What Is TOR?
TOR (The Onion Router) provides extreme anonymity by routing traffic through multiple servers worldwide. Unlike VPNs, TOR makes tracing users virtually impossible.
Why TOR Is Higher Risk Than VPNs
| Factor | TOR | VPN |
|---|---|---|
| Anonymity | Near-complete | Partial (provider has logs) |
| Traceability | Almost impossible | Difficult but possible |
| Speed | Very slow | Fast |
| Fraud correlation | Very high | High |
| Legitimate ecommerce use | Rare | Occasional |
When to Block TOR
Block if:
- You’ve experienced fraud from TOR traffic
- You don’t serve markets requiring TOR for safety
- You have no business reason to accept extremely anonymous orders
- You run limited-stock promotions
Allow if:
- You explicitly serve activists or journalists
- You operate in markets with internet restrictions
- Your other fraud prevention catches issues
- TOR represents meaningful legitimate traffic (rare for most stores)
How TOR Blocking Works
Exit Node Detection
TOR traffic exits the network through known “exit nodes.” We maintain an updated database of all TOR exit nodes and check visitor IPs against it.
Simple Toggle
Enable TOR blocking with one click in your dashboard. All TOR traffic is blocked automatically.
Custom Messages
Display an appropriate message to blocked TOR users explaining your policy.
TOR vs VPN Blocking
TOR blocking is simpler and more justifiable than VPN blocking:
- Fewer false positives - Almost no legitimate shoppers use TOR
- Clear risk signal - TOR use for shopping is inherently suspicious
- Easy detection - Exit nodes are publicly known
- Less customer impact - Very few stores have meaningful TOR customer bases
Most stores should block TOR even if they allow VPNs.
Recommended Configuration
For typical Shopify stores:
- Enable TOR blocking - Low risk of blocking real customers
- Use a polite message - “We’re unable to process orders from the TOR network”
- Monitor blocked attempts - Track how much TOR traffic you receive
- Combine with VPN blocking - For comprehensive anonymity protection
What Blocked Users See
Your custom message should:
- Explain access is restricted from TOR
- Avoid accusatory language
- Provide customer service contact if needed
- Maintain professional tone
Example:
“For security reasons, we cannot accept orders from the TOR network. If you believe you’ve reached this message in error, please contact our support team.”
Monitoring TOR Traffic
Track TOR blocking to understand your threat landscape:
- How many TOR visits do you get?
- What pages do TOR users try to access?
- Are blocked attempts correlated with fraud attempts on other channels?
Low TOR traffic means blocking has minimal impact. High TOR traffic might indicate targeted attacks.