How to Block a Specific City on Shopify

Country and state blocking are common, but sometimes the problem is narrower. A single city is generating a wave of chargebacks. A local reship-mule operation keeps hitting your store. A regional promotion needs to exclude one metro area. In these cases you want to block traffic at the city level — and while Shopify can do it with the right tooling, city targeting comes with accuracy caveats you must understand before you rely on it.

How city-level blocking actually works

City blocking is built on IP geolocation. When a shopper connects, their IP address is looked up in a geolocation database that maps IP ranges to physical locations. Country resolution from an IP is highly reliable — often 98%+ accurate. But precision drops sharply as you zoom in:

• Country accuracy: very high (95-99%).
• Region/state accuracy: good (around 80-90%).
• City accuracy: variable (often 55-80%, depending on country and connection type).

The reason is structural. IP addresses are assigned to internet service providers, not to street addresses. A single ISP hub can serve a whole metro region, so a customer physically in a suburb might resolve to the nearest large city — or to the ISP's registered headquarters entirely. Mobile connections are worse: a phone in one city can route through carrier infrastructure that geolocates 50 kilometers away.

The practical takeaway: treat city as a signal, not a verdict. It is useful, but on its own it will occasionally catch the wrong shopper and occasionally miss the target.

Legitimate use cases for city blocking

Despite the caveats, city-level rules solve real problems.

• Concentrated fraud. If your chargeback reports show a cluster of disputes tied to one city, a temporary block can stop the bleeding while you investigate. Fraud rings frequently operate out of specific metro areas.
• Reshipping and mule addresses. Package-reshipping scams often route through known freight-forwarding hubs in particular cities. Blocking checkout attempts geolocated there stops a common laundering path.
• Regional promo exclusions. Running a discount that legally or contractually cannot apply in one city? A geo rule enforces the boundary.
• Local abuse. Repeated fake orders, harassment, or competitor sabotage originating from one area can be dampened with a city filter.

Setting up a city block on Shopify

Shopify's built-in settings don't offer city-level order blocking, so you need an app that reads IP geolocation and acts at checkout.

Best control. Shieldy — Fraud Filter runs on Shopify Functions and can evaluate location down to the city level before payment is captured. The setup:

1. In Shieldy, create a new location rule.
2. Choose the country and state, then narrow to the specific city you want to block.
3. Set the action to block at checkout.
4. Save. Orders geolocating to that city are stopped before payment.

Because the evaluation happens in a Shopify Function, the block is enforced server-side rather than depending on client-side scripts that can be bypassed.

Avoiding the over-blocking trap

Because city accuracy is imperfect, a naive city block will inevitably reject some legitimate customers who merely resolve to that city. Here is how to keep the collateral damage low.

Signals. Never rely on the raw city match alone. Combine it with corroborating evidence:

• VPN/proxy detection. A connection that claims to be in your blocked city but is actually routing through a data center is far more suspicious than a plain residential connection. Weight accordingly.
• Billing/shipping mismatch. If the geolocated city conflicts with the billing address in a way consistent with fraud, that strengthens the case for blocking.
• AI fraud scoring. Rather than a hard block on city alone, feed the city signal into a broader risk score. A returning customer with clean order history who happens to geolocate to the flagged city should not be treated like a brand-new account exhibiting card-testing behavior.

Best control. For most merchants, the smartest configuration is not "block everyone in City X" but "raise the risk score for City X and hard-block only when other fraud signals stack on top." This preserves conversions from genuine locals while still stopping the abuse pattern you actually care about.

Testing and monitoring your rule

City rules are easy to get wrong, so verify before you trust:

• Start narrow and temporary. Apply the rule, then watch your order flow and support inbox for a week. Complaints from real customers who couldn't check out are your signal that the rule is too broad.
• Check your logs. Shieldy records what it blocks and why. Review whether the blocked attempts actually correlate with fraud (unusual order values, mismatched addresses, proxy usage) or whether you're catching ordinary shoppers.
• Prefer scoring over hard blocks whenever the fraud pattern is fuzzy. Reserve hard city blocks for clear, concentrated abuse.

When to reach for something broader

If your fraud isn't truly city-specific, city blocking is the wrong tool. A single problem city is often the visible tip of a broader pattern — data-center traffic, a specific ASN, or proxy networks that span many cities. In those cases, blocking the underlying network or connection type is more durable than chasing individual metros. City blocking shines when the abuse is genuinely local and concentrated; for everything else, reach for connection- and network-level controls.

City-level blocking is a precision instrument with a wide margin of error. Used carefully — as one weighted signal inside a larger fraud picture — it stops localized abuse without punishing your real customers. Used bluntly, it becomes a quiet conversion killer.

Want to enforce a city rule at checkout without over-blocking? Configure it in Shieldy and layer it with proxy detection and AI scoring.