Best fake website takedown services for online stores

Who can take a fake store down?

Start with what the site does. If it asks visitors for logins or card numbers, it's phishing: report it to Google Safe Browsing, which puts a warning in Chrome in front of flagged sites. A warning isn't a removal, though. If the site is selling your products with your photos, those photos are your claim, and the company that runs the store's server is the one that can remove them.

Is the copy on Shopify?

Then Shopify takes it down, through its own copyright form, and says it will "generally remove the reported content from its platform". When we file with Shopify, it takes one notice per store, listing every stolen photo on its pages, and sends no acknowledgement back. It also refused one of our notices because the store wasn't hosted by Shopify. Our Shopify theme detector shows whether a store runs on Shopify before you file. A copy that uses your name but none of your photos is a different complaint, on Shopify's separate trademark form, and our guide to takedowns without a registered trademark covers what still works.

Is it on its own web host?

Then the notice goes to the host. A US host keeps its legal protection only if it removes the material "expeditiously" after a proper notice, under 17 U.S.C. 512(c). The notice must name your work, point to the copy, give your contact details, and include a good-faith statement and a statement under penalty of perjury that you're authorized to act. Our free notice generator writes the notice from your details.

What if it's behind Cloudflare?

Cloudflare says it "does not host content" through its proxy services and will forward your complaint to the site's operator and host. In our filings, its reply named the real host and that host's abuse address, so that's where the next notice went. The server holding the photos isn't always the one serving the page, either: one cloud provider took our notice, then wrote back that the store wasn't on its servers. Our guide to reporting a website to Cloudflare walks through the form.

How do you tell who hosts it?

Not from the server header alone. Shopify's storefronts sit behind Cloudflare, so a copy on Shopify answers with "server: cloudflare" too, and a first report can go to the wrong company. The same response also says "powered-by: Shopify", and the domain points to the same address as Shopify's own stores. For anything that isn't Shopify, look up who owns the IP address the domain points to. That company's abuse desk is the host.

When is the registrar the right door?

When the whole domain exists to pass as your store, like a name one letter off yours. The registrar acts on the domain, not on your photos. ICANN's 2024 abuse rules for registrars leave "website content abuses" out, and one registrar's own abuse form acts on copyright only when it hosts the site itself. Registrars can also just go quiet: one we wrote to returned nothing for seven days, not even an autoresponder. Our guide to IP reports that go nowhere covers what to do then.

For one fake store, you can file all of this yourself, free. Our copycat store checker gives you a dated record of the photos the two stores share, and the guide for when someone copied your website covers the rest. What a service adds is the watching: finding the next copy, on whatever domain it moves to. Our domain squatting scanner shows the misspellings of your domain that are already registered.

Which one fits your store?

Want the copies found and filed for you?

Knockoff is for Shopify brands whose fake sites are copies of their store. You connect your store by its domain, with no API key and no access to your orders or customers. Every day Knockoff searches the open web for your product photos, and it spots new domains built on your brand name the day they appear, plus the other stores the same operator runs.

You sign one Letter of Authorization. From then on a person at Knockoff files each confirmed copy as your authorized agent: on Shopify's own form for a Shopify store, with the web host for anything else, and with the registrar for a domain posing as your store. Every case comes with an archived copy of the page, a timestamped screenshot and your photo beside theirs. It's $799 a month, with no contract and a 30-day money-back guarantee that ends when we file your first notice.

DomainsIntel checks new and existing web addresses for your brand name every day, opens each site, and has its team review every finding before it reaches you. You can request a takedown from its email or turn on automatic takedowns, and it prepares the evidence and follows up. On its pricing, Protect is $199 a month for one brand with 3 takedowns a month on the monthly plan, and Scale is $399 for up to three brands with 10. Annual plans cost the same each month but give Protect 50 takedowns a year and Scale 150. Your first takedown is free with its report. Unused takedowns don't roll over, a takedown counts only once the site is down, and a new domain counts as a new takedown.

Would you rather decide what gets reported?

StoreLock is a Shopify app that watches new registrations for names built to look like yours, spots storefronts copied from your catalog and searches for your product photos on other sites. On Premium, $19 a month, you decide what gets reported, and StoreLock sends the abuse report or DMCA notice to the hosting provider and the registrar, up to the plan's monthly limit. On Enterprise, $399 a month, its team handles each case and follows up. Both start with a free 3-day trial. Our StoreLock review goes through each plan.

Recon is a Shopify app that watches for copied storefronts and lookalike domains. Its free plan checks weekly and gives you screenshots and ready-to-send takedown templates. Pro, at $50 a month or $480 a year, monitors around the clock, scans 200 lookalike and typosquat domains, and adds DMCA templates and emails. Recon prepares the reports. You send them.

What about the services with no price on their site?

Most of Google's first page for "fake website takedown services" belongs to companies built for phishing, sold to security teams. Netcraft offers "brand protection from phishing, fraud, and scams", finds lookalike domains and files takedowns for you, and its pricing page is a form for a custom quote. Bolster covers lookalike sites, fake listings and storefronts with automated takedowns backed by analysts, and its site offers a demo and no price.

Two brand protection companies come up in AI answers to the same question. BrandShield watches new domain registrations, DNS records and certificates, and its enforcement team takes sites down "at the registrar, registry, and hosting level". It sells by demo, with no price on its site; our BrandShield review covers what it costs. Red Points offers fake website protection with its counterfeit plans, and its pricing page says it "works with mid-market and enterprise companies", with every plan marked Request pricing. More in our Red Points review.

For the wider market, including the companies built for marketplace listings, see the best brand protection companies, or read how Knockoff handles sites posing as your brand.