Getting Started

Connect Shopify with Cloudflare

Configure Shopify Orange-to-Orange, install Honeylog with Cloudflare Batch, and verify incoming events.

Shopify uses Honeylog's existing Cloudflare integration. First put your store's custom domain behind a Cloudflare zone you control using Orange-to-Orange (O2O). Then install the normal Honeylog Worker with Cloudflare Batch (recommended) and verify that the site receives events. There is no separate Shopify Worker or Shopify app to install.

You need a custom domain you control that is connected to your Shopify store and registered as a site in Honeylog. A *.myshopify.com address cannot be used for this procedure.

#1. Configure Shopify with Cloudflare

  1. Add the custom domain to your own Cloudflare zone. Before changing nameservers, copy and check the DNS records needed for email (including MX, SPF, DKIM and DMARC), domain verification and other services. Keep those records when moving DNS to Cloudflare.
  2. For each storefront hostname you want to monitor, create a Proxied CNAME pointing to shops.myshopify.com. Configure the root domain and www only when your store uses them.
  3. Set Cloudflare SSL/TLS encryption mode to Full. Turn Always Use HTTPS off for Shopify O2O. If you use a redirect rule to enforce HTTPS, exclude /.well-known/acme-challenge/* so Shopify can validate and renew its certificate.
  4. Before adding a Worker, open the storefront and a product page, add and remove a cart item, check the primary-domain and HTTP-to-HTTPS redirects for loops, and reach checkout without placing an order. Continue only when the store works normally.

See Cloudflare's Shopify O2O guide for the provider's current DNS and certificate instructions.

#2. Install Honeylog with Cloudflare Batch

Open your Shopify site in Honeylog, then go to Settings > Installation > Shopify and continue to Cloudflare Batch (recommended). Follow the Cloudflare Batch installation steps for the shared procedure. Batch uses the selected Honeylog site's domain, ingestion endpoint and secret; if the site has no ingestion secret, installation creates one, otherwise it reuses the existing secret. Leave ORIGIN_URL unset.

Before installing, check Cloudflare Workers Routes for a Worker or route already handling the store's hostnames. Resolve overlaps with the owner of that Worker; do not replace its routes. Batch initially creates yourdomain.com/* and *.yourdomain.com/*. After installation, replace the broad Honeylog wildcard route with routes for only the storefront hostnames you intend to monitor. Check each Honeylog route's request limit failure mode is Fail open. Keep the ingestion secret out of URLs and logs.

Workers request quotas apply to the Cloudflare account. If the quota is exhausted, Fail open keeps the store available but requests that bypass the Worker are not collected. Confirm the quota is suitable for the store's traffic.

#3. Verify events and store behavior

Installing the Worker completes configuration; it does not prove Honeylog is receiving events. Visit a few public storefront pages, note their paths and the time, then check Raw Logs for new events on the same Honeylog site. Allow for Batch delivery before concluding that nothing arrived. Old events alone do not verify this installation.

Repeat the storefront, product, cart, redirect and checkout checks after installation. Add and remove cart items and reach checkout without completing a payment. If events do not arrive, check proxied DNS, the exact hostname routes, existing Worker conflicts, Cloudflare quotas, and the selected site's endpoint and secret. Do not put the secret in a diagnostic URL or log.

#What is collected

  • Honeylog collects HTTP traffic, not Shopify orders or payments. Cloudflare does not run the Worker on /checkout, so do not use checkout to test event reception.
  • The default Honeylog path filter also excludes AJAX endpoints ending in .js, such as /cart/add.js. The cart continues to work; those requests are simply omitted from analytics. Test collection with public page URLs instead.
  • Shopify Markets domains tracked as separate Honeylog sites need separate configurations and secrets. Language subfolders on the same domain remain part of the same site.

To stop collection, remove only the Honeylog Worker routes for the store's hostnames in Cloudflare. Keep DNS, O2O and other Workers' routes in place. Check storefront, cart, redirects and checkout again afterward.