How to stop discount codes leaking on Shopify

Where Shopify discount codes leak from, the settings that limit the damage, what you can still control in checkout, and what to do about past orders.

Author:Benson
Merchant controlsUpdated 17 October 202615 min read
Jump to a section

In short

No Shopify setting stops a code being shared. Unique codes, usage caps, one use per customer, eligibility and end dates limit who a code works for and for how long. Turn off Google featuring for private codes, watch the discount report, and in checkout use a discount function that rejects leaked codes in coupon-extension sessions.

Monday's sales report has a code on it you'd half forgotten: STAFF40, the one for the team. It's on 31 orders from the weekend, from email addresses you don't recognise. The code you gave a creator last month is up too, on orders from people who never clicked her link.

You search for STAFF40 and find it on two coupon sites, with a note that it was "verified" on Saturday. Nobody on the team posted it. Nothing on the orders says where the shoppers got it.

A Shopify discount code is a word that works for anyone who types it, unless you set it up otherwise. This guide covers where codes leak from, how to spot one that has, the Shopify settings that limit the damage, what can still be controlled in checkout as of October 2026, and what to do about orders already placed.

Where do Shopify discount codes leak from?#

From anywhere a code can be seen or typed: coupon extensions at checkout, coupon sites, Google, your creators' audiences and your own discount links.

Coupon extensions. Browser extensions that test codes at checkout also collect them. Honey's help centre invites its members to add codes they find, which Honey tests before sharing [Honey Help Center, Oct 2026] (opens the source). Capital One Shopping's says it watches which codes work for its shoppers and shares them with others [Capital One Shopping Help Center, Oct 2026] (opens the source). So a code typed once by one customer with an extension can reach every other shopper with it. MegaLag's December 2025 investigation, reported by PPC Land, alleges Honey sent codes to its servers as shoppers typed them, before asking permission to share them. In the same report, Made In's CEO said a friends-and-family code that was never published turned up on Honey; Honey said a user had added it [PPC Land, Dec 2025] (opens the source). The Honey guide and the Capital One Shopping guide cover those two extensions in detail.

Coupon sites. Coupon sites list codes for your store whether or not you sent them, and they can be slow to clean up. P.F. Candle Co.'s founder told Modern Retail in 2024 that without a direct contact there, a code on RetailMeNot is really hard to get scrubbed [Modern Retail, May 2024] (opens the source).

Google. Shopify can send your discounts to Google as promotions. Google's Merchant Center help says codes sync once they're published to the Google & YouTube channel, and that discounts targeted to specific customers aren't supported [Google Merchant Center Help, Oct 2026] (opens the source). In Shopify, the discount's sales channel access setting decides which channels can feature it. Check it on every private code. It controls where a code is featured, not where it works: a shopper can still redeem it on every channel you sell on, AI channels included, as the guide to agentic commerce and your discount codes explains.

Creators, partners and print. A code read out in a video or printed on an insert is public by design, and some can't be changed. Anyday's founder told Modern Retail that a code printed in a partner's product booklet had leaked, and that a printed code can't be taken back [Modern Retail, May 2024] (opens the source). The creator codes guide covers who gets paid when those codes travel.

Your own emails and links. In email, most codes go out shared, not unique. Seguno's August 2025 report on 65,055 newsletters from US-dollar Shopify stores using its email app (May 2024 to May 2025) found generic codes in 12% and unique codes in 4.2%; the rest had no code [Seguno, Aug 2025] (opens the source). A shared code in an email is one forward away from a coupon site.

How do you know a code has leaked?#

A code is out when it's used by more people than you gave it to, or by people you never gave it to.

Shopify has three places to look.

  • The discount report. The Sales by discount codes report groups sales by discount, with the code, the discount amount and the order count. A staff, VIP or creator code with a jump in orders is the first sign.
  • The orders list. Filter orders by discount code, then pick a specific code to see every order that used it, and check the customers against the list you sent it to. If you export to a spreadsheet instead, the CSV's discount column leaves out automatic discounts.
  • An alert. Shopify Flow has a template called "Get notified when specific discount code is used". Point it at your private codes and you hear about a leak the day it starts.

Brands describe the same pattern. In Modern Retail's 2024 report, Anyday's founder said they usually spot a leak when a code's revenue suddenly spikes, then find it on Honey or another coupon site, and that they can't precisely track where leaks come from [Modern Retail, May 2024] (opens the source).

The free code check goes the other way: type your store's address and it shows which of your codes coupon extensions and coupon sites already hold. If a code is out, the first-hour steps are at the end of the section on orders already placed, below.

What does a leaked code cost?#

The discount on orders that would have happened anyway, and the meaning of the code.

Those inputs sit close to published figures. Ethercycle's 2026 study of 10 of its clients' Shopify stores put the median discount on discounted orders at 19.96% of the basket [Ethercycle, Jul 2026] (opens the source), Partnerize's Q2 2025 Americas index put the average order through coupon and value-proposition partners at $115.24 [Partnerize, Sep 2025] (opens the source), and Aswath Damodaran's January 2026 data puts the gross margin of US-listed apparel companies at 56.88% [Aswath Damodaran, NYU Stern, Jan 2026] (opens the source). The share who'd have paid full price isn't published for leaked codes. Only a test on your own store gives it to you.

$349K

given back by one evergreen code left live all year, the biggest in Ethercycle's 2026 study of 10 client stores.

Ethercycle, Jul 2026(opens the source)

The costs outside the sum are slower. A staff code stops being a perk once strangers have it. A creator gets credit for sales they didn't drive, or loses it, depending on your settings. And Anyday's founder put it plainly: a sale on a leaked code is worth significantly less to the brand [Modern Retail, May 2024] (opens the source).

Which Shopify settings stop a code leaking?#

None of them stops a code being shared. They decide who it works for, how often and for how long, and each has a catch. The guide to shared, unique and single-use codes covers which type suits which channel.

  • Unique codes. One code per customer, generated in bulk by an email app or the API. Shopify allows 20,000,000 unique codes per store across all discounts, and apps can't raise that. The catch: a unique code can still be collected before it's used. Outway's founder told AdExchanger in 2023 that Honey still applied a 20% code auto-generated for some other shopper, even for customers willing to pay full price [AdExchanger, Jun 2023] (opens the source).
  • Limit number of times this discount can be used in total. This setting caps a code's total uses. The catch: the first strangers to find it can use up the cap before your customers do.
  • Limit to one per customer. Shopify tracks this by email address or phone number. The catch: a new email address is a new customer. Shopify's help also says that if you delete a discount and create a duplicate, customers who used the old one can use the new one once.
  • Customer eligibility. Choose specific customers (up to 100) or customer segments, and Shopify checks the shopper's email or phone at checkout. The catch: it only works for customers who already have a profile, so it's no use for a welcome code.
  • Minimum purchase requirements. A minimum amount or quantity makes a leaked code less useful on small orders. The catch: it doesn't stop it on large ones.
  • Active dates. An end date limits how long a leak lasts. Shopify's help notes that a code with no end date never expires. The catch: a code printed on packaging or recorded in a podcast can't be replaced on a schedule.
  • Sales channel access. Turn off featuring on channels where a private code shouldn't appear, Google included. The catch: Shopify says you can't restrict which sales channels a code is redeemed on, only where it's featured.

When a code is out, deactivate it and shoppers who type it see "Unable to find a valid discount matching the code entered." Renaming a code or deactivating and reactivating it doesn't reset its usage history, so a capped code stays capped.

No. A Shopify discount link is the code in a URL.

Shopify builds a shareable discount link as /discount/ followed by the code, and saves the discount to the shopper's cart and browser. The same code still works typed into checkout, and a link only works while the discount is active. Anyone who sees the link, the cart or the discount box sees the code.

Links are still worth using. They save shoppers typing, and creators' links carry tracking a spoken code doesn't. But a link doesn't make a private code private. If a link has gone further than you meant, treat its code the way you'd treat any leaked code.

What can you still control in Shopify checkout in 2026?#

The codes, not the browser. Shopify has closed checkout to scripts over the last three years, and the one control left that touches codes on every plan is the discount function. Here is where each tool stands in October 2026.

ToolWhat it can do about codesPlans
checkout.liquidStopped working on the information, shipping and payment pages on 13 August 2024None
Shopify ScriptsDeactivated on 30 June 2026None
Checkout UI extensionsAdd blocks in a sandbox with no access to the checkout page; can read, add and remove codes through the Discounts API, but not in accelerated checkoutPlus, on the information, shipping and payment steps
Cart and checkout validation functionsCan stop a checkout on cart rules, but don't see discount codesAny plan from a public app; Plus for a custom app
Discount functionsSince December 2025, can reject an entered code with a message, when the function backs an automatic discountAny plan from a public app; Plus for a custom app
Coupon extensionsRun in the shopper's browser, so no app or setting switches them offNot an app

The sources: Shopify's checkout.liquid deprecation notice, the Script Editor help page, the checkout UI extensions docs, a September 2025 thread on Shopify's developer forum where staff explained the express checkout and validation limits, the Functions plan rules, the December 2025 changelog entry for discount rejection and the discount rejection tutorial.

Two details matter if you build your own. Rejection only works from a function attached to an automatic discount, and those count towards Shopify's limit of 25 active automatic discounts, app discounts included. And the function sees the cart and the codes, not the browser, so on its own it can't tell a coupon extension trying a code from a customer typing the one you emailed. The guide to coupon extensions in Shopify checkout goes through the same limits from the extension side.

What should you do about orders already placed with a leaked code?#

Decide before you act: honour them, cancel them, or honour them and retire the code. Shopify limits what you can change after the fact.

  • You can't take the code off an order. Shopify's order editing can't add, remove or update an order-level discount.
  • You can cancel, with costs. Cancelling comes with a refund to the original payment method by default (or store credit, or later), but card transaction fees aren't returned to you, and once an order is partly fulfilled it can't be cancelled.
  • Cancelling has precedent. In 2017 UGG cancelled orders placed with a 60%-off code from an internal employee event that had reached the public, then offered those shoppers 15% off a future order [NBC Connecticut, Dec 2017] (opens the source).

Whether you can cancel is a question for your terms and your lawyer, not this guide. Trading standards guidance for England, Scotland and Wales says a contract is made if and when the trader accepts the order [Business Companion (Chartered Trading Standards Institute), Mar 2026] (opens the source), and your terms say when that happens. Criminal law is a separate question. In England, Wales and Northern Ireland, the Fraud Act's false-representation offence needs someone to dishonestly make a representation they know is or might be untrue, intending to gain or cause a loss [legislation.gov.uk, Nov 2006] (opens the source). That is the statute, not a ruling on leaked codes, and other countries' rules differ.

In the first hour after you find a leak, work in this order:

  1. Confirm it. Filter orders by the code and check the customers against the list you sent it to.
  2. Find where it's listed. Run the code check to see which coupon extensions and coupon sites hold it.
  3. Deactivate it. Shoppers who type it then see Shopify's invalid-code message. For a code you can't take back, such as one printed on packaging, add an end date and a minimum purchase instead.
  4. Send the replacement. Give the people it was for a new code under the settings above, unique where you can, and point your Flow alert at it.
  5. Decide on the orders. Honour, cancel, or honour and retire, before anyone replies to a customer about it.

The leaked codes playbook has the same steps with the follow-up.

How Benson stops leaked codes working#

Benson works on the one control Shopify leaves open, the codes, and its code policy acts only in sessions where a coupon extension is present.

  1. See which codes are out. The code check is free and needs no install. It shows which of your codes coupon extensions and coupon sites hold.
  2. Install Benson and watch. Add Benson from the Shopify App Store. The Free plan's observe mode records which sessions have a coupon extension in them. The Shopify install guide has the steps.
  3. Turn on the strict code policy. When Benson's storefront script sees a coupon extension, it notes that on the cart, and Benson's discount function reads the note. With the strict policy on, only codes on your allowlist work in coupon-extension sessions; a leaked staff, VIP or creator code gets a short message instead of a discount. The function backs one automatic discount, which is what Shopify's code rejection needs, and because it ships in a public app it works on every Shopify plan. Checkout policies are on the Stop plan.
Sample store
Codes tried in coupon-extension sessions, and which ones the policy allows. Sample data.
  1. Keep your customers' codes working. The policy only acts in coupon-extension sessions, so a customer without an extension who types the code you sent them still gets their discount. Put your public welcome and loyalty codes on the allowlist.
  2. Watch each code after you change it. Code watch follows each code that spreads through extension sessions and shows whether it's contained, replaced, or its replacement is spreading too.
  3. Cap code guessing by agents. Agent policy, on Stop and above, limits how many codes AI agents and automated browsers can try per visit.
  4. Measure it. Every control can run against a holdout, a random share of extension sessions that keep the old experience, so you see what the policy earns on your own shoppers. The holdout guide explains how to read it.

A code that's been copied onto a coupon site can still be typed by hand outside an extension, so retire or limit those once you've seen how far they went.

How codes leak, how to find the ones that have, and how to contain them.

To start, run the code check on your store, then add Benson from the Shopify App Store and leave it in observe mode for a week.

Questions merchants ask

How do I stop my Shopify discount codes from leaking?
Give private audiences unique or capped codes, set end dates, limit eligibility where you know the customer, and turn off featuring on channels like Google for private codes. None of those stops a code being shared, so watch the discount report and make leaked codes fail in coupon-extension sessions with a discount function.
Do single-use codes stop leaks?
They limit them. A single-use code can only be redeemed once, but it can still be collected before it's used, and creators can't read a unique code out to an audience. Use them for email, SMS and customer service.
Can Shopify stop coupon extensions in checkout?
No. Extensions run in the shopper's browser, and Shopify doesn't let apps reach the checkout page. Since December 2025 a discount function can reject entered codes, which is how an app can make leaked codes fail in checkout.
Is it illegal to use a leaked discount code?
It's mostly a question of the store's terms, and the usual remedy is cancelling the order. Knowingly using a code you know wasn't meant for you can go further: in England, Wales and Northern Ireland, fraud by false representation requires dishonesty. This isn't legal advice; ask a lawyer where you trade.
Can I cancel orders that used a leaked discount code?
In Shopify you can cancel and refund an order unless it's partly fulfilled, but card fees aren't returned and you can't remove the code by editing the order. Check your terms first, and decide whether to honour, cancel or honour and retire the code.

Sources#

Keep the decision moving

Find out what's leaking. 14 days of Own, no card.

No card. 14 days of everything in Own, then Free unless you pick a plan. We'll email you about your trial. Unsubscribe any time.