Proxy vs VPN vs TOR: A Shopify Merchant's Guide to Anonymous Traffic
Your Browsify dashboard shows that 12% of your store traffic comes from VPNs and proxies. Should you block all of it? None of it? How do you tell the difference between a fraudster hiding behind a VPN and a privacy-conscious customer using one?
Understanding what proxies, VPNs, and TOR actually are and how each is used for both legitimate and fraudulent purposes lets you make smarter blocking decisions.
What Each Technology Does
Proxy Servers
A proxy routes your internet traffic through an intermediary server, masking your real IP address. The website sees the proxy's IP, not yours.
Legitimate uses: Corporate networks (employees browse through company proxies), content delivery optimization, basic privacy.
Fraud uses: Datacenter proxies are cheap and widely used for bot operations, card testing, and scraping. Residential proxies are more dangerous they route traffic through real home internet connections, making fraudulent traffic look like it comes from a regular household. Residential proxy subscriptions start at roughly $10/month.
Detection difficulty: Datacenter proxies are relatively easy to detect (their IP ranges are known). Residential proxies are harder because they look like regular consumer traffic.
VPNs (Virtual Private Networks)
A VPN encrypts your internet connection and routes it through a server in a location you choose. Like proxies, they mask your real IP but they also encrypt all traffic between your device and the VPN server.
Legitimate uses: Privacy protection on public WiFi, accessing content while traveling, corporate security requirements, general privacy preference. An estimated 30%+ of internet users use VPNs, and that number continues growing.
Fraud uses: VPNs let fraudsters appear to be in any country. A fraudster in Nigeria can use a US-based VPN server and appear to be browsing from New York. They switch servers between fraud attempts, getting a new IP each time.
Detection difficulty: Major VPN providers (NordVPN, ExpressVPN, etc.) use known IP ranges that can be detected. But new VPN services and private VPN servers are harder to identify.
TOR (The Onion Router)
TOR routes traffic through three random relay nodes, encrypting at each layer. It provides the strongest anonymity of the three technologies traffic is nearly impossible to trace back to the source.
Legitimate uses: Journalists and activists in repressive countries, whistleblowers, privacy researchers. TOR has important civil liberties applications.
Fraud uses: TOR's strong anonymity makes it attractive for serious fraud operations. The multi-layer encryption and random routing make it nearly impossible to identify the user. However, TOR is slow (traffic passes through three relays), making it impractical for high-volume bot operations.
Detection difficulty: TOR exit nodes are publicly listed, making detection straightforward. Blocking TOR traffic is easy and rarely affects legitimate customers.
Quick Comparison
| Factor | Proxy | VPN | TOR |
|---|---|---|---|
| Anonymity level | Low–Medium | Medium | Very High |
| Speed | Fast | Fast | Slow |
| Cost | Free–$50/mo | $3–$12/mo | Free |
| Encryption | Usually none | Full | Multi-layer |
| Fraud use frequency | Very High (datacenter/residential) | High | Medium |
| Legitimate use frequency | Medium | Very High | Low |
| Detection ease | Easy (datacenter) / Hard (residential) | Medium | Easy |
| Block recommendation | Block datacenter; evaluate residential | Selective blocking | Block |
| Estimated % of store traffic | 2–5% | 5–15% | <0.5% |
How to Handle Each Type on Shopify
TOR: Block It
TOR traffic is the simplest decision. Virtually no legitimate Shopify customer needs TOR to buy products. The anonymity level is extreme, the fraud correlation is high, and the percentage of store traffic from TOR is negligible (<0.5%).
In Browsify: enable TOR blocking. The impact on legitimate sales is essentially zero.
Datacenter Proxies: Block Them
Traffic from datacenter IPs (cloud hosting providers, known proxy services) is overwhelmingly non-human. Real customers don't browse from AWS servers or Google Cloud instances. Datacenter proxy traffic is bots, scrapers, and automated fraud tools.
In Browsify: datacenter proxy detection is part of the VPN/Proxy blocking feature. Enable it.
Residential Proxies: Score and Evaluate
Residential proxies are the tricky category. The traffic comes from real residential IP addresses, making it look like legitimate consumer traffic. But residential proxy networks are increasingly used for sophisticated fraud.
Browsify's fraud scoring helps here: a visitor on a residential proxy who also shows browser automation signals, timezone mismatches, or device fingerprint anomalies will score high regardless of their IP type. The combination of signals not any single signal determines the risk.
VPNs: Be Selective
This is where most merchants make mistakes either blocking all VPN traffic (losing real customers) or blocking none (letting fraud through).
The reality: A significant percentage of internet users use VPNs for legitimate reasons. If you block all VPN traffic, you're potentially losing 5–15% of your visitors many of whom are real customers.
The smart approach:
Don't block VPNs by default. Instead, let Browsify's fraud scoring evaluate VPN visitors on the full range of signals. A customer on a VPN who has a normal browser fingerprint, consistent timezone, and no automation signals will score low and pass through. A fraudster on a VPN who shows device anomalies, datacenter characteristics, or bot patterns will score high and get blocked.
Exception: during high-risk events (flash sales, limited drops), temporarily blocking VPN traffic for the first 30–60 minutes can significantly reduce bot abuse. Restore VPN access after the initial rush.
iCloud Private Relay: Always Allow
Apple's iCloud Private Relay is a privacy feature built into Safari on iOS, iPadOS, and macOS. It masks the user's IP address while browsing technically similar to a VPN from a detection standpoint.
The critical difference: iCloud Private Relay users are verified Apple device owners who are almost certainly legitimate consumers. Blocking iCloud Private Relay means blocking a significant portion of your Apple/iOS customer base.
In Browsify: the "Allow iCloud Private Relay" toggle exists specifically for this reason. Keep it enabled. If your store has significant mobile traffic (most Shopify stores do), blocking iCloud Private Relay would cost you real sales.
Browsify Configuration Cheat Sheet
| Traffic Type | Recommended Action | Setting |
|---|---|---|
| TOR | Block | Enable TOR blocking |
| Datacenter proxy | Block | Enable VPN/Proxy detection |
| Residential proxy | Score-based | Let fraud scoring evaluate |
| Commercial VPN | Score-based | Don't block all VPNs; let fraud scoring evaluate |
| iCloud Private Relay | Allow | Enable "Allow iCloud Private Relay" |
| Corporate proxy | Allow | Normal traffic from office networks |
The Bigger Picture
Anonymous traffic isn't binary it's not all fraud or all legitimate. The merchant who blocks everything loses customers. The merchant who blocks nothing loses to fraud.
Device fingerprinting provides a better signal than IP classification alone. A visitor's Visitor ID stays the same whether they're on a VPN or not. Their fraud score evaluates the full picture device signals, network characteristics, and behavioral patterns not just whether they're using a proxy.
The smart approach: use proxy/VPN/TOR detection as one input into a broader risk assessment, not as a standalone blocking decision.
Configure smart anonymous traffic handling install Browsify free →
Related Reading
- VPN & Proxy Blocking on Shopify Detailed configuration guide.
- What Is a Visitor ID? Why device fingerprinting is more reliable than IP classification.
- Why IP Blocking Is Dead The limitations of IP-based fraud detection.