Seatext library / BotRefund evidence
How Browser Extensions Hijack Affiliate Commissions at Checkout
Browser extensions like Honey and Capital One Shopping detect checkout pages, display coupon overlays, and silently fire their own affiliate redirect URLs in the background. This overwrites the merchant's existing tracking cookies so the...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
When a shopper reaches your checkout page, coupon and cashback extensions spring into action. They detect the checkout path or the coupon-code input field, pop up an overlay that offers to "apply coupons," and — behind the scenes — fire the extension's own affiliate redirect URL. That background call drops or overwrites your tracking cookie, so the sale is attributed to the extension instead of the original referrer. The merchant then pays a commission on top of the discount the shopper just received.
The cookie-overwrite flow step by step
- Shopper adds items and loads checkout. The session already carries your affiliate cookie from the original referral.
- Extension detects the checkout page. It recognizes the URL pattern or the coupon-input element by its class name or ID.
- Overlay appears. The extension shows a UI that promises to find and apply coupon codes.
- Background affiliate redirect fires. While the shopper watches the overlay, the extension silently requests its own affiliate tracking URL. That request sets a new cookie (or updates the existing one) with the extension's affiliate ID.
- Original cookie is replaced. Because the extension's request happens last, it wins last-click attribution.
- Merchant pays twice. The order completes with the shopper's discount applied, and the affiliate network credits the extension — so you pay a commission on a sale you already earned organically or through paid media.
Why the hijack works on almost every platform
Extensions run with the same origin permissions as the page itself. They can read the DOM, listen for navigation events, and make cross-origin requests to affiliate networks. Most e-commerce sites expose predictable checkout URLs (/checkout, /cart, /payment) and coupon inputs with stable selectors (#coupon_code, .promo-field). That predictability lets extensions trigger reliably without any cooperation from the merchant.
The affiliate networks themselves honor last-click attribution by design. When two cookies exist for the same program, the one set most recently gets the commission. The extension's background request is intentionally timed to be the last cookie write before the purchase event fires.
What the merchant actually loses
- Attribution accuracy. Your analytics show the extension as the referrer, hiding the true channel — organic search, email, paid social, or a content creator's link.
- Margin erosion. You honor the shopper's discount and pay a 5–15 % affiliate commission on the same order.
- Partner trust. Legitimate affiliates see their commissions stolen and may pause or leave your program.
- Data pollution. Conversion pixels fire with the wrong click ID, poisoning look-alike audiences and bidding algorithms.
How to detect the overwrite in your own network logs
- Open DevTools → Network tab and filter for your affiliate network's domain (e.g.,
shareasale.com,awin.com,impact.com). - Complete a test checkout with a known coupon extension installed.
- Look for a request to the affiliate network that fires after the page load but before the purchase confirmation. The request will carry the extension's affiliate ID (often visible in the query string as
aff_id,pid, orsubid). - Compare the timestamp of that request with your own cookie-set event. The extension's request will be later.
BotRefund automates this detection by running client-side telemetry on checkout pages. It logs the millisecond timing of every referral cookie set. If a coupon-extension cookie appears after the shopper has already added items and reached checkout, the transaction is flagged as an override. That timestamped evidence is what you need to dispute the commission with the affiliate network.
Prevention strategies you can implement today
| Strategy | How it works | Effort | Limitations |
|---|---|---|---|
| Strict Content Security Policy (CSP) | Block unauthorized frames and scripts from loading on checkout URLs. Use frame-ancestors 'self' and script-src 'self' with nonces. |
Medium — requires testing to avoid breaking legitimate third-party scripts (payment gateways, chat widgets). | Extensions that inject via content scripts (not iframes) may still run because CSP does not block same-origin content scripts. |
| Obfuscate coupon-field selectors | Randomize the id, class, and name attributes of the coupon input on every page load. Extensions that rely on static selectors fail to detect the field. |
Low — a few lines of template logic. | Sophisticated extensions use heuristic detection (placeholder text, nearby labels, ARIA attributes) and can adapt. |
| Track referral timelines server-side |
|
Medium — requires session storage and pixel modification. | Does not stop the overwrite; only gives you evidence to reject the commission later. |
| Client-side telemetry (BotRefund) | Lightweight script records every cookie write on checkout with millisecond precision. Flags transactions where a new affiliate cookie appears after cart-add events. | Low — one-line install, no credit card. | Detects and documents; does not block the extension's UI from appearing. |
Key facts from BotRefund's research
| Fact | Detail |
|---|---|
| Primary vectors | Honey, Capital One Shopping, and similar coupon/cashback extensions |
| Mechanism | Background affiliate redirect URL overwrites tracking cookie at checkout |
| Financial impact | Merchant pays discount + unearned affiliate commission (double-dip) |
| Detection signal | Coupon-extension cookie set after shopper completes shopping steps |
| BotRefund method | Client-side telemetry logs millisecond timing of all referral cookies |
| Actionable output | Flagged transactions with timestamped evidence for commission disputes |
Limitations and edge cases
- Extensions that don't use cookies. Some newer tools pass attribution via URL parameters or server-to-server postbacks. Cookie monitoring alone won't catch those.
- First-party affiliate programs. If you run your own program without a network, the extension may not have a ready-made redirect URL — but it can still stuff your custom parameter.
- Mobile apps and in-app browsers. Extensions don't run inside native apps or Instagram/Facebook in-app browsers, so the hijack is desktop-web specific.
- User consent. Shoppers install these extensions voluntarily. Blocking them entirely can trigger backlash or support tickets.
Frequently asked questions
Do all coupon extensions hijack commissions?
Most major ones do. The business model depends on last-click attribution. If an extension applies a coupon but does not overwrite the cookie, it earns nothing from the affiliate network.
Can I just block the extension's domains via CSP?
Partially. CSP can stop iframes and third-party scripts from loading, but content scripts injected by the extension run in your page's origin and are not blocked by CSP.
Will obfuscating the coupon field break autofill for legitimate users?
Browser password managers and form autofill rely on autocomplete attributes and field types, not stable class names. Randomizing id and class is safe if you keep autocomplete="off" or autocomplete="coupon" correctly set.
How far back can I dispute commissions?
Affiliate networks set their own windows — typically 30 to 90 days. BotRefund retains the timestamped cookie logs so you can file disputes within whatever window your network allows.
Does this affect Google Ads or Meta conversion tracking?
Yes. When the extension's affiliate redirect fires, it often carries its own click ID (GCLID, FBCLID). Your conversion pixel picks up that ID instead of the original one, poisoning the platform's optimization data.
Is there a way to let the coupon work but keep my attribution?
Not reliably. The extension controls the redirect. You can try stripping affiliate parameters on your checkout success page, but the network has already recorded the last click. The cleanest path is detection + dispute.
Putting it together: a practical workflow
- Install client-side telemetry (BotRefund script) on all checkout pages.
- Let it run for 7–14 days to build a baseline of override frequency.
- Export flagged transactions with timestamps and extension identifiers.
- Submit dispute evidence to each affiliate network per their process.
- Simultaneously deploy CSP and selector obfuscation to reduce future overwrites.
- Monitor dispute win rate and adjust tactics quarterly.
You don't need to guess which extensions are active. The telemetry shows you exactly which affiliate IDs appear late, on which URLs, and how often. That data turns a vague margin leak into a line-item recovery process.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.