A merchant sends a 15% code to their email list on Monday. On Wednesday it’s on three coupon sites and inside two browser extensions, and the merchant has no idea how it got there. They didn’t post it. Their subscribers didn’t post it, or at least not on purpose.
There’s no single answer, because there are five routes, and a typical code travels down more than one of them.
1. Shoppers submit them
The oldest route. Every large coupon site has a “submit a code” form, and several reward the submitter with points or cash when the code is verified. A subscriber who got your email and wants a few cents of credit pastes the code in. It takes fifteen seconds and feels like nothing, because to them it’s just a coupon.
This is why a code sent to 2,000 people should be treated as public. You need one of the 2,000 to have the habit.
2. Extensions learn from their users
Honey, Capital One Shopping, Coupert and the rest sit in the browser at checkout. When a shopper with the extension types a code and it works, the extension has just watched a working code for your store. The mechanics vary and the companies describe them carefully, but the effect is the same across all of them: codes entered by their users end up in the pool the extension tries for everyone else.
The extension’s users didn’t leak anything. They used the code you sent them. The extension did the rest, and it did it at the one place your theme can’t see, the checkout.
3. Your own storefront
Some codes are public the moment you create them. The welcome popup that offers 10% for an email address is displaying a code to every visitor, and coupon sites scrape those. Your announcement bar. The code in your Instagram bio. The “use code SAVE15 at checkout” line on the sale page.
A code shown on your site is a code you published. Coupon sites are just the second place it appears.
4. Affiliate and influencer networks
An influencer’s code is published on purpose, in a caption, in a video description, on a landing page. Coupon sites copy it within hours, because the influencer’s audience is small and the coupon site’s audience is everyone.
Affiliate networks add a quieter version. Many coupon sites are affiliates, and networks push a feed of active promotions and codes to them. If your affiliate program has a coupon feed enabled, you may be sending your codes to the coupon sites yourself.
5. Guessing
Sites and extensions try common patterns against every store. SAVE10, WELCOME15, FREESHIP, your brand name followed by a number. If any of those exist and work, they’re “found” without anyone submitting anything. This is also why codes that look like patterns are a bad idea for anything private.
Why they never take codes down
Every route above ends at the same page, and the page has one job. The coupon site places affiliate links next to the codes and gets paid when a shopper converts. A working code is inventory. A dead code is a page that still ranks and still carries the links, which is why expired codes stay listed for years.
That’s the incentive to keep in mind when you’re writing a removal request. The site has no reason to act on it, and merchants who’ve tried report results from same-day removal to nothing at all. The one removal that always works is making the code stop working. Sites test codes, users flag them, and a dead code sinks.
What this means for how you build discounts
If every shared code becomes public, the question isn’t how to keep codes secret. It’s how to make publication not matter.
A code per person. When each subscriber or referral gets their own single-use code, a leaked code is worth exactly one order and is dead by the time it’s posted. This is the structure that makes routes 1, 2 and 4 harmless. Email and SMS tools can send them; PromoLock’s bulk codes generate the supply.
No code at all. Automatic discounts have nothing to submit, scrape or guess. Right for any promotion that doesn’t need per-person tracking.
A short life. An expiry date bounds how long any of this matters.
Know when it happens anyway. Even with good structure, some shared codes are unavoidable, and the honest position is that you’ll find out late unless something is looking. LeakHunt, which PromoLock stores get for free, watches the coupon sites for codes attributed to your store and confirms which of them still redeem, so the list you see is the short one that matters. From there it’s one click to disable a code, or to mark it intentional if it was public all along.
The route a code took to the coupon site turns out not to matter much. Whether it still works is the only fact the sites care about, and it’s the one you control.