A discount code that works for anyone who types it will end up being used by anyone who finds it. Once a welcome code, an influencer code or a "VIP" code is posted on a coupon site or picked up by a browser extension that tries codes at checkout, every visitor gets your margin as a gift. You can't take the code off those sites. What you control is whether the code still works, and who it works for.
So the fix has two parts: stop this code today, then set up your codes so a leak costs you little next time.
Today: find out how far it spread
Before you switch anything off, look at the numbers. On Shopify, the sales by discount report shows sales per discount. Compare uses this week with what you expected: say a code went to 400 newsletter subscribers and has been used 900 times, the extra 500 are the leak.
Check the orders behind it. A spike from customers with no previous orders and no newsletter signup points to coupon sites or extensions. A spike from one affiliate's audience may simply be the campaign working.
Today: end it, cap it, or narrow it
Pick one, depending on who the code was for:
- End it now. Right for a code that wasn't meant to be public: a VIP code, an apology code, a code for staff. On Shopify you can deactivate an unexpired discount from the Discounts page, and reactivate it later if you need to.
- Set an end date. Right for a promotion that's already been announced to the people it was meant for. Give them the date in a reminder email so they don't feel cheated when it stops.
- Cap total uses. Right for a code with a fixed budget, such as a launch offer for the first 200 orders.
If the code belongs to an influencer or affiliate, tell them before you switch it off and give them a replacement. Their audience will try the old code, and they'll hear about it first.
Then send the people the discount was really for a new code with limits set from the start, as described below.
The limits you can set
Store platforms offer a similar handful of controls. On Shopify, a discount code can have:
- a total limit: the number of times the discount can be used in total;
- one use per customer, tracked by the customer's email or phone number;
- eligibility: the options are "All customers", specific customers, customer segments or markets. A single code can apply to up to 100 specific customers, products and variants combined;
- start and end dates, in your store's time zone;
- a minimum order amount.
WooCommerce coupons have a usage limit per coupon, a usage limit per user, an expiry date, and an allowed emails list that checks the customer's billing email.
One use per customer doesn't stop a leak. It stops the same person using the code twice, but every new visitor from a coupon site is a new customer with one use available. To actually limit who can use a code, you need either eligibility (only certain customers can use it) or uniqueness (each person gets a code nobody else has).
Match each code to its audience
A leak does the most damage when one kind of code is used for every job. A rule per kind:
| Code for | Set it up as |
|---|---|
| A public sale everyone should get | No code at all, where your platform supports it: an automatic discount applied at checkout, with an end date. Nothing to leak. |
| New subscribers (welcome offer) | A unique code per subscriber, one use, expiring after a set number of days |
| Existing customers or a VIP group | Eligibility limited to that customer segment |
| One customer (apology, service recovery) | Eligibility limited to that customer, one use |
| An influencer or affiliate | A code you expect to spread: a total cap, an end date, and a review of uses every week |
| A launch or first-orders offer | A total limit equal to the number of orders you planned for |
The affiliate row is the one to accept rather than fight. A code meant to be shared by a creator will be shared beyond their audience too, so budget for it with a cap and an end date instead of hoping it stays small.
Unique codes for email offers
A single welcome code sent to every subscriber is the easiest one to leak: one subscriber posts it, and it works for everyone. A unique code per subscriber limits the damage to one code.
Email tools connected to the store can generate these for you. Omnisend's discount item, for example, creates a unique code for each recipient when it's used in an automation such as a welcome series; in a one-off campaign, every recipient gets the same code. You set an expiry, and on Shopify the generated codes appear under Discounts, grouped under a parent discount. Before relying on it, open one of the generated discounts in your store admin and check its usage limit: a unique code that can be used many times by different people can still spread.
If your platform or email tool can't create unique codes, an expiry of a few days is the next best limit. A code that has expired by the time it reaches a coupon site does no harm.
Check every week
Set a short weekly check, ten minutes on a Monday:
- Open the sales by discount report, or your platform's equivalent.
- For each active code, compare uses with what you expected from its audience.
- Look for codes you'd forgotten: old campaign codes with no end date keep working for as long as they're listed somewhere. Set an end date or deactivate them.
- Note any code whose uses jumped, and check its orders before deciding whether to cap it.
What not to spend time on
You can't stop coupon sites listing your codes or browser extensions trying them at checkout. Chasing take-down requests or blocking extensions uses time a usage limit makes unnecessary. If a leaked code no longer works, the coupon site is advertising a dead code, and the cost to you is a customer who pays full price.