How to stop discount code leaks on Shopify

Guide by Northlight Apps · Updated 30 October 2026

Short answer: a normal Shopify discount code works for anyone who types it. Once a creator's code is posted on a coupon site or picked up by a browser coupon extension, shoppers who were already going to buy use it too. You can't make a typed code secret, but you can limit who it works for, how often, and for how long — and you can measure the leak.

How codes leak

Coupon websites collect codes that creators post publicly and list them under your store name.
Browser coupon extensions try known codes automatically at checkout and remember the ones that work.
Shoppers share codes in groups and forums ("use SARAH15 for 15% off").

The cost isn't only the discount. If the code belongs to an affiliate or influencer, you may also pay them commission on sales they didn't bring in.

Step 1 — Measure the leak first

Go to Analytics → Reports and open the sales-by-discount report.
For each creator code, compare orders that used the code with the visits that creator actually sent (their tracked link or UTM). Many code orders but few visits from the creator usually means the code is being used by shoppers who came from somewhere else.
Search the web for "your store name discount code" — if your creator codes appear on coupon sites, they have leaked.

Step 2 — Limit the damage with Shopify's built-in settings

Setting	What it does	Trade-off
Limit total uses	Code stops after N orders	The real audience can hit the limit too
One use per customer	Same customer can't reuse it	Doesn't stop new shoppers using a leaked code
Active dates	Code expires with the campaign	Evergreen creator codes need renewing
Minimum purchase	Leaked code costs less on small orders	Doesn't stop the leak
Customer eligibility	Only chosen customers or segments	Doesn't fit public creator campaigns
Combinations off	Leaked code can't stack with your sales	Real fans can't stack either

Step 3 — Rotate and personalise codes

One code per creator (never one shared code), so you can see which one leaked.
Rotate the code per campaign instead of keeping one forever; a leaked code then dies with the campaign.
Unique single-use codes work well for email and SMS, where each customer gets their own code.

Step 4 — Make the code depend on the creator's link

Shopify's discount links (yourstore.com/discount/CODE) apply a code automatically when someone clicks the link — but the same code still works when it's typed in by someone who never clicked. Out of the box, Shopify has no setting for "this code only works through this link".

Apps can add that rule: the code only gives the discount when the shopper arrived through the creator's link, and shoppers who type it without the link see a short message explaining why. Ask any app you consider: does it work with codes you already have, what does the shopper see, and what happens to your codes if you uninstall?

We've also made a small app that adds this rule for you — LinkLock: Stop Code Leaks. It works with the codes you already have, and shoppers who type a locked code without the link see a short explanation. It's free for one code (Starter is US$12/month), and it's currently in Shopify App Store review. It's ours, so please compare it with other options too.

FAQ

Can I block coupon browser extensions?

Not reliably — they run in the shopper's own browser. What you can control is whether a leaked code still gives a discount.

Will limiting codes hurt my creators?

Tell them first. Most creators prefer a code that only counts their real audience, because their results then show their true value.

Does this affect automatic discounts?

No. Automatic discounts don't use codes, so they can't leak this way — but they have a different problem: they're often invisible on product pages.