A thread on X this week showed shoppers a trick: take a store's address, add /discount/WELCOME10 (or FIRST15, SAVE20) and see whether a discount lands in the cart. It works because of a normal Shopify feature, not a bug. Every discount code has a shareable link at yourstore.com/discount/CODE, and visiting it applies the code. If the code exists and has no restrictions, it works for whoever types it.
That is fine for a code you meant to share. It is a problem for a code you meant only for new email subscribers, or a 30% code you sent to ten VIP customers, if its name is something a stranger could guess. Before Black Friday, when shoppers go hunting for codes, it is worth 15 minutes to check yours.
Why a code is not a secret
A discount code is a word customers type at checkout. Unless you restrict it, Shopify does not know who it was meant for. Shopify lets you set, per code:
- Customer eligibility: all customers, or specific customers.
- Usage limits: a total number of uses, and one use per customer.
- Minimum requirements: a minimum order amount before the code applies.
- Active dates: a start and an end, in your store's timezone.
- Combinations: whether the code stacks with other discount classes.
A code with none of those set is, in practice, a public price cut with a password anyone can guess.
The 15-minute audit
1. List every active code (3 minutes)
In your Shopify admin, open Discounts and filter to active ones. Look at the names. Anything that follows a pattern a shopper would try is guessable:
- WELCOME plus a number, FIRST plus a number, SAVE plus a number
- Your store name plus a number
- Seasonal words: BLACKFRIDAY, BFCM, XMAS, SUMMER
- Generic words: VIP, SORRY, THANKYOU, FRIEND, STAFF
2. Check what each guessable code gives away (5 minutes)
Open each one and note the discount, who it is for, and its limits. Sort them into three groups:
- Meant to be public (on your homepage banner, in a public post). Guessing does not matter. Make sure the dates and minimum order are what you intended.
- Meant for a group (email sign-ups, past customers). Guessing matters. Fix in step 3.
- Meant for a few people (VIP, apology or staff codes). Guessing matters most. Fix in step 3, today.
3. Fix the ones that matter (5 minutes)
- Restrict eligibility where you can: a code for particular customers can be limited to those customers, so a stranger gets an error even with the right word.
- Cap usage: set a total-use limit and tick one use per customer. A leaked code with a 50-use cap can only cost you 50 discounts.
- Add a minimum order amount so the code cannot be used on your cheapest item.
- Set an end date. An old welcome code with no end date is still live years later.
- Retire guessable names. Rather than editing a name that is already out in the world, create a replacement with a name nobody would guess (a word plus random letters, such as WELCOME-K7QF) and deactivate the old one. A shopper who tries a deactivated code sees Shopify's error that it is "Unable to find a valid discount matching the code entered."
If you send the new code to sign-ups automatically, update the welcome email before you deactivate the old one, or new subscribers will get a code that does not work.
4. Put the public Black Friday offer somewhere else (2 minutes)
If the deal is for everyone, it does not need a code at all. An automatic discount applies in the cart and at checkout whenever its conditions are met, so there is nothing to guess and nothing to forget at checkout. Shopify allows up to 25 active automatic discounts, including app-based ones, and they come as amount off, free shipping or buy X get Y. One limit to know: automatic discounts created in the admin do not apply on the post-purchase page at checkout.
Keep codes for the offers that should be private, and check how they combine with the automatic one. Combinations are set per discount, and a 20% automatic offer plus a forgotten 15% code can stack into more than you planned.
Watch for leaks during the sale
Open the Sales by discount report once a day from now through Cyber Monday. It shows how often each code was used. Things to look for:
- A VIP or apology code with more uses than people you sent it to.
- A welcome code used far more often than you got new subscribers.
- An old code you forgot about suddenly being used.
Any of those means the code has escaped, onto a coupon site or a group chat. Deactivate it and issue a fresh one to the people it was for.
Shareable links are still useful
None of this means you should stop using discount links. They are a good way to apply a code for the customer, especially from email or a QR code. Get one from Discounts, open the discount, then Promote and Get a shareable discount code. You can point the link at a specific page instead of the homepage by adding a redirect, for example /discount/CODE?redirect=/collections/gifts. Shopify's limit of five discount codes per order still applies to codes that arrive through links.
The link only applies the code; the code's own settings decide who can use it. So the fix is never to hide the link. It is to make sure every code that is not meant for everyone has a name nobody would guess, a cap, and an end date.
The checklist
- List active codes; mark guessable names.
- Group each one as public, group or few-people.
- For group and few-people codes: restrict eligibility, cap total uses, one per customer, minimum order, end date.
- Replace guessable names with unguessable ones; update automated emails; deactivate the old code.
- Move the public holiday offer to an automatic discount; check combinations.
- Check Sales by discount daily through Cyber Monday.
