Here's what happens in your custom checkout.
- 1
A shopper reaches the checkout you built.
They came from your ad, your email or a creator you sponsor. They fill a basket and find the coupon field.
35%
of stores with a promo field show it by default. In Baymard's testing, some shoppers left checkout to hunt for a code.
Baymard Institute, Jun 2024(opens the source) - 2
An extension tries its codes.
Honey, Capital One Shopping and others can pop up on your storefront and checkout, then type collected codes into the discount box.
5M+
Microsoft Edge users run Capital One Shopping, before you count Chrome.
Microsoft Edge Add-ons, Oct 2026(opens the source) - 3
Codes made for someone else get shared.
Extensions collect codes as shoppers type them. A December 2025 investigation alleged Honey gathered staff, VIP, influencer and newsletter codes this way and published them for everyone.
PPC Land, Dec 2025(opens the source) - 4
The discount and commission cost you.
The order can look normal while a leaked code takes money off the basket and an extension receives affiliate commission.
Modern Retail, May 2024(opens the source)
What most teams try
- You could delete the code. Today's leak stops. The people you made it for find it broken, and the replacement can spread the same way.
- You could make every code single-use. Each shopper needs their own code, and a creator can't share one code with their audience.
Or control what happens on your checkout.
Benson hides selected extension pop-ups and guards the coupon field in detected extension sessions. Your developers can use its signals in your own checkout. A holdout compares revenue per session with and without protection.




