Banned Customers
Navigate to yStore → Marketing → Banned Customers.
The banned customers list lets you block specific individuals from completing purchases. Bans can target an email address, an IP address, a customer name — or any combination. When a banned record matches an incoming checkout attempt, the customer is blocked from placing the order.
Banned customers can still browse the storefront and add items to their cart. The block fires only when they attempt to complete checkout. If you need to restrict access entirely, manage that at the Craft user level or at the server/CDN level.
Ban fields
| Field | Description | Required? |
|---|---|---|
| The email address to block | At least one field required | |
| IP address | The IP address to block — useful against guests who re-register | Optional |
| Name | Customer name as an additional signal | Optional |
| Reason | Internal note explaining why the ban exists — not visible to customers | Recommended |
You only need to fill in one field for a ban to be effective. Adding multiple fields makes it harder to evade.
How bans are matched
yStore checks all active ban records against every checkout attempt. A match on any single field (email, IP, or name) is sufficient to block the order — you do not need all fields to match simultaneously.
| Field | How matching works |
|---|---|
| Exact match (case-insensitive) | |
| IP address | Exact match against the request IP |
| Name | Partial match — "John" would match "John Smith" and "Johnny" |
An email-only ban can be bypassed by creating a new account with a different email. Adding the IP address prevents the same device from checking out even with a new account. For persistent abusers, also block at the server or CDN level (nginx, Cloudflare, etc.) to prevent access entirely.
Adding a ban
- Go to
yStore → Marketing → Banned Customers. - Click Add new ban.
- Fill in at least one identifying field — email, IP address, or name.
- Add an internal reason so your team knows why the ban was placed (e.g., "Chargeback fraud 2026-03-10", "Filed false non-delivery reports").
- Save.
The ban takes effect immediately on the customer's next checkout attempt.
Removing a ban
- Locate the record — use the search bar to filter by name, email, or IP.
- Open the record.
- Click Delete.
The ban is removed immediately. The customer can complete checkout on their next attempt with no further restrictions from yStore.
Banning from the Flow Manager
You can automatically add customers to the banned list using the Block Customer action in a flow. This is useful for:
- Automatically banning customers who trigger a chargeback (via a webhook from your payment provider)
- Banning accounts that fail authentication a suspicious number of times
- Banning accounts flagged by a fraud detection integration
Example flow:
[HTTP Request trigger from payment provider webhook]
↓
[Condition: event_type = "chargeback"]
↓
[Block Customer]
↓
[Send Slack Notification: "Customer {customer.email} auto-banned — chargeback received"]
See Flow Manager for setup details.
Searching the ban list
The search bar on the banned customers list accepts email addresses, IP addresses, and names. Use it to:
- Check whether a specific customer is currently banned before adding a duplicate
- Investigate a support request from a customer unable to check out
- Verify a ban is active after adding it
Common questions
Q: Will a banned customer know they are banned? They see a checkout error message. The default message is generic ("We were unable to process your order") and does not reveal that they are banned or why.
Q: Can I temporarily suspend a ban without deleting it? Not via the UI — bans are active or deleted. For temporary suspensions, set a calendar reminder and delete/re-add the ban manually.
Q: Does banning affect existing open orders? No. The ban only applies to new checkout attempts. Existing orders already placed are not affected.
Q: Can a banned customer still create an account or log in? Yes. yStore bans apply only at checkout, not at account creation or login. To restrict account access, manage that via Craft's user status controls.