WooCommerce Guest Order Lookup and Public Account Registration Constraints

Question

WooCommerce provides a centralized 'My Account' system to manage customer profiles and order histories. While authenticated users are restricted to their own data, the platform also supports Guest Checkout and public registration settings via the WooCommerce account configuration.

A specific concern arises when balancing the convenience of guest order lookups with the restriction of public account creation. When the setting to allow customers to create an account on the My Account page is disabled, the system should prevent unauthorized registration while still permitting guests to verify their identity for specific order inquiries.

There is uncertainty regarding how these two distinct access paths—guest order verification and account registration—interact when strict privacy constraints are applied to the My Account page.

Does disabling public account creation inadvertently restrict the guest order lookup verification flow?
  What is the documented behavior for guest users attempting to access the My Account dashboard after a successful order lookup?

Tasadduq Burney · Answer

Interaction Between Guest Lookups and Account Constraints
Disabling public account creation on the My Account page does not restrict the guest order lookup verification flow. These two features operate on different authorization logic: account registration manages permanent user identity in the WordPress database, while guest order lookup is a transient verification based on specific order metadata.

Behavioral Analysis
In a standard WooCommerce configuration (assuming version 8.0+), the following behaviors are established:

Guest Order Lookup: When a user provides a valid Order ID and billing email via the Order Tracking endpoint, WooCommerce grants temporary access to that specific order's status and details. This is a read-only operation that does not require a user session or a registered account.
  Account Registration: The setting WooCommerce > Settings > Accounts & Privacy > Allow customers to create an account on the "My account" page only controls the visibility and functionality of the registration form. It does not block the API or endpoint logic used for order tracking.

Post-Lookup Dashboard Access
If a guest user successfully performs an order lookup and subsequently attempts to navigate to the main My Account dashboard, the system will treat them as an unauthenticated visitor. Because they have not been assigned a User ID in the database, they will be redirected to the login/registration page. If public registration is disabled, they will see only the login form, effectively preventing them from accessing the full dashboard.

Verification Steps
To verify this behavior in your environment, perform the following scoped tests:

Navigate to WooCommerce > Settings > Accounts & Privacy and uncheck "Allow customers to create an account on the 'My account' page".
  Open a private/incognito browser window to ensure no active admin sessions exist.
  Access your Order Tracking page and enter a valid Order ID and the associated billing email.
  Confirm that the order details are displayed.
  Attempt to click a link to the general "My Account" area and verify that you are prompted to log in rather than seeing a registration form or the account dashboard.

Diagnostic Note: Are you using a third-party "Order Tracking" plugin or the native WooCommerce endpoint? Custom plugins may implement their own session handling which could inadvertently trigger account creation prompts.

WooCommerce Guest Order Lookup and Public Account Registration Constraints

1 answer

Interaction Between Guest Lookups and Account Constraints

Behavioral Analysis

Post-Lookup Dashboard Access

Verification Steps

Your perspective belongs here.

1 question comment