Most stores add purchase limits the week after they needed them — one buyer took 500 units, or a promotion was cleared out by four orders. The rules themselves take twenty minutes. The part worth thinking about first is where the rule is enforced, because a limit that lives in the cart is a suggestion, and the people you are trying to stop know that.
The four situations that actually call for a limit
A limited release
You have 200 units and 3,000 people want them. Without a cap, a handful of buyers take a third of the stock and your real customers get a sold-out page. You sold the same number of units either way — what you lost is 2,800 people's next visit, and the units ended up on a marketplace at a markup with your brand attached.
A promotion
A 40% offer without a cap is an invitation to buy your entire stock at 40% off. The discount was priced as a customer-acquisition cost across many small orders; four large ones turn it into a wholesale deal you did not agree to.
Wholesale and retail on one store
Here you need limits pointing in both directions at once — a minimum for trade accounts, because picking a two-unit order costs more than it earns, and a maximum for retail, because a retail price on a case quantity is a margin you cannot recover. Both rules on one catalogue, scoped by customer tag.
Samples and loss leaders
Anything priced below cost to win a customer needs a hard per-customer cap, usually one, and usually for life rather than per order. Without it the product does exactly what it was designed to do, for people who were never going to buy anything else.
Why the cart is the wrong place to enforce it
This is the part that decides whether the rule works, and it is not obvious from an app listing.
A limit implemented in your theme or by a script on the cart page changes what the cart shows. It does not change what Shopify will accept. There are several ordinary paths straight past it:
-
Cart permalinks. A URL of the form
/cart/VARIANTID:QTYbuilds a cart server-side with whatever quantity is in the link and goes straight to checkout. Your cart page never runs. - Buy It Now and dynamic checkout buttons skip the cart entirely by design.
- The Shop app renders its own interface, not your theme.
- The Storefront API, which is how any headless or app-driven purchase path builds a cart.
You do not need to be technical to use the first one. It is a link. Anyone who has seen it once can use it forever.
The enforcement point that holds is checkout, through a Shopify Function — server-side validation that runs when the order is created, whatever built the cart. A cart-page message is still worth having, because it tells honest customers the rule before they get attached to a basket. It is just not the thing doing the work.
The test that settles it in two minutes
Take a product with a limit of 3. Find the variant ID, open /cart/VARIANTID:10 in a private window, and try to check out. If the order goes through, your limit is decorative — regardless of what the cart page said. Run this on any app you are evaluating during the trial, not after you have migrated your rules into it.
The rule types worth knowing
- Per-order maximum — "max 3 per customer". The common case, and the weakest on its own: nothing stops four orders.
- Per-order minimum — "minimum 6", the wholesale side.
- Quantity increments — multiples of 6 or 12, for anything that arrives case-packed. Breaking a case to fill an odd order costs warehouse time the order price rarely covers.
- Lifetime cap per customer — "one, ever". The only rule that survives someone ordering repeatedly, and the right one for samples and one-per-household releases.
- Cart-level limits — a maximum order value or total item count, useful when the risk is the basket rather than any single line.
- Tag-scoped rules — the same catalogue behaving differently for trade, VIP and new accounts.
Most stores need two of these, not all six. Start with the one that matches the problem you actually have.
Choosing the number
The instinct is to set the cap where it feels safe. That costs money quietly, because a limit below what ordinary customers buy turns a normal order into a support conversation.
Look at your order data first. If 95% of orders for a product are three units or fewer, a cap of 5 stops the abuse and touches almost nobody. If a quarter of orders are six units, a cap of 5 is a revenue decision you are making without realising it — those customers do not email you, they just buy less.
For a launch, staged limits work better than one number: one per customer on day one, three after a week, normal after that. Real demand is satisfied first, and the rule relaxes on its own instead of needing a diary entry.
What a limit cannot do
Per-customer rules identify a customer by account or email. Someone determined enough will use a second address, and a per-order cap is trivially beaten by placing two orders. Limits raise the effort involved; they do not make bulk buying impossible.
That is usually enough. Most of what these rules prevent is opportunistic rather than organised — the buyer who would have taken twenty because nothing stopped them, not a professional operation. For organised reselling you also need lifetime caps, some scrutiny of orders that share an address, and a willingness to cancel.
What happens to orders that were already placed
A rule you add today does not touch an order from yesterday, which sounds obvious and catches people out during a live incident. If a promotion is being cleared out right now, adding the cap stops the next order and nothing else. The orders already in your queue have to be cancelled by hand, and that decision is worth making quickly — a refund on the day of purchase is an inconvenience, while one issued after the parcel has shipped costs you the postage in both directions.
It is also worth deciding in advance what you will do about orders that technically comply but obviously coordinate: five separate orders, same address, same day, different names. A limit app will not flag those because each one is legitimate. A saved search on shipping address, run on the morning after a drop, will.
The message matters more than the rule
A blocked checkout with no explanation reads as a broken site. "Limit 3 per customer so everyone gets one" reads as fairness, and customers accept it — most of them approve of it, because they have been on the losing end of a drop before.
Say the limit on the product page as well, near the quantity selector, not only at checkout. The rule you learn at the end of the process is the one that feels like a trick.
Where to go next
Limit enforces minimums, maximums, increments and lifetime caps at checkout through a Shopify Function, so the cart permalink test above passes. For the lifetime rule specifically, see per-customer lifetime caps; for promotions, flash sales without losing money. The MOQ guide covers the wholesale side in full.
