How to stop customers from buying all stock during a Shopify drop

You launch a limited drop. Five minutes later, one person bought everything. The rest of your customers see "sold out" and leave frustrated.

A single "max 1 per customer" rule is the obvious fix, and it is the right starting point. But hoarding during a drop is really an inventory-distribution problem: your goal is to get scarce stock into as many hands as possible, and a determined buyer has more than one way to grab a pile. This article covers the full toolkit — not just the one rule.

If all you need is the exact setup for a one-per-person cap, start with Shopify max 1 per customer: practical setup options, then come back here for the surrounding tactics.

Why one buyer can clear your stock

By default, Shopify tracks inventory at the variant level. If you have 100 units and someone adds 100 to their cart, the system allows it — as long as the stock exists. There's no native setting that says "maximum 3 per order" or "maximum 1 per customer per day."

That gap gets exploited in predictable ways during a hyped drop:

One cart with a huge quantity
Many small orders from the same buyer, minutes apart
Multiple guest checkouts with different emails
Bots adding to cart faster than humans can

Each of these needs a slightly different defense. Relying on a single rule leaves gaps.

The toolkit for spreading stock

Think in layers. Most stores combine two or three of these, not just one.

1. Per-customer quantity cap

The baseline: "max 1 (or 2) per customer" so no single account can take a large share. This is the rule most people mean when they say "purchase limit." The detailed setup — variant vs collection scope, cart vs checkout enforcement, guest handling — lives in the max 1 per customer guide.

2. Per-order quantity cap

A cap like "max 3 units per order" is a blunter, simpler guard that also applies to guests who never log in. It won't stop someone placing five separate orders, but it kills the single-cart sweep instantly and is trivial to configure.

3. Time-based limits to slow repeat buyers

This is what a per-order cap misses: the same buyer placing order after order. A rolling limit like "max 2 per customer per 24 hours" or "1 per customer for the duration of the drop" spreads stock across the sale window instead of the first ten minutes. Time-based rules need an app that reads purchase history by customer or email — see purchase limits by day, week, or month for how rolling versus calendar windows behave.

4. Tiered access by customer tag

Reward loyalty without opening the floodgates: give vip or early-access tags a higher cap (or earlier entry), and hold everyone else to the strict limit. Tag-based rules let one product page serve different limits to different segments.

5. Bot mitigation

Purchase limits raise the effort, but sophisticated bots bypass guest-cart limits by rotating accounts, emails, and sessions. If your drops are valuable enough to attract bots, layer a dedicated tool (Shopify's own bot protection or a third party) on top of quantity rules. Limits make it harder for one person to clean you out; they don't make it impossible for a determined operation.

6. Communication and queuing

Half the frustration is surprise. State "Max 1 per customer" on the product page and in your announcement so buyers know the rule before they click. For the biggest drops, a queue or waitlist app smooths the traffic spike and makes the limit feel fair rather than arbitrary.

Where these rules are enforced

The distinction that matters: a rule enforced in the theme (a max="1" on the quantity input) is a UX hint that bots and cart edits ignore. A rule enforced at the cart or checkout — via an app's cart validation or Shopify Functions — actually blocks the order. For anything you care about protecting, enforce at cart or checkout, not just in the storefront.

On Shopify Plus you can build this with Shopify Functions (Cart and Checkout Validation). On any plan, a purchase-limit app is the practical route, and most enforce at the cart so buyers get feedback before checkout.

A layered example

You're dropping 200 units of a limited hoodie and want it to reach at least 150 customers:

Per-customer cap: max 1 per customer (see the setup guide).
Per-order cap: max 1 per order, so guests are covered too.
Time window: 1 per customer for the full drop, so no one re-buys after selling out others.
Tag exception: vip customers get early access, still capped at 1.
Announce it: "One per customer. Be quick — 200 available."

That combination defends against the big cart, the repeat buyer, and the guest workaround at once, while keeping the message simple for honest shoppers.

FAQ

What's the difference between a per-order and a per-customer limit?

A per-order limit caps units in a single cart (and works for guests who never log in). A per-customer limit caps units across all of that customer's orders, which requires identifying them by account or email. For drops, use both: per-order stops the single sweep, per-customer stops repeat buying.