[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog-post-audit-guessable-discount-codes-black-friday":3},{"slug":4,"title":5,"body":6,"summary":7,"tags":8,"author":14,"cover_url":15,"published_at":16,"seo_title":17,"seo_description":18,"reading_minutes":19,"related":20},"audit-guessable-discount-codes-black-friday","Anyone can type \u002Fdiscount\u002FWELCOME10 after your store's URL: auditing guessable discount codes before Black Friday","\u003Cp>A thread on X this week showed shoppers a trick: take a store's address, add \u003Ccode>\u002Fdiscount\u002FWELCOME10\u003C\u002Fcode> (or FIRST15, SAVE20) and see whether a discount lands in the cart. It works because of a normal Shopify feature, not a bug. Every discount code has a shareable link at \u003Ccode>yourstore.com\u002Fdiscount\u002FCODE\u003C\u002Fcode>, and visiting it applies the code. If the code exists and has no restrictions, it works for whoever types it.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad54a586ce38bf97b7432bb\">\u003Cvideo src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ad54a5a6ce38bf97b7432c1-0-2e8b7347.mp4\" autoplay muted loop playsinline preload=\"metadata\">\u003C\u002Fvideo>\u003C\u002Ffigure>\n\u003Cp>That is fine for a code you meant to share. It is a problem for a code you meant only for new email subscribers, or a 30% code you sent to ten VIP customers, if its name is something a stranger could guess. Before Black Friday, when shoppers go hunting for codes, it is worth 15 minutes to check yours.\u003C\u002Fp>\n\u003Ch2>Why a code is not a secret\u003C\u002Fh2>\n\u003Cp>A discount code is a word customers type at checkout. Unless you restrict it, Shopify does not know who it was meant for. Shopify lets you set, per code:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad481ccaf8e63ad10e8aae4\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ad481ccaf8e63ad10e8aae9-0-e347afb6.png\" alt=\"A discount code without restrictions is like a lock with the key left in it.\" loading=\"lazy\">\u003Cfigcaption>A discount code without restrictions is like a lock with the key left in it.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cul>\n\u003Cli>\u003Cstrong>Customer eligibility:\u003C\u002Fstrong> all customers, or specific customers.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Usage limits:\u003C\u002Fstrong> a total number of uses, and one use per customer.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Minimum requirements:\u003C\u002Fstrong> a minimum order amount before the code applies.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Active dates:\u003C\u002Fstrong> a start and an end, in your store's timezone.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Combinations:\u003C\u002Fstrong> whether the code stacks with other discount classes.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>A code with none of those set is, in practice, a public price cut with a password anyone can guess.\u003C\u002Fp>\n\u003Ch2>The 15-minute audit\u003C\u002Fh2>\n\u003Ch3>1. List every active code (3 minutes)\u003C\u002Fh3>\n\u003Cp>In your Shopify admin, open \u003Cstrong>Discounts\u003C\u002Fstrong> and filter to active ones. Look at the names. Anything that follows a pattern a shopper would try is guessable:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad481ccaf8e63ad10e8aaee\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ad481ccaf8e63ad10e8aaf3-0-e787918a.png\" alt=\"A quick audit can prevent unexpected margin loss during a major sale.\" loading=\"lazy\">\u003Cfigcaption>A quick audit can prevent unexpected margin loss during a major sale.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cul>\n\u003Cli>WELCOME plus a number, FIRST plus a number, SAVE plus a number\u003C\u002Fli>\n\u003Cli>Your store name plus a number\u003C\u002Fli>\n\u003Cli>Seasonal words: BLACKFRIDAY, BFCM, XMAS, SUMMER\u003C\u002Fli>\n\u003Cli>Generic words: VIP, SORRY, THANKYOU, FRIEND, STAFF\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>2. Check what each guessable code gives away (5 minutes)\u003C\u002Fh3>\n\u003Cp>Open each one and note the discount, who it is for, and its limits. Sort them into three groups:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Meant to be public\u003C\u002Fstrong> (on your homepage banner, in a public post). Guessing does not matter. Make sure the dates and minimum order are what you intended.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Meant for a group\u003C\u002Fstrong> (email sign-ups, past customers). Guessing matters. Fix in step 3.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Meant for a few people\u003C\u002Fstrong> (VIP, apology or staff codes). Guessing matters most. Fix in step 3, today.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>3. Fix the ones that matter (5 minutes)\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Restrict eligibility\u003C\u002Fstrong> where you can: a code for particular customers can be limited to those customers, so a stranger gets an error even with the right word.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Cap usage:\u003C\u002Fstrong> set a total-use limit and tick one use per customer. A leaked code with a 50-use cap can only cost you 50 discounts.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Add a minimum order amount\u003C\u002Fstrong> so the code cannot be used on your cheapest item.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Set an end date.\u003C\u002Fstrong> An old welcome code with no end date is still live years later.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Retire guessable names.\u003C\u002Fstrong> Rather than editing a name that is already out in the world, create a replacement with a name nobody would guess (a word plus random letters, such as WELCOME-K7QF) and deactivate the old one. A shopper who tries a deactivated code sees Shopify's error that it is \"Unable to find a valid discount matching the code entered.\"\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>If you send the new code to sign-ups automatically, update the welcome email before you deactivate the old one, or new subscribers will get a code that does not work.\u003C\u002Fp>\n\u003Ch3>4. Put the public Black Friday offer somewhere else (2 minutes)\u003C\u002Fh3>\n\u003Cp>If the deal is for everyone, it does not need a code at all. An \u003Cstrong>automatic discount\u003C\u002Fstrong> applies in the cart and at checkout whenever its conditions are met, so there is nothing to guess and nothing to forget at checkout. Shopify allows up to 25 active automatic discounts, including app-based ones, and they come as amount off, free shipping or buy X get Y. One limit to know: automatic discounts created in the admin do not apply on the post-purchase page at checkout.\u003C\u002Fp>\n\u003Cp>Keep codes for the offers that should be private, and check how they combine with the automatic one. Combinations are set per discount, and a 20% automatic offer plus a forgotten 15% code can stack into more than you planned.\u003C\u002Fp>\n\u003Ch2>Watch for leaks during the sale\u003C\u002Fh2>\n\u003Cp>Open the \u003Cstrong>Sales by discount\u003C\u002Fstrong> report once a day from now through Cyber Monday. It shows how often each code was used. Things to look for:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad481ccaf8e63ad10e8aaf8\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ad481ccaf8e63ad10e8aafd-0-eddf65c4.png\" alt=\"Monitoring usage reports helps identify when a private code has leaked.\" loading=\"lazy\">\u003Cfigcaption>Monitoring usage reports helps identify when a private code has leaked.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cul>\n\u003Cli>A VIP or apology code with more uses than people you sent it to.\u003C\u002Fli>\n\u003Cli>A welcome code used far more often than you got new subscribers.\u003C\u002Fli>\n\u003Cli>An old code you forgot about suddenly being used.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Any of those means the code has escaped, onto a coupon site or a group chat. Deactivate it and issue a fresh one to the people it was for.\u003C\u002Fp>\n\u003Ch2>Shareable links are still useful\u003C\u002Fh2>\n\u003Cp>None of this means you should stop using discount links. They are a good way to apply a code for the customer, especially from email or a QR code. Get one from \u003Cstrong>Discounts\u003C\u002Fstrong>, open the discount, then \u003Cstrong>Promote\u003C\u002Fstrong> and \u003Cstrong>Get a shareable discount code\u003C\u002Fstrong>. You can point the link at a specific page instead of the homepage by adding a redirect, for example \u003Ccode>\u002Fdiscount\u002FCODE?redirect=\u002Fcollections\u002Fgifts\u003C\u002Fcode>. Shopify's limit of five discount codes per order still applies to codes that arrive through links.\u003C\u002Fp>\n\u003Cp>The link only applies the code; the code's own settings decide who can use it. So the fix is never to hide the link. It is to make sure every code that is not meant for everyone has a name nobody would guess, a cap, and an end date.\u003C\u002Fp>\n\u003Ch2>The checklist\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>List active codes; mark guessable names.\u003C\u002Fli>\n\u003Cli>Group each one as public, group or few-people.\u003C\u002Fli>\n\u003Cli>For group and few-people codes: restrict eligibility, cap total uses, one per customer, minimum order, end date.\u003C\u002Fli>\n\u003Cli>Replace guessable names with unguessable ones; update automated emails; deactivate the old code.\u003C\u002Fli>\n\u003Cli>Move the public holiday offer to an automatic discount; check combinations.\u003C\u002Fli>\n\u003Cli>Check Sales by discount daily through Cyber Monday.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fx.com\u002Falexpagepilot\u002Fstatus\u002F2110721605110571369\">The X thread on guessing hidden welcome codes\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fhelp.shopify.com\u002Fen\u002Fmanual\u002Fdiscounts\u002Fdiscount-methods\u002Fdiscount-codes\">Shopify Help Center: Discount codes\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fhelp.shopify.com\u002Fmanual\u002Fdiscounts\u002Fmanaging-discount-codes\">Shopify Help Center: Managing discount codes (shareable links, deactivating)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fhelp.shopify.com\u002Fen\u002Fmanual\u002Fdiscounts\u002Fdiscount-methods\u002Fautomatic-discounts\">Shopify Help Center: Automatic discounts\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>","A Shopify discount code works for anyone who knows it, and codes like WELCOME10 are easy to guess. A 15-minute pre-Black-Friday audit: find guessable codes, cap them, restrict who can use them, move public offers to automatic discounts, and watch the Sales by discount report.",[9,10,11,12,13],"shopify","discounts","black-friday","store-security","ai-assisted","Async.Shop","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ad481caaf8e63ad10e8aade-0-bdb1503c.png","2026-10-19T00:55:14.088Z","Audit guessable Shopify discount codes before Black Friday","Anyone can try \u002Fdiscount\u002FWELCOME10 on your store. A 15-minute audit: cap, restrict and rename codes, and use automatic discounts for public offers.",5,[21,32,42],{"slug":22,"title":23,"type":24,"summary":25,"tags":26,"author":14,"cover_url":29,"published_at":30,"updated_at":31},"shop-your-own-store-like-an-ai-agent-pre-black-friday-test-script","Shop your own store the way an AI agent would: a pre-Black-Friday test script","blog","Ask ChatGPT, Claude and Copilot your customers' top questions about your shop, log every wrong or missing answer, and fix the source before Black Friday.",[27,9,28,11,13],"ecommerce","ai-agents","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ae48cd437fa83c1536d8c1a-0-09c57ab4.png","2026-10-31T04:02:11.962Z","2026-10-31T04:02:11.963Z",{"slug":33,"title":34,"type":24,"summary":35,"tags":36,"author":14,"cover_url":40,"published_at":41,"updated_at":41},"shopify-mcp-servers-shopper-ai-what-to-check","What Shopify's MCP servers let a shopper's AI do in your store, and what to check first","Shopify's docs now split what a shopper's AI assistant can do in your store across several servers. A plain-language map of what each exposes, what the docs leave unsaid, and which policy pages to tidy before an assistant reads them aloud.",[9,37,38,39,13],"ai-shopping-agents","mcp","store-policies","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ae1ba761edd7a39ec513077-0-3172c55c.png","2026-10-29T03:19:16.591Z",{"slug":43,"title":44,"type":24,"summary":45,"tags":46,"author":14,"cover_url":51,"published_at":52,"updated_at":53},"etsy-bans-ai-patterns-recipes-what-sellers-must-change","Etsy now bans AI-made patterns, recipes and instructions: what pattern and printable sellers must change, and what AI use is still allowed","On 22 October Etsy banned AI-generated patterns, recipes and instructions, banned bot-made listings and asked for one unedited photo of the real item. A checklist for pattern, recipe and printable sellers: what is at risk, what to fix first, and what AI use is still fine.",[47,48,49,50,13],"etsy","marketplace-policy","digital-products","product-photos","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ae038cf1edd7a39ec50fa8a-0-03819514.png","2026-10-27T07:25:13.068Z","2026-10-27T07:25:13.069Z"]