Orders Showing Up in Wrong Customer Account

[krdito]

I have had this problem occasionally on my site, where a customer's order shows in another customer's account.  I became aware of it when a customer contacted me, stating an order that was not hers is displayed in her account.  Embarrassing and makes customers question the security of the site!

 

From reading other threads about this same issue, it seems to be a Google issue, where customers coming to my site from the same Google ad have the same session ID, so my site thinks they are the same customer.

 

To remedy this, in June of this year, I changed my settings in the Admin Panel to:

 

Force Cookie Usage = true

Prevent Spider Sessions = true

Recreate Session = true

 

However, I am still having customer orders show up under the wrong account.  Is there some other setting change that needs to be made?  This happens about once per week and seems to happen when an order from a customer who checks out without creating a account gets attached to a customer who has recently created an account (regardless of whether they actually made a purchase).  Maybe the customer with an account did not log out when leaving the site?

 

I am not sure how to fix this and wecome any advise that you can provide!

 

 

[Gauravs]

includes/spiders.txt should also be updated .. have a look if google is listed, if not you may like to add the name to the list. Also if you have installed any tracker, you may know which all search engines frequently index your site and to add them as well in the list...

 

HTH

[krdito]

Thank you for your reply!  I checked includes/spiders, and googlebot is listed there.  Should I add google also?

[Gauravs]

Google uses googlebot only.. however on its googlebot documentation.. it also mentions feedfetcher as mentioned below

 

"Google has several other user-agents, including Feedfetcher (user-agent Feedfetcher-Google). Since Feedfetcher requests come from explicit action by human users who have added the feeds to their Google home page or to Google Reader, and not from automated crawlers, Feedfetcher does not follow robots.txt guidelines. You can prevent Feedfetcher from crawling your site by configuring your server to serve a 404, 410, or other error status message to user-agent Feedfetcher-Google. More information about Feedfetcher."

 

I would suggest putting a tracker on your site to identify

1. Is it because of googlebot / or is it due to any other factor

2. Is the spider.txt file doing its work.. or failing due to some reason..

 

Good luck!

[Gauravs]

In addition, you may also add the following code to robots.txt to prevent Google from storing OscId

 

User-agent: *

Disallow: /*osCsid

Sitemap: http://www.yoursite.com/sitemap.xml

[krdito]

Thanks!  I will do as you have suggested :)

 

Much appreciated!!

[Jack_mcs]

@@krdito If the session ID (the osCsid) is showing up in the url's of your shop, you have a mistake in the includes/configure.php file. See here for a guide. If you are using cache and it is set to a public directory, like tmp, then that is probably the real cause of the problem since it is shared with other sites on the server (assuming a shared server).

[Hotclutch]

In addition, you may also add the following code to robots.txt to prevent Google from storing OscId

 

User-agent: *

Disallow: /*osCsid

Sitemap: http://www.yoursite.com/sitemap.xml

 

Doing this won't remove osCsid URLs already in the index, in fact it will keep them there indefinitely. You should allow bots to crawl the URLs and rather use meta noindex or .htaccess to 301 redirect the URLs.