashboards reported elevated paid-ad conversions inconsistent with downstream order data in Shopify Admin.

Investigation isolated three SG-originating bot patterns exploiting Shopify's recommended-products URL parameter (refer §3) and Meta Pixel's client-side track('PageView') event. These patterns inflated reported pageviews by ~[XX]% and corrupted Meta's lookalike audience seeds for the past [N] weeks.

Recommended remediation: a 4-layer ruleset spanning Shopify Admin, Meta Pixel client + Conversions API server-side, and GA4 IP/UA exclusions. Estimated implementation: 14 days. Expected outcomes (summarised in §6) are deliberately understated in this preview to preserve client anonymity.

2 · Methodology

1. Pulled 30-day session log from Shopify (orders, sessions, source/medium, IP class) via Admin GraphQL.
2. Cross-referenced with Meta Pixel's EventsManager → Test Events stream and the GA4 BigQuery export (events_* table).
3. Flagged any session matching ≥2 of: (a) UA fingerprint shared by ≥10 unique IPs, (b) zero scroll/click engagement, (c) recommended-products URL parameter exploitation pattern, (d) IP belonging to an SG-resident datacentre ASN.
4. Sample size: [N,NNN] flagged sessions out of [NN,NNN] total. False-positive review on a stratified sample of 100.

3 · Pattern signatures observed

// Shopify Admin GraphQL — flag rule (extract):
sessions {
  filter: {
    landingPath: { matches: "^/products/.+\?recommended=" }
    pageviewCount: { gte: 8 }
    addToCart: { eq: 0 }
  }
}

4 · Ruleset deployed (4 layers)

# Stape GTM Server-side variable (ruleset extract):
const isBot = (event) => {
  const ua = event.user_agent || '';
  const ip = event.ip_override || event.client_ip;
  return BOT_UA_PATTERNS.some(rx => rx.test(ua))
      || BLOCKED_ASN_PREFIXES.some(p => ip.startsWith(p))
      || (event.event_name === 'AddToCart' && event.value === 0);
};

5 · Conversions API migration plan

Migration from client-only Pixel to dual-mode (client + server) executed via Stape's GTM Server-side container. Preserves attribution for iOS 17+ users (ATT-restricted) while filtering bot traffic before it reaches Meta's optimisation surface.

1. Day 1–2: Stape container setup, custom domain (track.[client-domain]), Conversions API connector deployed.
2. Day 3–5: Client → server dedup keys configured for Purchase, InitiateCheckout, AddToCart, ViewContent. event_id hashed via SHA-256 of (timestamp + cart_token).
3. Day 6–10: Bot ruleset (§4) integrated into Stape transformations. Test events validated in Meta EventsManager.
4. Day 11–14: Cutover. 7-day monitoring window with daily diagnostic against Shopify Admin source-of-truth.

6 · Outcomes (redacted)

Over the 30 days following ruleset deployment:

• Reported sessions down [XX]% (the bot inflation, removed)
• Reported InitiateCheckout events down [XX]%; actual checkout count from Shopify Admin unchanged
• Meta lookalike audience signal restored — CPM rebased to within [X]% of historical norm
• Klaviyo abandoned-cart flow open rate up [XX]% (cleaner list)
• Founder reported "I can trust the dashboard again" — qualitative but the most-cited outcome at the 30-day handoff

Quantitative outcomes redacted under NDA. Discuss your own situation in WhatsApp; we can share approximate ranges from comparable engagements without identifying clients.

7 · Bot Shield + Analytics Stack — your deliverables

The actual engagement (S$2,800, 18 days) ships:

• Bot-pattern report formatted as above, with your store's specific signatures
• Ruleset deployed across Shopify, Meta Pixel, GA4 (L1–L2 + L4)
• Conversions API migration via Stape (L3) — 14-day implementation
• Re-anchored conversion baseline + 30-day handoff memo
• Monthly diagnostic template — you run it yourself; quarterly check-in optional