I can see any order when changing the order number on URL

Hi @thanparm

I opened an incognito window to test my site and when I made a dummy order, I figured that I can see every order made on my website if I simple change the order number on the URL. How can I change that?

It isn’t immediately clear what the exact URL is you are referring to, but customer information is hidden as of 2.6 unless the user is logged in. Otherwise it shows just ordered items. The URL itself uses randomly generated keys and it’s not guessable, so it’s not really a risk.

If you can give us a better idea of what you are looking at, we can take a closer look.

Cheers!

I think I might have solved the problem. I used a custom thank-you page and the URL was https://mywebsite.com/thank-you/?order=3119. And I could see every order if I changed that number. I reversed to the default page and it seems that it is fixed now.

May I ask how I can customise the thank-you page? Because that was what I wanted to do, but apparently I can’t use that way as I’m facing privacy issues. Thank you.

Hi there!

Thank you for the update.

I think I might have solved the problem

Glad to hear it and thank you for letting us know!

May I ask how I can customise the thank-you page?

You can optimize and customize the thank you page using a premium extension like Custom Thank You Pages. There is also a way to do it manually using custom code and this article will give you more insights.

Check out the support documentation and if you have any pre-sales questions please contact us at:

https://woocommerce.com/contact-us/#sales-form

From there, click on the tab “I have a question about a specific extension or theme I’d like to purchase.” We will be able to help you further there.

Just so you know, we offer a 30-day refund policy so you can test out the extension with your requirements and make sure it works for you. Here are more details on the refund policy: https://woocommerce.com/refund-policy/.

Hope this helps!