Skip to content

430 Shopify Security Rejection

Shopify's code for a request rejected by its security layer, often too many URLs in a single request.

Status

HTTP/1.1 430 Shopify Security Rejection

Details

  • Category: 4xx
  • Status: Unofficial (Shopify). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry only after changing the request

Shopify returns 430 when its platform rejects a request for security reasons rather than for a business rule. A documented trigger is a request containing too many URLs, which the platform treats as abusive.

It is unrelated to any registered code in the 4xx range. Some other stacks have used 430 informally for oversized headers, so read the body rather than assuming.

Common causes

  • A request carrying an unusually large number of URLs or parameters.
  • Traffic patterns Shopify's protection layer classified as abusive.

How to fix it

As the client

  • Split the request into smaller batches.
  • Reduce request rate and remove anything that looks like scanning behavior.

As the server

  • Not applicable for callers. On Shopify, review app request patterns against the platform's limits.

Examples

A request rejected by Shopify's security layer

HTTP request

POST /admin/api/2024-01/graphql.json HTTP/1.1
Host: shop.myshopify.com

HTTP response

HTTP/1.1 430 Shopify Security Rejection

See also