Shopify

Shopify reduces complexity while securing and personalizing the online shopping experience for millions worldwide with Cloudflare

Shopify powers commerce for millions of merchants and businesses. Centralizing product data, customer information, and operational tasks into a single, powerful solution with unlimited omnichannel connectivity — everywhere people scroll, search, and shop from online marketplaces to social media — Shopify provide their customers with the tools essential to managing a successful retail business without complex, costly independent technical overheads.

A complete business management ecosystem, the Shopify platform supports everything from product sourcing, sales and inventory tracking, payment processing, and shipping to customer accounts management, marketing, and reporting. To offer their customers even greater flexibility, the Shopify app store contains over 13,000 third-party applications.

Driving sales with fast, frictionless, and secure commerce transactions

Available in over 175 countries, Shopify operates under the premise that even the slightest delay or complication in the sales process can lead to lost opportunities. To avoid potential delays and guarantee their buyers and sellers enjoy the most personal, frictionless commerce experience possible in the face of rapid international growth, Shopify sought a technical partnership that would help them:

• Protect customers and data from threats and disruptions like bot and DDoS attacks
• Enhance the speed and reliability of critical e-commerce functions to facilitate seamless transactions
• Deliver personalized, optimized, and localized customer experiences
• Limit complexity with a single-vendor solution
• Simplify merchant onboarding and automating essential services like provisioning customer DNS and SSL certificates, security, and connectivity

“As the developers of a single-platform solution that helps businesses scale from startup to Fortune 500 enterprise, our goal is to make buying and selling through Shopify so easy that people don’t need to think about it,” says Duncan Davidson, Shopify’s VP of Developer Productivity. “That means no loading delays, security alerts, or page timeouts — the moment they click the buy button, our users get exactly what they want.”

Connecting businesses and customers by securing transactions in over 175 countries

When Shopify began their search for a like-minded solutions partner to help them improve security, connectivity, and the customer experience, only Cloudflare offered the technical expertise and international reach the company was looking for. “Cloudflare is synonymous with connectivity across a vast chunk of the global Internet, just like Shopify drives a substantial amount of the world’s online commerce,” explains Davidson. “It was an easy partnership to visualize — Cloudflare operates at the same scale we do, as companies we faced similar challenges.”

That common background helped finalize Shopify’s decision to move to Cloudflare. Based on the cultural similarities between the two companies, the team at Shopify was confident that Cloudflare could help free up their development teams to focus on what they did best — innovating, improving, and expanding the company’s commerce services.

“Shopify and Cloudflare are both engineering-first companies — it’s great to have a partner as invested in their infrastructure as we are in our product,” adds Mattie Toia, Shopify's Vice President of Infrastructure. “The engineering connection we share is nearly as important as the functionality Cloudflare offers.”

Securing buyers and sellers against automated attacks

With their global footprint and customer base rapidly expanding, security was at the top of Shopify’s list of priorities. To reduce vulnerabilities, secure customer applications, and quell the rising tide of automated attacks, the company deployed Cloudflare Application Security and Performance Solutions, specifically the Cloudflare WAF, Bot Management, Gateway, and DDoS Protection. Switching Cloudflare on, the company saw immediate results.

“While bots, data scraping, credential harvesting, and DDoS attacks continue to evolve, Cloudflare allows us to mitigate incoming threats, protecting millions of storefronts, and ensuring customers can complete their transactions without interruption,” says Davidson. “It was the right choice — today, backed by Cloudflare, we operate safely in over 175 countries, each with a unique risk profile.”

With their global customer sites secured by Cloudflare, Shopify meets and deflects sophisticated automated threats before they can do any harm, and maintains a level of security they struggled to achieve with their internally developed security suite.

“Our previous security solution wasn’t very sophisticated, scalable, or easy to maintain,” says Toia. “Automating application security with Cloudflare saves us the time, expense, and engineering effort we would have invested in scaling to our present levels and staying on top of the evolving trends in incoming bot traffic.”

In addition to reducing the administrative and development burdens associated with maintaining their internally developed security solution, with Cloudflare, Shopify is confident that their security is always current.

“We see excellent results using Cloudflare bot prevention tools to stop automated attacks,” says Toia. “Every year we see a consistent increase in threat intensity, but regular Cloudflare updates and feature releases mitigate complex new threats as they come up.”

Establishing intelligent, data-driven security rules

Powered by the Cloudflare ruleset engine, the Cloudflare WAF, Bot Management, DDoS Protection and Gateway also provide Shopify with a host of evolving, flexible, intelligent, and highly configurable security functionality. Key among these features for Shopify are log-only rules that allow the team to preview the impact of security changes before they hit production.

Using Cloudflare’s bot score, the Shopify team can rapidly identify and classify specific bots or groups of bots. This enhanced intelligence allows Shopify to control what automated traffic can access and interact with customer sites, letting desirable bots through and neutralizing malicious activity. For Shopify — a company responsible for millions of international commerce businesses, each with their own specific security needs — the information is critical.

“Understanding what that incoming traffic actually does is crucial, especially when deciding to let through automated traffic that is still commerce relevant,” says Toia. “From our centralized dashboard, we can see Cloudflare doing the right thing when it comes to prioritizing traffic and protecting our customers.”

Meticulously logging and tracking everything on the global network, Cloudflare provides Shopify with increased clarity into their customers’ traffic and facilitates important business decisions.

“Cloudflare supplies actionable data like no other platform we have used, ”says Toia. “It has become fundamental to how we think about growing and securing our customers and our platform.”

Localizing the buying experience for everyone, everywhere

Since their earliest days with Cloudflare, Shopify has also harnessed the power of Cloudflare performance services, specifically the Cloudflare global network and CDN, to accelerate Internet and mobile applications, ensure application availability, and establish fast, reliable connections between their global users and over 6 million customer domains. Using Cloudflare, Shopify seamlessly processes 3.4 trillion requests totaling over 170 petabytes worth of data monthly and scales easily to meet seasonal demand.

“Cloudflare puts our services within 50 milliseconds of anybody on the planet. That allows us to build experiences that feel local to everyone, everywhere, at any time.” says Davidson. “The scale of it is just astounding. We've gone from being a user of just a few Cloudflare services to adopting a large chunk of the Cloudflare stack.”

Enabling personalized ecommerce experiences with Cloudflare Workers and Workers for Platform

As a part of that growing Cloudflare tech stack, Shopify also relies on Cloudflare Developer Services, specifically Cloudflare Workers and Workers for Platform — Cloudflare’s serverless computing platform — to further personalize services and provide a consistent experience everywhere, particularly in locales with connectivity issues. Powered by the Cloudflare global network with its data centers in 330 cities in over 120 countries, Workers help Shopify create, deploy, enhance, and scale applications like shopping carts and payment gateways. Workers brings these applications closer to customers without additional infrastructure or configuration.

“We run our checkouts as close as possible close to the customer, to ensure everything happens quickly on our customer websites,” says Davidson. “Much faster than a round trip to our servers, localizing customer interactions with Cloudflare personalizes every transaction. The result is a better ecommerce experience for both buyers and sellers.”

A single-vendor solution to enhance performance and reduce complexity

Shopify also uses Cloudflare and the Workers development ecosystem to streamline and improve the performance of sophisticated customer storefront customizations, all without adding third-party vendors or additional layers of complexity. In addition to empowering their customer sites, Workers also power critical applications in Shopify’s own infrastructure, most notably a global marketing website that demands instant scalability and the flexibility to deploy campaigns to every corner of the globe without startup delays, architectural changes, or intensive configuration. Using Cloudflare and Workers on the edge to handle these tasks, Shopify saves time and money it can then dedicate to other business objectives.

“Our successful partnership with Cloudflare comes down to simplification,” says Toia, “Where it is possible, we prefer a single, reliable vendor with centralized controls over the increased complexity of multiple suppliers. It’s a strategy that played a large part in our decision to adopt Cloudflare and explains why we are where we are today. The decision to heavily leverage Cloudflare is one that we make sure to reevaluate and renew regularly, as our company grows and our needs evolve.”

“For Shopify, the real challenge is not about how many different pieces of complex technology we can use but the opposite,” says Davidson. “Cloudflare helps us find a simple way to achieve something very complex that we can scale and maintain.”

Adding value and securing 6 million domains with Cloudflare built-in

SSL for SaaS is another example of how Shopify has abstracted complexity and streamlined how it onboards and secures merchant websites on their own domains with Cloudflare. SSL for SaaS enables Shopify to share Cloudflare Web Application services with their customers, extending all the benefits of Cloudflare to every Shopify customer while improving SEO and discoverability. Using SSL for SaaS the company can rapidly provision and protect customer domains and data, deploying new certificates across the global network to ensure branded visitor experiences and end-to-end HTTPS security in minutes.

“With Cloudflare, we easily manage millions of customers and ensure their connections are working and secure before traffic reaches our infrastructure,” says Davidson. “It is seamless — buyers and sellers benefit without ever knowing Cloudflare is part of the equation.”

For the future, Shopify plans to continue working with Cloudflare as it improves the ecommerce journey.

“Cloudflare is one of our most important partners,” says Davidson. “We have faced so many challenges together it would be very difficult to find someone else we could scale with, build with, or rely on in the same way.”