: Keep order status private from search engines? I searched hard before posting this question. I apologize if it is a duplicate or if this is not the correct forum. We have a homegrown shopping

@Voss4911412

Posted in: #BestPractices #Ecommerce #Security #WebCrawlers

I searched hard before posting this question. I apologize if it is a duplicate or if this is not the correct forum.

We have a homegrown shopping cart website. We do not require shoppers to register to place an order, but we still want to provide them with a way to review and check the status of their order online.

Our system generates a unique key value for each order. This key is included in a link sent to customers by email. Anyone with the link can therefore view the order status and limited information about the order.

I've noticed that search engines have been hitting our website using this private key. For example: An order with a Yahoo email address results in the order status function (with the private key) being hit by the Yahoo Slurp bot. Obviously Yahoo scraped the link from their user's email.

Two questions:


Why are search engines doing this? We have since modified our software to block detectable user agents and give them a 404.
Is the approach of emailing a link/key to customers a correct way to let them check the status of their orders without requiring login? What might be an alternative solution?


Thanks!

Edit: Addendum. Looking into how other stores handle this, I see one solution is to ask for the order number (which can be part of the link) and require the shopper to input another field, like zip code, to confirm authorization.

Vote Up Vote Down

Login to post a comment!