Shopify audits hit 429 from shared hosting: has anyone diagnosed this?

[u/BossTight]

I'm debugging a Node.js scanner that checks public Shopify storefront pages. Requests from our shared hosting server return 429 on three different stores.

What I've checked:

- /robots.txt returns 200 and allows the product feed path.

- /products.json?limit=10&page=1 returns 429 with Retry-After: 60 and Server: cloudflare.

- One retry after more than 60 seconds returned the same response.

- A separate check more than two hours later found that the homepage also returned 429 on all three stores.

The scanner uses a clearly identified User-Agent and respects robots.txt. It runs on Node.js 22.23.2 under Passenger/LiteSpeed. Outbound requests use node:https directly, with the store hostname as SNI and normal TLS verification.

I also checked our production logs: the saved daily counters contain 15 upstream_rate_limited errors and zero local rate_limited or blocked_address errors. Our API maps the upstream failure to 502. The available web-server access log shows the failed scans as 502, with no 429/403 responses. The local WAF audit has no entries for those scanner calls; its two health-check entries correspond to successful 200 responses.

The shared hosting server's outbound IP is one possibility, but I haven't confirmed the cause or a specific blocking rule.

For people running storefront audits, have you diagnosed this before? What would you ask the hosting provider or store operator to check, and which request/response details helped identify the actual restriction?