How to limit quantity per customer on Shopify (cart caps, bot protection)

Shopify already caps every cart — just not in the direction merchants expect. When a customer tries to add more units than you have in stock, the cart quietly reduces the quantity to match your available inventory. That prevents sales running past zero, and it also broadcasts your exact ceiling to anyone paying attention. The native counterweight is the add-to-cart limit: one store-wide number that caps how many of each item a single cart can hold. Here's how it works, what it can't do, and the bot layer on top — all verified against the Shopify Help Center in November 2026.

The native add-to-cart limit

• Where: Settings → Checkout → Advanced preferences → Add-to-cart limit. The setting is active by default; you can change the value or switch it off (Help Center, "Set a limit to the maximum quantity of items per cart", November 2026).
• Scope: one store-wide whole number, applying per variant independently. A cap of 30 on a three-colorway tee means 30 red, 30 blue, and 30 green in one cart — not 30 total across the product.
• The recommended limit: once your store has more than 250 sales, Shopify calculates a recommendation from your order data, including a surplus for larger-than-average orders; below that, the default recommendation is 50. It updates periodically as data accrues, and you can set higher or lower — though a limit set too low costs you real orders.

What the cap fixes is both the hoarder and the disclosure. The auto-reduce behavior reveals inventory because the cart shrinks to match whatever's left; a cap sitting above your current stock binds first, so the cart stops at your limit before it ever touches your stock number.

What it can't do

Honest limits, because they shape the setup:

• It's per cart, not per customer. A buyer who wants 10 units can place five orders of 2. No native setting caps a customer across multiple orders as of November 2026 — that's app territory.
• It's one number for the whole store. You can't cap one product at 2 and another at 10 natively.
• Documented exceptions where it doesn't apply at all: carts created in Shopify POS, draft orders, carts containing B2B catalog products with their own quantity rules, customers logged in with a B2B customer profile, variants with inventory tracking deactivated, and variants set to continue selling when out of stock.

That last exception is the deliberate-oversell setting, which is a different tool for a different decision — the deliberate-overselling guide covers when to allow sales past zero on purpose.

If you sell wholesale from the same store, B2B catalogs carry quantity rules (minimums and maximums per order) that override the cart limit for those buyers. That's the B2B-side equivalent of a cap, and its setup lives in the B2B guide.

A worked drop setup

Illustrative numbers, phone-stand edition: a maker drops a new colorway, 120 units, Friday 10 a.m.

Without a meaningful cap, the auto-reduce default does this: three auto-checkout bots hit the product in the first four minutes and take 40, 30, and 25 units. That's 95 of 120 gone to three carts — and every slower customer's cart shrank to match a shrinking stock number, advertising the count as it drained.

With the add-to-cart limit set to 2, the same three buyers take 6 units total. 114 remain, enough for up to 57 two-unit orders. The stock number stays hidden until stock itself — below the cap — becomes the binding constraint.

The setup is one field: enter 2, save. The judgment is the number itself. At 1, you block every legitimate two-pack order; at 20, you've done nothing about bots. The recommended-limit logic exists because the honest answer lives in your own order history: set the cap near your largest legitimate single-order quantity, with the surplus mindset Shopify itself applies.

The bot layer, and its catch

Shopify's bot protection blocks known auto-checkout bots and slows bot activity so human customers get a fair window during flash sales. The catch: it's Plus-only as of November 2026, and activation requires contacting Shopify Plus Support — it isn't self-serve.

Details worth knowing before you schedule an event:

• It covers the Online Store sales channel only, and applies to up to 500 specific products or all published products (not to collections).
• One event at a time, maximum 60 minutes, scheduled in your store's time zone — plan it to overlap the drop window itself.
• You choose the checkpoint: reCAPTCHA or hCaptcha, with hCaptcha offering customizable challenge types.
• The "don't allow bots to auto-complete checkouts" setting is active by default once protection is on; events can be deactivated early but not edited once running, and they shut off automatically when the scheduled window ends.
• The checkpoint page itself is theme-customizable through a checkpoint.liquid template, and you can preview what customers will see before the event starts — worth doing, because a broken challenge page during a drop is its own emergency.

No Plus plan? The honest answer is the cap plus operational pacing: don't publish exact remaining counts, stagger scarce variants across the day, and watch the first hour live in the admin so you can pause a listing if one buyer is obviously automated.

Setting it up, and testing it

Timing and verification, because the cap only helps if it's live before the drop:

1. Set it the day before, not the hour before: Settings → Checkout → Advanced preferences → Add-to-cart limit → enter the value → Save. Whole numbers only, one value for the store.
2. Check the exceptions on your drop product. If the variant has "continue selling when out of stock" enabled for a preorder overlay, the cap doesn't apply to it — verified exception. If you're dropping to wholesale buyers through B2B, catalog quantity rules govern instead.
3. Test like a customer. Draft orders and POS carts bypass the cap entirely, so don't test from the admin. Open the live storefront in a private window, add past the cap, and confirm the cart holds the line at your number.
4. Revert after the drop if the number is drop-specific. A cap of 2 that survives into December quietly throttles every gift-set order all season.

One boundary from the docs: Shopify's bot protection is "meant only to limit the effectiveness of auto-checkout bots" — it isn't a fraud tool, and it doesn't address bot-driven fraud. Treat the two as separate problems with separate tools.

Choosing the tool

The boundary worth keeping straight: caps stop one buyer taking too much before stock reaches zero. Overselling is what happens when sales run past zero — a seller-side failure with its own causes and fixes, covered in the guide linked above rather than re-taught here.

One sentence from us, since it's adjacent: caps are prevention, but if you also want awareness while a promo drains a SKU — an estimated dollar figure on what's at stake before it's gone — that's the gap our read-only risk alerts are built for.

Common questions

Where do I set the maximum quantity per order in Shopify? Settings → Checkout → Advanced preferences → Add-to-cart limit. Enter a whole number and save; the setting is active by default. Shopify shows a recommended limit based on your order history once you've passed roughly 250 sales, and 50 below that.

Can I limit quantity per customer instead of per order? Not natively. The add-to-cart limit applies per item per cart, so a customer can place repeat orders to work around it. True per-customer caps across orders need an app; B2B buyers are the exception, governed by quantity rules on catalogs.

Does the cart limit apply to POS, draft orders, and B2B? No — those are documented exceptions, along with carts from B2B customer profiles, variants with inventory tracking off, and variants set to continue selling when out of stock. Staff-sold and negotiated channels keep their own rules, so set the cap with online drop buyers in mind.

What is the default add-to-cart limit in Shopify? The setting is on by default with a recommended value rather than a hard-coded one: under about 250 sales the recommendation is 50; above that it's calculated from your order data with a surplus for larger-than-average orders, and it updates periodically.

How do I stop bots without Shopify Plus? Bot protection is Plus-only as of November 2026. Without it: set the add-to-cart limit, don't broadcast exact stock counts, stagger scarce releases, and monitor the launch hour in the admin so you can pause a listing if one buyer is clearly automated.

Next step

The rule: set the cap to roughly your largest legitimate order quantity, review it after each drop, and reach for bot protection only if bots actually show up. When a capped drop still sells through and demand outlives the stock, the waitlist guide covers capturing the excess — and the overselling guide covers the opposite failure, when sales run past zero.