I'm not sure that there is a download link...in that case you could either disable anonymous checkout or customize your store to include the download link.

Speaking from experience through a couple BV5 stores, lasted about a week with anonymous checkout....


It's a great feature but it's not as groomed as it should be. Without the account, the customer is literally lost in the database.



Requiring a user account solved all of the issues and there really hasn't been any protest from the customers.



My two cents is to disable anonymous checkout to relieve yourself of the issues it's going to create.



You can setup the single page checkout workflow to require an account and it's smooth sailing.

I would get phone calls from my client and it would be a flustered confusion of how to find a customer's order. It made them look awkward when on the phone. The customers would call to check the status of their order. Not being able to find the orders promptly turned into further errors. This all happened within a week of switching the site from BV2004 to BV5.


We're talking more than a year ago, to be honest, there were one or two specific things that were happening that added a speed bump to the process.



The prominent one was there is no way for a customer (that checked out anonymously) to check the status of their order. Without the account created, there is no true "link" to the order and the customer.



I know there were multiple threads on the topic and the end result of using the one page checkout with anonymous checkout enabled, was to add the require user login to the one page checkout workflow.



There were several submissions for feature enhancement suggestions that I believe we'll see in future versions. I cannot speak for BV5 and whether or not we'll see it improved.



I am a fan of the anonymous checkout process as I do this on certain websites that I know I'm going to get baraged with email after email after email and it seems to me that this process has helped keep that stuff at bay.



Great feature, just needs some tweaks in my opinion.

attached is a visual.


Dashboard > Options > Orders



1. 1 page checkout

2. force email on anonymous checkout



Edit Workflows (link in dark green bar)



1. edit "Checkout Started" workflow

2. Drop Down box, select "Require Login Before Checkout"

3. click new button once selected

---

All in all though, the only thing that's missing is the ability for an anonymous user to check their order status. Be it enter an order # and email address, "find order" button.



I'm sure there's capable developers in the community to tackle it and it may be worth it in the end if your user base is asking for it.

My partner Jason and I took a quick look at order look-up for anon users that did not log-in or create an account on BV5.
Looks like this was already there although not working at all until we made a couple small changes. This is a V5.4 website.


So, has anyone built on this yet for BV5? I suppose it could be combined with a log-in as well.

I pulled this example from potterybarn.com

hackable? not sure. A mega-multi-million dollar company went this route.... doesn't mean we have to follow them, but if they're doing it with only a zip code and order number... adding the third option might just be too many?

I wasn't necessarily thinking of adding a third element, but perhaps opting for email address over zip code. For example, if I wanted to hack the system, I could place an order using an invalid credit card (or stolen one) to get the current order number. Then I could work backwards from their using major metropolitan zip codes (i.e. NY, LA, etc). An email address would be more secure in this scenario. How likely is this? Probably not that likely, but it's worth mentioning...

Customer names, email address, and billing & shipping addresses. I don't think you could get to any payment info, except maybe the last 4 digits of a credit card number. But, consider the value of this information to a competitor. It would be possible to write an automated process that could extract all the customer contact info from the major metropolitan areas (in theory you would go through all zip codes, assuming the ISP doesn't catch on).


That's not true in all cases. For one, the merchant may not have AVS turned on with their payment gateway. Second, the default behavior of BV is not to reject invalid credit cards. Even if you have those two items wrapped up, if your goal is to steal information rather than product, why not use a stolen card's real address info?

You gotta think like a hacker, Matt! :) The reason I was saying to place a test order is so the hacker can see the order number format and get the latest order number. Then they would write an automated process that would start at that number and count backwards, trying major metropolitan zip codes with each order number until it found a match. Here's some psuedo code to maybe help illustrate this...



You couldn't do this if an email address was used instead of a zip code. Kim also mentioned using a CAPTCHA. That should help discourage this.

Cool, yep let us know Matt. I am leaning towards including the email address. Another benefit of using the email address is you could send back a list of order numbers. Did that at one clients site.