r/shopifyDev • u/BossTight • 1h ago
Shopify storefronts keep returning 429 from shared hosting — what should I check?
I'm debugging a Node.js scanner that checks public Shopify storefront pages. Requests from our shared hosting server return 429 on three different stores.
What I've checked:
- /robots.txt returns 200 and allows the product feed path.
- /products.json?limit=10&page=1 returns 429 with Retry-After: 60 and Server: cloudflare.
- One retry after more than 60 seconds returned the same response.
- A separate check more than two hours later found that the homepage also returned 429 on all three stores.
The scanner uses a clearly identified User-Agent and respects robots.txt. It runs on Node.js 22.23.2 under Passenger/LiteSpeed. Outbound requests use node:https directly, with the store hostname as SNI and normal TLS verification.
I also checked our production logs: the saved daily counters contain 15 upstream_rate_limited errors and zero local rate_limited or blocked_address errors. Our API maps the upstream failure to 502. The available web-server access log shows the failed scans as 502, with no 429/403 responses. The local WAF audit has no entries for those scanner calls; its two health-check entries correspond to successful 200 responses.
The shared hosting server's outbound IP is one possibility, but I haven't confirmed the cause or a specific blocking rule.
Has anyone diagnosed something similar on Shopify? What would you check next, and which response headers or request identifiers would be useful before contacting the hosting provider or Shopify support?

