Shopify's API is a magnet for credential stuffing and gift card fraud. Their built-in WAF misses a lot, especially when attackers rotate IPs from residential proxies.
Here's a rule set I built for ModSec (CRS 3.x style). Catches the low-effort stuff that slips through.
```
SecRule REQUEST_URI "@contains /admin/api" "id:1000,phase:1,t:none,log,deny,status:403,msg:'Shopify Admin API Access Attempt'"
SecRule ARGS:password "@rx ^[a-zA-Z0-9]{6,20}$" "id:1001,phase:2,t:none,log,deny,status:403,msg:'Simple password pattern common in credential stuffing'"
SecRule ARGS:email "@rx (?:mailinator|tempmail|10minutemail).(?:com|net)" "id:1002,phase:2,t:none,log,deny,status:403,msg:'Disposable email provider in checkout'"
SecRule REQUEST_HEADERS:User-Agent "@contains python-requests" "id:1003,phase:1,t:none,log,deny,status:403,msg:'Common scripting UA on sensitive endpoints'"
```
Key is to run this *before* the request hits Shopify's origin. Edge WAF only. Tune the thresholds to avoid blocking legit bulk operations from known app partners.
Keep it simple