1

I searched hard before posting this question. I apologize if it is a duplicate or if this is not the correct forum.

We have a homegrown shopping cart website. We do not require shoppers to register to place an order, but we still want to provide them with a way to review and check the status of their order online.

Our system generates a unique key value for each order. This key is included in a link sent to customers by email. Anyone with the link can therefore view the order status and limited information about the order.

I've noticed that search engines have been hitting our website using this private key. For example: An order with a Yahoo email address results in the order status function (with the private key) being hit by the Yahoo Slurp bot. Obviously Yahoo scraped the link from their user's email.

Two questions:

  1. Why are search engines doing this? We have since modified our software to block detectable user agents and give them a 404.

  2. Is the approach of emailing a link/key to customers a correct way to let them check the status of their orders without requiring login? What might be an alternative solution?

Thanks!

Edit: Addendum. Looking into how other stores handle this, I see one solution is to ask for the order number (which can be part of the link) and require the shopper to input another field, like zip code, to confirm authorization.

Improve this question
3
  • SEs do this to discover new and/or hidden pages. We can argue whether this is really a good idea. I personally do not like it, however, I do understand the thought behind it. Second, you can possibly check the referrer. SE bots will not have one where an email might. Otherwise, SEs are well behaved and use a recognizable agent name. That said, I would consider a 403 instead of a 404. This should keep these links out of the SERPs.
    – closetnoc
    Nov 30, 2017 at 18:39
  • Excellent suggestion. I should have thought of that. I have modified our system to respond with 403.
    – Timothy B.
    Nov 30, 2017 at 18:53
  • Email links will send a referrer from webmail, but not from mail client applications that run outside the browser.
    – Stephen Ostermiller ♦
    Nov 30, 2017 at 20:25

1 Answer 1

Reset to default
1

In addition to serving a 403 to known search bots, you can (and probably should) also set the order status pages to have a "noindex" attribute (either via metatag or robots.txt) This will help ensure the order status pages don't get indexed and shown in any search results.

Improve this answer
1
  • Thanks. I checked and page already contains this: <meta name="robots" content="noindex">
    – Timothy B.
    Dec 4, 2017 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.