One per customer, and the guest who ordered five
Every purchase limit that works by counting a customer's past orders has the same hole: a guest checkout has no customer to count. This is not a gap in an app you bought — it is what the checkout hands a rule in the first place, and the honest fix is a trade rather than a setting.
A purchase limit that counts past orders has nothing to count when the shopper is a guest. The rule at checkout does see the email they typed. What it is not handed is a customer record behind it — Shopify's own wording for the equivalent field elsewhere is that it is undefined "if the buyer isn't a known customer for this shop or if they haven't logged in yet" — so "has this person ordered before?" has nowhere to look. The rule does not fail or error. It simply never fires, and the fifth order goes through looking exactly like the first.
That is why the limit you set is working and being bypassed at the same time, and why no app can fix it from the inside: the information is not there to be read.
What actually exists natively
On discount codes, a real limit. A code can be set to one use per customer, tracked by email address or phone number. If your "one per customer" is a launch discount, this is the answer and it works.
On products, one blunt thing. Your checkout settings carry an add-to-cart limit — a maximum quantity per variant that can go into a cart, on by default, and store-wide: you cannot set it for one product. Outside B2B, where a catalogue can cap a variant per order, that is all there is. Both are per-order caps, not per-person ones: they stop a basket of ten, not ten baskets of one.
So for a product limit across orders, there is nothing native to enable. Every solution is a rule at checkout, and every rule at checkout meets the same guest problem.
Limit set, and the same person keeps ordering? Describe how it should actually work →
The fix that works, and what it costs
Require shoppers to sign in before checkout. Now every order has a customer attached, and a rule counting orders behaves as expected.
The price is concrete and worth weighing:
"If the option to require customers to sign in to their customer account before checking out is activated, then accelerated checkout options such as Apple Pay aren't displayed in the online store cart."
So the Apple Pay and Shop Pay buttons come out of your cart — the fastest path to purchase for a large share of mobile shoppers — in exchange for a limit being enforceable. On a limited-edition drop that trade is obviously right. On everyday stock it usually is not, and this is the decision to make deliberately rather than by accident.
And one more leak to know about even after you have decided. Shopify's dynamic "Buy now" buttons skip the cart, and on that path the buyer identity can arrive empty. A developer posted Shopify Support's explanation in December 2024 — "a known limitation of how Dynamic Checkout functions" — and we have not seen it confirmed or fixed since. If your limit matters, that button is worth turning off on the products it applies to, and worth testing yourself either way.
Which route is yours
| What you are limiting | What to do |
|---|---|
| A discount code, one use per person | Native — one per customer on the code |
| How many of any item go in a single cart | Native — the store-wide add-to-cart limit |
| How many of ONE item go in a single order | Native on B2B catalogs; otherwise a checkout rule |
| One per person, across separate orders | A checkout rule and requiring sign-in |
| A launch where fairness matters more than speed | Require sign-in, and turn off dynamic checkout buttons |
| Everyday stock where speed matters more | Accept the leak, or limit per order rather than per person |
An honest word about how tight this can get
Even with sign-in required, a determined person makes a second account with a second email address. Every limit of this kind is a speed bump rather than a lock, and the useful question is not "can this be defeated" but "does it stop the ordinary case" — the same shopper, same address, ordering four more because nothing said no.
If what you actually need is one per household or one per address, that is a different rule and it does not depend on accounts at all: it looks at where the order is going. For a guest it can only run after the order exists — nothing at checkout can look up what was sent to that address before — so it becomes "flag it and deal with it", not "refuse it".
What Shopivibe does
You describe the outcome you want: "One of these per customer. If somebody tries for a second, stop it and tell them why."
What you get is the rule and a message at checkout that explains rather than just refuses. The sign-in requirement is a switch in your own checkout settings — we will tell you which way to set it and what it costs you, and you flip it.
And nobody hears when it fires. A refusal at checkout tells the shopper and no one else; there is no event anybody can be sent, including us. If you need to know who hit the limit, that is a different design — let the order through and flag it afterwards.
Two things to say plainly. A guest is still a guest: if you do not require sign-in, no rule — ours or anybody's — has a customer to count, so the sign-in setting above is part of the design rather than an afterthought. And checkout rules are built for you, not switched on — a request that reaches into checkout is one a person here takes on straight away and has working in your store within 24 hours.
Shopivibe solves the problem in your store and keeps what it adds maintained, including when Shopify changes something underneath. Shopivibe is free during early access, with 3,500 credits included. Credits beyond the included 3,500 cost $0.06 each.
Know what the limit should be? Describe it in your own words →
Checked against Shopify's documentation and the App Store on 21 September 2026.