The code was for one email. It went to 2,300 subscribers on a Tuesday. By Friday it had 900 redemptions, and your list doesn’t open that well.
That’s usually how a merchant finds out. Not from a coupon site, from a number that doesn’t add up. The other common route is a customer who says “I found it on RetailMeNot” while asking for a refund on something else. Either way, this is the sequence that fixes it, written for store owners rather than shoppers looking for a bargain.
Step 1: confirm it’s a leak, and that it’s still working
Search your brand plus “coupon” and you’ll find pages of codes for your store. Most of them are dead. Coupon sites keep expired and invented codes on the page because the page still earns traffic. A listing is not a leak. A listing for a code that redeems right now is.
So check the code, not the site. In your Shopify admin, open the discount and compare its usage count with the number of people who should have it. Then look at where the orders came from. A code with three times more redemptions than recipients, spread across customers who’ve never been on your list, is leaked and live.
If you want the same check across every code at once, PromoLock’s Discount given report ranks your codes by what they handed out and how many orders used each one. The leaked one is usually near the top and out of proportion to its campaign.
Step 2: shut it down
For a code that should never have been public, deactivate it in Discounts. It stops working within seconds, everywhere, including in every coupon extension that learned it.
For a code attached to a person (an influencer, an affiliate, a partner), don’t just kill it. Rotate it. Create the replacement first, send it to them, then deactivate the old one. They lose nothing, and the leaked string turns into a dead listing overnight.
If the code has to stay public and typeable, tighten what it can do instead. Add an expiry. Add a usage limit. Restrict it to first orders, or to the products it was meant for. Shopify’s one use per customer setting helps less than it sounds like it should, but it’s still a smaller prize than an unlimited code.
Step 3: getting coupon sites to remove it (and why it rarely works)
Every major coupon site has a contact form or a “report this code” link, and you can use them. Set your expectations first.
The sites are paid when a code converts, through affiliate links on the same page. A working code is their inventory, and a request to remove inventory gets the treatment you’d expect. Merchants in the Shopify Community have reported everything from same-day removals to months of silence from the same site. Removal also does nothing about every other site that copied the listing, or the extensions that harvested the code at someone’s checkout.
There’s a much more reliable way to get a code off coupon sites: make it stop working. The sites test their codes, users flag them, and a dead code slides down the page and eventually off it. Step 2 is the removal request that always goes through.
Step 4: stop the next one
A leak is a property of the code, not bad luck. Shared codes leak because they’re shared. Three structures don’t have that problem.
Automatic discounts. No code exists, so nothing can be posted. Right for any promotion that doesn’t need per-person attribution.
One code per recipient. Your email tool sends each subscriber their own single-use code instead of one code to everyone. A leak is then worth exactly one order, and the leaked code is dead by the time it’s posted. PromoLock’s bulk codes generate up to 100,000 of these behind one offer, and Klaviyo-style tools accept the CSV directly.
An allow list at checkout. If you only ever want your three official codes to work, the Controller’s Block all codes except mode rejects everything else at checkout, including codes you don’t know exist. It’s blunt, and it’s the setting many stores wanted all along.
Step 5: find out before the number does
Everything above starts with knowing a code leaked. Checking three coupon sites by hand takes ten minutes. Checking all of them, every day, is nobody’s job, which is why leaks are usually a month old when they’re found.
LeakHunt, which is included with PromoLock, does that check on a schedule. Its Leak Radar goes through the coupon sites, RetailMeNot and Coupert down to the long tail, looking for codes attributed to your store, then tests each one against your store and shows you only the ones that exist and currently work. Each row has a one-click Disable and a Mark as intentional for the codes that are supposed to be public. On the nightly plan it emails you when a scan finds something new.
One thing not to do
Don’t kill your best affiliate’s code because it turned up on RetailMeNot. A public code from a public partner will be on coupon sites by lunchtime, and a share of the orders it brings from there would have happened at full price. That’s a code to mark intentional and to watch, not a leak. The leak is the code that was meant for 2,300 people and reached 20,000.