What Is the Order Key in a WooCommerce Order URL?
How the WooCommerce Order Key Works
When an order is created, WooCommerce generates a random key and stores it as order meta, then includes it as a URL parameter on the order-received page and in related links (like a "pay for this order" retry link). Anyone with the correct order ID and matching key combination can view or interact with that specific order without authenticating, which is what makes guest checkout order confirmation and retry-payment flows possible without requiring an account.
Why This Is Reasonably Secure
- The key is long and randomly generated, making brute-force guessing impractical — there's no meaningful pattern or predictability to exploit.
- It's scoped to a single order, not a customer's entire account or order history, limiting the exposure if a specific key were ever compromised to just that one order's details.
- It's not designed to be a permanent secret the way a password is — it's a convenience mechanism for legitimate order-related actions, and the overall security model assumes the link stays within the intended communication channel (email to the actual customer).
- Sharing an order link publicly (posting it somewhere visible, forwarding it carelessly) would let anyone with that link view the order's details, which is the main practical risk worth being aware of.
Practical Considerations
- Treat order confirmation links like any other private, personal information — not something to share or post publicly.
- Encourage account creation for customers who want a more centrally managed way to view order history, rather than relying purely on individual order links.
- No action is typically needed on the store side, since the underlying key generation is already handled securely by WooCommerce core.
Have specific security concerns about order data handling? See WooCommerce fixes.