Shopify BFCM 2026 Checklist: Fix the Funnel and Stop Bots First

Thanksgiving is Thursday, November 26, 2026, according to the U.S. Office of Personnel Management's federal holiday calendar. That puts Black Friday on November 27 and Cyber Monday on November 30. If you're reading this in mid-October, you have about six weeks.

The BFCM prep threads on r/shopify and r/ecommerce this fall keep circling the same questions: why is my conversion rate so low, why are abandoned checkouts piling up, and where are all these fake accounts coming from? One r/ecommerce thread asked it plainly: should you fix the funnel before scaling ad spend? Yes. More traffic into a leaking checkout just buys more abandoned checkouts at the most expensive time of year.

Here's the order we'd work in, and the rest of this checklist follows it:

Baymard Institute's cart abandonment research calculates an average documented abandonment rate of 70.22% across 50 studies. Many of those shoppers were never going to buy: in Baymard's survey, 42% of US online shoppers said they'd abandoned because they were just browsing. Set those aside and the reasons that remain are mostly fixable.

Shopify counts a checkout as abandoned when it stays incomplete for more than ten minutes after the customer enters an email address, according to its abandoned checkouts help page. Recovery emails now run in Shopify Messaging. Shopify's automation guide says migrating stores keep their previous settings, an added automation defaults to a 10-hour wait (changed by editing the workflow in Shopify Flow), and emails go only to subscribed customers by default.

Klaviyo's abandoned cart flow guide is more aggressive: its pre-built flows wait four hours, and it recommends the first message between two and four hours after checkout starts. It also recommends a 'Placed Order zero times since starting this flow' filter and tells Shopify stores to turn off the platform's default abandoned cart messages so customers don't get duplicates.

That last point matters more than timing. A common fix on Reddit this fall was 'add another recovery app'. If checkout itself is the leak, another recovery tool just sends more overlapping emails to the same people. Fix the checkout, then run one flow you understand. If your Klaviyo flow isn't firing at all, see our guide to Klaviyo flows not triggering on Shopify.

Gmail's email sender guidelines apply to anyone sending more than 5,000 messages a day to Gmail accounts, a line many stores cross during BFCM. Gmail's sender FAQ says it started ramping up enforcement on non-compliant traffic in November 2025, including temporary and permanent rejections. Yahoo's sender best practices set out matching rules.

'Just scale ads' is the most common BFCM advice and the riskiest. During peak season you're bidding against every other store that had the same idea, so each visitor costs more. If your checkout loses people to surprise shipping costs, you pay that higher price and still lose the sale.

Warm audiences already trust you and are waiting for the offer. Build them now from past purchasers, subscribers and recent visitors who viewed products or started checkout, spend most of the BFCM budget there, and keep cold prospecting at a level you could live with if conversion dropped.

Make sure your purchase tracking is clean before you set budgets. If your GA4 or Meta purchase events broke after Shopify's checkout changes, fix that first; our guide to Shopify purchase tracking after Additional Scripts walks through it.

This fall, r/shopify owners described hundreds of fake sign-ups a day, accounts with repeated generic names, and bot carts flooding their email flows. It isn't new. A Shopify Community thread from early 2024 documented a bot nicknamed 'James James' starting and abandoning checkouts across many stores. Merchants there said deleted customers were simply recreated, and app developers told them they couldn't fully fix it. Treat any 'this app fixed it 100%' claim with skepticism.

Shopify's guide to identifying bot activity lists the signs: high volumes of $0 orders, many checkout and payment attempts with repeated or suspicious details, new customer profiles with strangely formatted names, session spikes, and heavy traffic from cloud data center locations. That last one is why 'block the country' rarely works. Bot traffic can come from data centers and proxies in many places, including the countries you sell to, and blocking whole regions mostly blocks real customers.

Bots reach your email platform two ways: through sign-up forms and through checkouts. Klaviyo's double opt-in article explains that with double opt-in, only subscribers who confirm are added to the list. Unconfirmed Klaviyo form sign-ups get a blank profile that isn't on any list. But double opt-in only controls list membership. Abandoned checkout flows are triggered by the Started Checkout event, not by list membership, so a bot that enters an email at checkout can still land in the flow.

Look at your recent fake profiles and find what they share: matching first and last names, the same sign-up form, a cluster of locations, or zero opens and clicks since joining. Build a segment on those traits and suppress its members before your volume ramp starts. Klaviyo's developer documentation confirms suppressed profiles can't receive email marketing, whatever their consent status, and offers a bulk suppression endpoint if you'd rather script it. Remember to clean the matching customer records in Shopify too.

Then add a flow filter to your welcome and abandoned checkout flows that excludes profiles in that segment. If you send with Shopify's own email tools, Shopify's changelog says bot-generated subscribers are filtered out automatically at delivery time, though they stay in your customer list.

Shopify's September 21, 2026 changelog entry says session-based metrics such as sessions, conversion rate, bounce rate and pageviews per session may look different after the change, while orders, sales and customer counts aren't affected. Shopify suggests treating reports from after the change as a new baseline. The 'Human or bot session' filter itself arrived in October 2025.

For BFCM, that means two things. If your conversion rate jumped in late September, check whether it's the measurement change before celebrating. And when you compare BFCM 2026 to BFCM 2025, compare orders and revenue, which didn't change, rather than session conversion rate, which did.

Shopify's guide to dealing with bots says Cloudflare's firewall and DDoS protection run automatically on every store, and that visitors occasionally see a verification challenge. A flood of synthetic traffic is exactly what that layer exists to challenge. On Plus, raise any supervised test with Plus support first.

Small-store BFCM failures tend to come from add-ons: an upsell app whose server slows down, a widget that blocks the page, or a theme edit made the night before. Shopify's bot guide also recommends keeping your theme and apps updated. Do those updates in October, not November.

This plan assumes you're starting the week of October 12, 2026. If you're starting later, compress the first three weeks but keep the email ramp and the freeze; those two dates are the hardest to move.

Most of this list is settings and discipline, not new software. For a broader store health check, see 10 common Shopify issues and how to fix them.

If you'd like a second pair of hands before the freeze, the WordPress & Shopify team at Pixel2Tech can work through the checkout, app and bot items with you, and the Social Media & Email team can handle segment cleanup and the volume ramp. Either way, start this week; November is for watching the numbers, not changing the store.