What is a reverse proxy clone?
A reverse proxy clone is a fake website that shows your real store’s pages, live, on an address you do not control.
It keeps no copy of your store. When a shopper opens the fake address, the fake server asks your store for the same page. It changes a few details, such as the name, logo, email address or prices. Then it shows the result to the shopper.
You may also see it called a mirror, a live mirror or a proxy site.
This page explains how these clones work and what merchants usually do about them. It is not legal advice.
How is it different from a copied clone?
Most cloned websites are copies. Someone saves your pages and photos once, then puts them on a new address. The copy stays as it was on the day it was made.
A reverse proxy clone fetches every page fresh. That has three effects:
- It looks current. New products, prices, stock levels, sales and blog posts appear on the clone as soon as they appear on your store.
- It is complete. Every page you publish is on the clone, with the same page addresses.
- It is cheap to run. The operator does not need to copy or update anything. One server can mirror a whole store.
To a shopper, a live mirror can be harder to spot than a saved copy, because nothing on it looks out of date.
What are the warning signs?
For shoppers:
- The address is not the brand’s own domain.
- Prices are a little lower than on the brand’s own site. One clone showed prices without UK sales tax.
- The checkout looks different from the rest of the store.
- The checkout asks you to email or message someone before you pay.
For merchants:
- A brand alert, search result or ad points to a domain you do not own.
- The other site has your exact page addresses. Swap your domain for theirs in any link and the page loads.
- Your changes appear on the other site within minutes.
What should you do about a reverse proxy clone?
- Save the evidence. Take dated screenshots with the address bar visible. Record a short screen video while you browse the clone. List your own page addresses and check them against the clone. Do not enter real payment details.
- Find who controls each part. Look up the domain’s registrar, its nameservers and the company that owns its IP address. A clone often has a registrar, a CDN such as Cloudflare and a separate host.
- Check whether it runs on Shopify. Many mirrors use their own checkout and run elsewhere. How to report a fake Shopify store shows how to check.
- Report to each company at the same time. Send phishing or fraud reports to the registrar and to browser blocklists such as Google Safe Browsing. Send a copyright notice for your photos and text to the host. If Cloudflare sits in front of the site, see report a fake store to Cloudflare. The DMCA takedown generator writes the copyright notice.
- Tell your customers. Post your official address and support email. Tell shoppers who paid the clone to contact their bank.
- Keep a log. Record each report, its reference number and the date.
For one merchant’s full account, with every report they filed, read a reverse proxy clone of a Shopify store.
Can a notice on my store show up on the clone?
Yes, while the mirror is live. A mirror fetches your pages fresh, so a short announcement on your store appears on the clone too. One merchant did this, and the notice appeared on the clone at once.
Word it calmly, because your own customers see it as well. “Our only official website is yourstore.com” is enough. A loud scam warning can make your own store look unsafe. Remove the notice once the clone is down. This does not work on a saved copy.
Recon can show a warning like this on a clone that mirrors your store, and never on your own domains. You turn it on from the clone’s case in the app. See how to warn shoppers on a clone.
Can you block a reverse proxy clone?
Not reliably. A mirror asks for your pages the same way a shopper’s browser does. Right-click blocks, copy blockers and image scripts do not stop it.
What you can do is find it sooner and report it to the right companies.
How Recon fits
Recon is a Shopify app that watches for clones of your store and suspicious lookalike addresses. On every plan, for each clone Recon finds, it works out who to report it to and writes the notices. You review and send them. The host or registrar decides whether to remove the site. Recon does not remove sites.
If you add Recon’s optional theme block, Recon alerts you when a clone loads your store’s pages. Pro sends clone alerts by email straight away. Free reports new clones in your weekly summary. Recon cannot find every clone. Keep your other checks, such as a Google Alert on your brand name, in place.
The free website check looks for clones on addresses built from your brand name. Clones on unrelated addresses need the installed app.
FAQ
Q: Is a reverse proxy clone hosted on Shopify?
A: Usually not. The mirror runs on its own server and fetches your Shopify pages. Shopify can only act on stores that run on Shopify, so report to the host, registrar and CDN as well.
Q: Does a reverse proxy clone have access to my store’s admin or customer data?
A: No. It loads the same public pages a shopper sees. Payments made on the clone go to the clone’s operator, not to your store.
Explore Recon’s Shopify brand protection tools
All knowledge