Download

Shopify app package

Install the app on your store from the zip below, or sideload during development. Customer account features require Shopify customer accounts (classic or new).

Features

• ✓ Customer login and failed-login logging with IP and country
• ✓ Automatic blocking after repeated failed logins, plus manual IP block list
• ✓ Optional country gate for new customer signups with an admin review queue
• ✓ Cloudflare CF-IPCountry and trusted proxy header options
• ✓ Customer cleanup rules for inactive accounts (scheduled job off by default on new installs)

Country lookup (ipwhois.io)

When Look up countries online is enabled in app settings, and the country is not already known from Cloudflare or the local cache:

• ✓ What is sent: the visitor IP address. The request asks for success and country_code only.
• ✓ Signups: looked up during customer registration when the country gate is on, so the app can hold the account for review if needed.
• ✓ Logins: not looked up at sign-in time. A background sync fills the login log afterward.
• ✓ Storage: a successful country code is cached for 30 days. A failed lookup is retried after 6 hours.
• ✓ Service terms: ipwhois.io/docs

Disable online lookup in Geo-gate & review to stop outbound requests. If your storefront uses Cloudflare, enable Cloudflare country header to prefer CF-IPCountry.

Installation

1. Download the Shopify app zip from this page.
2. In your Shopify Partner dashboard (or your store’s custom app flow), create or update the app and upload the package according to your deployment process.
3. Install the app on the target store and open Trivla Account Security from the Shopify admin apps menu.
4. Complete the setup wizard: confirm proxy/Cloudflare settings, review geo-gate defaults, and save.
5. If you migrate from an older Trivla customer-cleanup app, disable the legacy app first so logins are not recorded twice. Existing login history and settings are preserved where compatible.

Frequently asked questions

Does this work without customer accounts?

Login logging and IP blocking apply to customer account login flows. Checkout-only guest orders are not treated as customer accounts. Enable customer accounts on your store to use signup review and login history.

Will it delete customers automatically?

Not on a new install. Scheduled deletion stays off until you enable it under Customers → Scheduled auto-delete. Run cleanup now uses the same rules and requires confirmation.

Stores upgrading from version 1.x may keep daily deletion enabled to match prior behavior.

Which customers can cleanup remove?

Only Shopify customers with no qualifying orders, never your staff session or the installing admin. Rules mirror WordPress: 0 orders or 0 orders, email not verified, and never logged in, plus minimum account age. Orders remain in Shopify; the customer record is removed according to your rule set.

How is email verification detected?

The app checks a customer metafield or tag (default metafield namespace/key documented in-app). Verified states include common truthy values; missing data shows as No record. Configure the key in app settings to match your verification flow.

I blocked my own IP. How do I recover access?

Open the app from another network or VPN, then remove your IP under Geo-gate & review → Blocked addresses. The block action prevents blocking the IP you are currently using from the admin UI; automatic blocks after failed logins can still affect shared IPs.

Why do all customers show the same IP?

Your shop is likely behind Cloudflare or a reverse proxy. Enable Cloudflare country header or Trust forwarded headers in app settings. Leave both off on direct connections so clients cannot spoof IPs.

What happens to orders when a customer is deleted?

Historical orders stay in Shopify. The customer profile is removed or anonymized per Shopify API behavior and your cleanup settings.

Where is data stored?

Login events and app settings are stored in the app backend database and Shopify metafields/options configured during install. Uninstalling the app removes app-owned data according to the uninstall webhook and your retention settings. Shopify customer and order records are not deleted unless you run cleanup rules explicitly.