Reselling is not one problem. There is the opportunistic buyer who takes twenty because nothing stopped them, and there is the organised operation that will work around whatever you put in place. The first is solved by a rule. The second is managed, not solved, and knowing which you have determines how much effort is worth spending.
Telling the two apart
Before adding rules, look at what actually happened. Sort a drop's orders by quantity and look at the top twenty.
- A long tail of threes and fours, with a handful of twenties. Opportunistic. A per-order cap removes almost all of it.
- Many orders at exactly your maximum, placed within minutes, to a small number of addresses. Organised. A per-order cap is already being respected and routed around.
- New accounts created minutes before ordering, all at the limit. Organised, and account-based rules alone will not hold.
- Different names, same shipping address or same building. The clearest signal there is, and the one no app will flag for you because each order is individually legitimate.
Your product appearing on a marketplace at a markup confirms it is happening but tells you nothing about scale or method, so it is a poor basis for choosing a rule.
The rule that does the most work
A per-order maximum is the obvious first move and the weakest one, because two orders defeat it. The rule that actually changes behaviour is a lifetime cap per customer — a total across all orders, ever, rather than per basket.
It is the difference between "you can have three at a time" and "you can have three". For a limited release where the point is that each customer gets one, this is the only rule that means what you intended.
Staged limits are the other high-value pattern. One per customer for the first 24 hours, three for the rest of the week, then normal. Real demand is served first, the window when reselling is most profitable is the window when limits are tightest, and the rule relaxes without anyone remembering to change it.
Where the rule has to run
This is the part that decides whether any of it holds. A limit enforced on the cart page changes what the cart displays; it does not change what Shopify will accept.
A cart permalink — /cart/VARIANTID:QTY — builds a cart server-side from a URL and goes straight to checkout without your cart page running at all. Buy It Now and dynamic checkout buttons skip the cart by design. The Shop app draws its own interface. Anyone who wants to buy in bulk finds the first of these quickly, and it is a link, not a technique.
Enforcement at checkout, through a Shopify Function, runs server-side when the order is created regardless of what built the cart. Test any app you are considering during its trial: set a limit of 3, open /cart/VARIANTID:10 in a private window, and try to check out. If it completes, the limit is decoration.
Tag-based rules, and their limit
Different rules for different customers is genuinely useful: tighter caps for accounts created in the last thirty days, standard for customers with order history, higher or none for trade accounts.
The catch is that tags are applied by you, usually by an automation, and a brand new account has no history to judge. Tag rules protect you from someone who has been around long enough to be classified. They do nothing on drop day, when every account involved was created that morning. That is what the staged limits above are for.
What rules cannot reach
Per-customer limits identify a customer by account or email. A second address defeats them, and creating one is free. Increasing effort is the goal, not making bulk buying impossible.
Two things extend past that boundary, both manual:
Address clustering. After a drop, group orders by normalised shipping address and look at anything with three or more. This catches the pattern that per-customer rules structurally cannot, and it takes a few minutes with an export.
Cancelling. Rules prevent; cancellations are the only thing that recovers stock already committed. If you intend to cancel coordinated orders, say so in your terms before the drop, refund promptly, and do it before anything ships — a refund on the day is an inconvenience, one after shipping costs you postage twice.
The measures that work on the product rather than the order
Two things change the economics of reselling without touching quantity at all, and both are worth considering before adding a fifth rule.
Requiring an account to buy the release. It adds friction for everyone, which is a real cost, but it means every order has an identity attached rather than a guest email typed once. If you combine it with a cutoff — accounts created before the announcement — the drop-day account farm stops working, and you can say so publicly, which deters more than it blocks.
Pricing closer to what the market will bear. Reselling exists because of the gap between your price and the resale price. That gap is sometimes deliberate — an accessible price point is a brand decision — but if it is accidental, closing part of it removes the incentive that no rule can. It is worth naming out loud rather than treating limits as the only available lever.
The cost of over-tightening
Every rule that stops a reseller also stops some ordinary customers, and they do not complain. They buy less, or they leave.
Check your order distribution before setting a number. If 95% of orders for a product are three units or fewer, a cap of five costs you almost nothing. If a quarter of orders are six units, a cap of five is a revenue decision — and a household buying six of a consumable is not a reseller, they are your best customer.
Apply the tight rules to the products that need them. A blanket cap across the catalogue is easier to configure and quietly expensive.
Say it on the product page
A checkout that blocks without explanation reads as a broken site, and that is where the abandonment happens. "Limit 2 per customer so everyone gets one" next to the quantity selector reads as fairness, and most customers approve — they have been on the wrong end of a drop themselves.
For a lifetime cap, be specific: "one per customer" means something different from "one per order", and a customer who discovers the difference at checkout on their second visit feels tricked rather than governed.
A practical order of work
- Look at the order data from your last drop before choosing any number.
- Put the rule at checkout, and verify with the permalink test.
- Use a lifetime cap where the point is one per person, not a per-order cap.
- Stage the limits for launches instead of picking one number for all time.
- Cluster by address the morning after, and cancel before shipping.
- Say the rule on the product page, in the customer's favour.
Where to go next
Limit enforces per-order and lifetime caps at checkout through a Shopify Function, with tag-scoped rules for trade and new accounts. For the lifetime rule in detail, see per-customer lifetime purchase caps, and flash sales without losing money for the promotional case.
