What to do if someone cloned your Shopify store

A Shopify storefront is public by design: product titles, descriptions, prices and images have to be visible for customers to buy. Scrapers collect all of it automatically, and Shopify's public product data makes a full catalogue easy to copy in minutes. The copy is then dropped onto a new domain, often:

• your brand name plus a word like “outlet”, “sale”, “official” or “uk”;
• a one-letter misspelling of your domain;
• your exact name on a cheap ending such as .shop, .store or .online.

Many clones still load product images straight from Shopify's CDN or your own domain, because the scraper copied the image addresses rather than the files. That is useful: it proves where the content came from.

The point of the clone is the checkout. Some collect card details on a form that looks like a payment page; others take payment for goods that never arrive. Traffic usually comes from paid social ads using your photos, aimed at people who already know your brand.

1. Do not contact the clone. It tips them off and they move faster. Do not buy from it with your own card.
2. Record it. Full URL, date and time, screenshots of the home page, a product page and the checkout. Save an archived copy at web.archive.org/save.
3. Find out who runs the domain and hosting. Our free check shows the registrar, host, Cloudflare status and abuse contacts in about 20 seconds, or follow our guide to finding who hosts a website.
4. Report it to the registrar and host, then the browser blocklists. Details below.
5. Warn customers with a short banner or announcement bar stating your only official address, and brief your support team on what to say to anyone who bought from the copy.

Sometimes the copy is itself a Shopify store; more often it is on cheap hosting elsewhere, sometimes behind Cloudflare. The lookup tells you which. Signs of Shopify include name servers or DNS records pointing at Shopify, and the page source referencing Shopify assets.

If the clone runs on Shopify, report it to Shopify as well as the registrar. Shopify has its own process for intellectual property complaints and for stores that break its acceptable use policy, both reachable from its legal pages. Include the clone's URL, your own store's URL, and what was copied.

If it is hosted elsewhere, send the hosting provider an abuse report and a DMCA notice for the copied photos and text. Our DMCA template has every required element. If it is behind Cloudflare, use Cloudflare's abuse form, which forwards to the host.

• Registrar abuse desk: ask for the domain to be suspended for fraud and impersonation. Usually the most effective single report.
• Hosting provider (or Shopify, or Cloudflare): abuse report plus DMCA notice.
• Google Safe Browsing and Microsoft SmartScreen: report the site as phishing so browsers warn visitors, often before it is removed.
• Netcraft and APWG: anti-phishing feeds used by browsers and security vendors.
• The ad platform: if you have seen ads for the clone, report the ads and the advertiser through the platform's intellectual property or scam reporting tools.
• Action Fraud (UK) if customers have lost money. The crime reference helps them with their banks.

The full process, with what to put in each report, is in how to report a fake website.

People who paid the clone will contact you, angry, believing you took their money. Be kind and clear: the site was not yours, you have reported it, and they should contact their card issuer or bank straight away to dispute the payment and, if they entered card details, to replace the card. Point them to Action Fraud in the UK. Do not promise refunds for orders you never received; do log each contact, as it strengthens your reports.

Clones come back on new domains. A few things help:

• Register a trade mark for your shop name if you have not. It is not required to get a copy taken down, but it strengthens every report.
• Watch for lookalike domains. New certificates and new registrations that imitate your domain often appear before a clone is advertised. Monitoring does this daily.
• Add a clone beacon: a small script in your theme that does nothing on your real store, but reports a scraped copy the moment it loads and sends visitors back to you. You can paste it into your theme code yourself; there is no app to install.