Question
WooCommerce Guest Order Lookup and Public Account Registration Constraints
Dev River
0 reputation · 15 Aug 2024, 04:59 UTC
145.6K views1
Loading…
0 reputation · 15 Aug 2024, 04:59 UTC
WooCommerce provides a centralized 'My Account' system to manage customer profiles and order histories. While authenticated users are restricted to their own data, the platform also supports Guest Checkout and public registration settings via the WooCommerce account configuration.
A specific concern arises when balancing the convenience of guest order lookups with the restriction of public account creation. When the setting to allow customers to create an account on the My Account page is disabled, the system should prevent unauthorized registration while still permitting guests to verify their identity for specific order inquiries.
There is uncertainty regarding how these two distinct access paths—guest order verification and account registration—interact when strict privacy constraints are applied to the My Account page.
32275 reputation · 15 Aug 2024, 08:39 UTC
Disabling public account creation on the My Account page does not restrict the guest order lookup verification flow. These two features operate on different authorization logic: account registration manages permanent user identity in the WordPress database, while guest order lookup is a transient verification based on specific order metadata.
In a standard WooCommerce configuration (assuming version 8.0+), the following behaviors are established:
woocommerceWooCommerce > Settings > Accounts & Privacy > Allow customers to create an account on the "My account" page only controls the visibility and functionality of the registration form. It does not block the API or endpoint logic used for order tracking.If a guest user successfully performs an order lookup and subsequently attempts to navigate to the main My Account dashboard, the system will treat them as an unauthenticated visitor. Because they have not been assigned a User ID in the database, they will be redirected to the login/registration page. If public registration is disabled, they will see only the login form, effectively preventing them from accessing the full dashboard.
To verify this behavior in your environment, perform the following scoped tests:
Diagnostic Note: Are you using a third-party "Order Tracking" plugin or the native WooCommerce endpoint? Custom plugins may implement their own session handling which could inadvertently trigger account creation prompts.
Use comments to ask for clarification. Post a solution as an answer.
32,275 reputation · 15 Aug 2024, 15:40 UTC
The guest order verification flow relies on a transient order_key token generated by woocommerce_get_view_order_url(). This token is validated against the order's metadata and does not require a WordPress user session or trigger the is_user_logged_in() check that protects the My Account dashboard. Consequently, even when the setting “Allow customers to create an account on the ‘My account’ page” is disabled, a guest can still access the order‑view page via the URL /my-account/view-order/?order_id=ID&order_key=KEY and see order details. After viewing the order, any attempt to navigate to /my-account/ (the dashboard) will redirect unauthenticated guests to the login page, and because registration is disabled they will only see the login form.