SARAH20 did 400 orders last month. Sarah has 30,000 followers and posts about you twice a month, so you were pleased, until you looked at where the orders came from. About forty match her audience. The rest arrived through Honey, RetailMeNot and a Slickdeals thread, from people who have never heard of Sarah and had a cart open already.
You’re now paying Sarah a commission on 360 sales she didn’t drive, and giving 20% to 360 people who’d have paid full price. Nothing malicious happened. A public code became public.
First, decide what’s wrong
Some of this is fine, and it’s worth being precise about which part.
A shopper who found SARAH20 on a coupon site and bought a $90 order they’d have bought anyway cost you $18 of margin. That’s a real cost, but it’s the same cost as any public promotion, and Sarah’s code is a public promotion. If you didn’t want strangers using it, it shouldn’t have been a typeable code in a video caption.
The part that’s broken is attribution. Sarah’s commission is supposed to measure her influence, and it’s now measuring Honey’s reach. Worse, if you also pay affiliates by last click, the extension may be taking the click itself. That’s the practice the Honey affiliate-hijacking exposé in late 2024 put on the record, with lawsuits still moving and PayPal acknowledging in January 2026 that it had disabled some of the code practices involved. The commission you pay on that sale goes to whoever touched it last, and the extension is built to be last.
So the question isn’t “how do I hide Sarah’s code.” It’s “how do I pay Sarah for Sarah’s sales, and stop paying everyone else.”
The native moves
Rotate the code. Give Sarah a new one, keep the old one live for a week so her followers who saved it aren’t burned, then deactivate it. The coupon listings die with it. You’ll be doing this again in a month, which is where the approach runs out.
Pay on the link, not the code. If Sarah’s commission is tied to her tracking link rather than to code redemptions, coupon-site traffic stops earning her money. The code becomes a courtesy discount for her audience instead of the attribution mechanism. Most affiliate tools support this, and it removes the incentive problem entirely.
Limit the code. An expiry, a usage cap, or a restriction to first orders makes the public version a smaller prize. None of these stop the leak; they shrink it.
Product-scope it. A code that only works on the products Sarah promotes is worth much less to a random shopper checking out with something else.
The structural fix
The strongest version is one where the public code isn’t the discount. Sarah’s link lands on a page that gives each visitor their own single-use code. The visible SARAH20 can still exist for social proof, with a small discount or none, while the real 20% lives in codes that each work once. PromoLock’s bulk codes generate that supply and Klaviyo-style tools deal them out.
It’s more setup than a shared code, and for a small creator program it’s overkill. For the three creators who bring you real revenue, it’s the difference between measuring them and measuring Honey.
What to do about the extension itself
Rotating codes is a treadmill, because the new code will be in Honey within days for the same reason the old one was. LeakHunt, included with every PromoLock plan, steps off it in two ways.
Leak Radar finds SARAH20 on the coupon sites and shows you the listing along with every other code of yours that’s out there and still working, so you see all of it rather than the one code a customer happened to mention. If a code should be public, one click marks it Intentional and it stops appearing as a leak.
Extension Guard handles the Honey side. When a shopper’s browser is running a coupon extension, your leaked codes are rejected at that shopper’s checkout. Anyone without an extension, which includes the bulk of Sarah’s followers, is unaffected. If you’d rather Sarah’s code work for absolutely everyone, mark it intentional and the guard leaves it alone. The choice is yours per code, which is the part a rotation never gave you.
The version of this that’s fine
If Sarah’s code brings in 400 orders and you’re happy with the margin on all of them, leave it public, mark it intentional, and pay her on her link. Plenty of brands run creator codes as an open discount on purpose, and it’s a legitimate way to run a promotion. The problem was never that strangers used the code. It was that you didn’t know they were, and were paying for it twice.