Here's what happens in your Shopify checkout.
- 1
A shopper you paid for reaches checkout.
They came from your ad, your email or a creator you sponsor. The discount box is right there, so they go looking for a code.
35%
of stores with a promo field show it by default. In Baymard's testing, some shoppers left checkout to hunt for a code.
Baymard Institute, Jun 2024(opens the source) - 2
An extension types your codes into the box.
Shopify retired checkout scripts in 2024, so no app can touch an extension's pop-up in checkout. The extension runs in the shopper's browser. It still sees the box and tries every code it holds.
Shopify Changelog, Feb 2023(opens the source)5M+
Microsoft Edge users run Capital One Shopping, before you count Chrome.
Microsoft Edge Add-ons, Oct 2026(opens the source) - 3
The codes it tries were never meant for it.
Extensions collect codes as shoppers type them. A December 2025 investigation alleged Honey gathered staff, VIP, influencer and newsletter codes this way and published them for everyone.
PPC Land, Dec 2025(opens the source) - 4
You pay for the discount and the commission.
The order looks normal. But the code cost you margin, and a creator or the extension's network can still be paid for a sale they didn't send.
Modern Retail, May 2024(opens the source)Nearly 80%
of US affiliate programmes pay on last click, so the last link before checkout gets the commission.
Performance Marketing Association, Jul 2026(opens the source)
What most teams try
- You could delete the code. Today's leak stops. The people you made it for find it broken, and the replacement spreads the same way.
- You could make every code single-use. Coupon sites lose interest. So does the creator who reads one code out in a video.
Or control them where the extension works.
Benson spots the extension in the session and hides its pop-ups on your storefront by rule. At checkout, only the codes you allow work in its sessions. A holdout keeps a slice unprotected, so you see what it saved.
