BFCM 2026 order limits checklist: caps, resellers, and resets

Black Friday and Cyber Monday 2026 run November 27 through November 30. If your BFCM plan is “turn on the discount and hope,” here’s what usually happens: your best doorbuster sells out in minutes, and a chunk of that inventory goes to a handful of buyers who refreshed their cart and checked out three or four times in a row.

A security review won’t stop that. Order limits will. This checklist covers the purchase-limit settings worth checking before the rush: quantity caps that actually hold per product, limits that follow a customer across multiple orders instead of resetting at checkout, minimum and maximum order values, and how to reset everything once the sale ends.

If you haven’t done a broader BFCM pass yet, start with our BFCM 2026 security and operations checklist. This post picks up where that one leaves off, on the order-limits side specifically.

Why a cart limit isn’t enough

Shopify has no native quantity cap for regular retail checkout. Outside of Shopify Plus B2B rules, a customer can add any quantity to their cart and check out. Even with a third-party quantity limit applied to the current cart, that limit only sees the cart in front of it. Once the customer checks out, the slate is clean. Nothing stops them from starting a new cart and checking out again five minutes later.

During a normal week, that’s a minor leak. During a four-day sale with your biggest traffic spike of the year, it’s how a doorbuster meant for 200 customers ends up with 40 people holding 5 units each.

Closing that gap takes a short list of settings, checked in order.

Cap quantity per product or per variant, not just per cart

Start with the basics: a maximum quantity rule on your doorbusters and limited-stock items. In DC Order Limits, you choose how the cap groups:

• Any item, so the cap applies to the whole cart as one total
• Product, so each product gets its own cap regardless of how many variants it has
• Product variant, so a size or color gets its own cap separate from the rest

For a doorbuster, “product” or “product variant” grouping usually makes more sense than “any item.” A cap of 2 per product means a customer buying one of your doorbuster and one unrelated item doesn’t get blocked on the unrelated item.

Apply the rule to your BFCM products using tags (something like bfcm-2026 or doorbuster) so you can turn the whole set on and off without editing individual products one at a time.

Make the cap follow the customer, not the cart

A cart-level cap resets every time someone starts a new checkout. If stopping repeat buyers matters for a specific item, a cart cap alone won’t do it.

Customer purchase limits solve this differently. Instead of checking the current cart, they track what a customer has already bought, across every order, and block the next purchase once the customer hits the cap. A customer who got 2 units at 9am can’t come back at 9:15 and get 2 more.

This is also the closest thing to reseller protection that order limits can offer, and it’s worth being specific about the mechanism. The app has no way to identify a bot or flag an account as a reseller. It tracks one thing: the total quantity a given customer account has bought of that product. Once that account hits the cap, checking out a sixth or seventh time under the same login stops working, whatever the reason behind the extra orders.

The gap that’s left is identity. Someone determined to get around a lifetime cap can still try a different email address. Two settings narrow that gap:

• Require login for the eligible products. Customer purchase limits can block guest checkout and require an account for the products the rule covers. Creating a throwaway account is more friction than a disposable email address.
• Watch for the same shipping address or payment details across accounts, manually, if a product is valuable enough to be worth the extra attention. Order limits won’t catch this automatically, but it’s worth a glance at your order list once the sale starts.

Customer purchase limits are a Pro plan feature in DC Order Limits, alongside weight-based limits and mixed cart rules. Standard quantity, price, and increment limits are available on every plan.

Set a minimum order value for your BFCM promotions

If you’re running free shipping or a percentage-off threshold for BFCM, a minimum order value rule enforces it at checkout instead of leaving it as a suggestion on a banner. Set a minimum cart price and shoppers can’t check out below it.

This also protects margin on deep discounts. If a 40% off code makes a single low-ticket item unprofitable to ship, a minimum order value makes sure the code only applies to carts large enough to still work financially.

If you’re also adjusting a free shipping threshold for the sale, our free shipping threshold calculator can help you check the new number against your margins before you commit to it.

Set a maximum order value too

Unusually large orders during BFCM are worth a second look. A cart that’s 10 times your average order size could be a wholesale buyer trying to stock up through your retail checkout, or it could be a stolen card being tested with a big purchase before anyone notices.

A maximum price rule blocks carts above a set total at checkout, before the order ever gets placed. That’s different from catching it after the fact: there’s no order to cancel, no refund to process, and no fraud review that happens after the product has already shipped.

Carve out exceptions without reopening the door

Rules built for BFCM shoppers usually need exceptions for your own staff, wholesale accounts, or VIP customers who should be able to buy more. Exclusion rules let you do that without weakening the main rule:

• Exclude customers with specific tags, so staff or wholesale accounts tagged in Shopify skip the limit entirely
• Exclude specific products, if a doorbuster rule is grouped broadly but one item shouldn’t be included

Set these up before the sale, not during it. Adding an exclusion mid-rush under pressure is exactly when it’s easiest to make the rule looser than you meant to.

Reset your limits before the next sale

Standard quantity and price limits don’t need a reset. They check the live cart every time, so turning the rule off (or changing the product tag it applies to) is enough once BFCM ends.

Customer purchase limits are different, because they track usage over time. A lifetime cap keeps counting toward the same total forever unless you clear it. If your BFCM cap was meant to be a one-time thing for this sale, and not a permanent limit, you have two ways to reset it once the weekend is over:

1. Reset all limits from the rule’s usage page. This clears tracked usage for every customer on that rule at once, so the next sale starts clean.
2. Reset a single customer through Shopify Flow. DC Order Limits exposes a Flow action that resets one customer’s usage on a specific rule, which is useful if you only need to clear a handful of accounts rather than everyone.

Decide which kind of cap you actually want before BFCM starts. “2 per customer for this drop” and “2 per customer, forever” are both valid, but they call for different cleanup afterward.

The short version

• Cap quantity per product or variant for your doorbusters, not per cart
• Use customer purchase limits where repeat buying across orders is the real risk, and require login on those products
• Set a minimum order value if a discount or free shipping threshold needs to hold at checkout
• Set a maximum order value to catch unusually large orders before they ship
• Add exclusions for staff and wholesale accounts ahead of time
• Reset customer purchase limit usage after the sale if the cap wasn’t meant to be permanent

Pair this with the broader BFCM security and operations checklist for inventory, fraud settings, and site performance, and you’ve covered both sides of the sale: what happens to your store, and what happens to your stock.

Frequently asked questions

Does a cart quantity limit stop someone from buying more across multiple orders?

No. A cart-level quantity limit, whether from Shopify’s native B2B quantity rules or a standard app quantity rule, only applies to the cart in front of it. Once a customer checks out, they can start a new cart and buy again. Stopping repeat purchases across orders requires a limit that tracks the customer, not the cart, such as a customer purchase limit.

Can order limits detect bots or resellers automatically?

No. Order limits cap how much a given customer account can buy. They don’t identify who is a bot or flag an account as a reseller. The protection comes from the cap itself: once an account hits its limit, repeat checkouts under that account stop working, regardless of why someone was trying to buy more.

Do I need to reset anything after BFCM if I only used quantity and price limits?

No. Standard quantity and price limits evaluate the live cart each time, so they don’t carry usage forward. Turn the rule off or adjust its product tags once the sale ends. Resets only matter for limits that track customer history over time, like customer purchase limits.

Is there a way to reset one customer’s purchase limit without clearing everyone’s?

Yes. DC Order Limits includes a Shopify Flow action that resets a single customer’s usage on a specific rule, separate from the “reset all” option on the rule’s usage page.

If you want to set any of this up before November 27, DC Order Limits handles quantity caps, customer purchase limits, and price floors from one app. Test your rules with a dummy account before the sale goes live, not after.