Here's what happens in your WooCommerce checkout.
- 1
A shopper reaches your checkout.
They came from your ad, your email or a creator you sponsor. They fill a basket and find the coupon box.
35%
of stores with a promo field show it by default. In Baymard's testing, some shoppers left checkout to hunt for a code.
Baymard Institute, Jun 2024(opens the source) - 2
An extension tries the codes it collected.
Honey, Capital One Shopping and others can pop up on your store and type collected codes into the coupon box.
5M+
Microsoft Edge users run Capital One Shopping, before you count Chrome.
Microsoft Edge Add-ons, Oct 2026(opens the source) - 3
A private code reaches another shopper.
Extensions collect codes as shoppers type them. A December 2025 investigation alleged Honey gathered staff, VIP, influencer and newsletter codes this way and published them for everyone.
PPC Land, Dec 2025(opens the source) - 4
The order report doesn't tell the whole story.
WooCommerce records the order's referrer, but its order attribution doesn't identify coupon extensions. A code and commission can cost you margin on the same sale.
WooCommerce documentation, Sep 2026(opens the source)
What most teams try
- You could delete the code. Today's leak stops. The people you made it for find it broken, and the replacement can spread the same way.
- You could make every code single-use. Each shopper needs their own code, and a creator can't share one code with their audience.
Or control the extension session.
Benson hides selected pop-ups across your store and checkout. WooCommerce checks codes against your allowlist in detected extension sessions. A holdout keeps a slice unprotected, so you can compare revenue per session.




