A cart is remembered by a cookie tied to one exact address. Pick one version of the shop address, with or without www and on HTTPS, redirect every other version to it, and test the whole path.

Items in, cart empty

A shopper adds two items to the cart, clicks to pay, and arrives at a checkout page that says the cart is empty.

Some add everything again and it happens a second time. Some email the shop. Most simply leave.

The owner tries it and it works every time, so the complaints are put down to the customers' computers.

Very often the cause is the shop's address. Not the street address: the web address, which exists in more versions than most owners realise.

How a cart remembers you

When a shopper adds something, the shop sets a cookie, a small piece of data the browser sends back with each page so the shop knows whose cart it is.

A browser sends a cookie only to the address that set it. A cookie set by example.com is not normally sent to www.example.com, and one marked secure travels only over HTTPS.

So the shop has, in effect, four doors: with and without www, on http and on https. A cart started behind one door can be invisible behind another.

Where the cart gets lost

The third is common in carts installed several years ago. Many keep one address for browsing and another for checkout, with a cookie setting for each, and a missing www in one of them is enough.

Why the owner never sees it

Owners reach their own shop the same way every time, through a bookmark or the address they always type, and that route happens to be the one that works.

Customers arrive from everywhere: a Google result, an ad, last year's newsletter, a Facebook post, an address typed from a business card without the www. Each can start them behind a different door.

Testing from your usual starting point proves only that your usual starting point works.

Testing the whole path

Test the whole path: arrive, add to cart, view the cart, check out, pay, and land on the confirmation page. Stopping at the cart misses the step where the address changes.

Use a private browsing window each time, so no cookies from earlier visits hide the problem, and repeat it in Chrome, Firefox, Internet Explorer 11 on a Windows 7 computer, and Safari on an iPhone.

Start each run from a different door: the address with and without www, with https in front, the shop's Google listing and a recent newsletter link. Watch the address bar between cart and checkout.

A worked example

A resale shop for used sports gear, in a strip mall near an arena, sells skis and hockey equipment in winter and bikes and baseball gloves in summer. Its best pieces also go into an online store.

Every few weeks someone emailed to say the cart had emptied at checkout. The owner could never make it happen and blamed the customers' browsers.

The shop's settings sent checkout to the www version on HTTPS, because the certificate covered only that one. The Facebook page, the Google listing and the printed flyers all used the address without www.

Anyone arriving from those started a cart the checkout could not see. The owner, who always used a bookmark to the www version, never did.

The fix moved the whole store onto the secure www address, redirected every other version there and corrected the listing and the Facebook page. The full path now works from every starting point tried.

Pick one address

Choose one version of the address and use it for the whole shop: browsing, cart, checkout and confirmation. With or without www matters less than choosing one.

HTTPS is the better choice for every page this year. The certificate is already paid for if checkout is secure, and Google has counted HTTPS as a small ranking signal since last August.

Moving every page onto HTTPS also removes the switch between http and https entirely, which is one of the doors this problem comes through.

Redirect everything else

Every other version should redirect to the chosen one with a permanent redirect that keeps the rest of the address. A link to a product page without www should land on the same product page with it.

Redirecting everything to the home page instead loses the shopper's place and the product they came for.

Make sure the certificate covers the chosen version, and ideally the other too, so someone typing https without www does not meet a security warning before the redirect.

Settings and links to change

Change the shop's own address settings to the chosen version, including any separate secure address and cookie setting. Older carts keep these in a configuration file rather than on a settings screen.

Check the address the payment provider sends shoppers back to after paying, since it is often set separately in the provider's account.

Then update the links you control: the Google listing, social profiles, newsletter templates and ads. If you are moving AdWords ads to upgraded URLs before July 1, use the chosen address as the final URL.

The counter-case

Shops on hosted platforms that manage the address and certificate themselves rarely meet this, though links to an old domain can still cause it.

Empty carts have other causes too, such as caching that stores a copy of the cart page or sessions set to expire too quickly. If every door checks out, look there next.

And a shop already on one address with redirects in place needs only the test, repeated after any change to hosting or settings.

For the rest, the fix is the same: one address for the whole shop, every other version redirected to it, and the full path tested from every door.

From cart to confirmation

  1. Test the full path in a private window.
  2. Start from each version of the address.
  3. Watch the address bar between cart and checkout.
  4. Choose one address for the whole shop.
  5. Redirect every other version to the same page.
  6. Update the settings and the payment return address.
  7. Fix the links on listings, ads and newsletters.

Step five is the one that makes the fix last. Shoppers will keep arriving at old versions of the address for years, and a redirect that keeps the page puts each of them behind the right door.

The wider trouble with carts installed years ago is the subject of an online shop built on software from 2009.

Frequently asked questions

Why does my cart empty at checkout?

Usually because the cart was started on one version of the address and checkout runs on another, with or without www, or on http rather than https.

Why can I not reproduce the problem?

You probably reach the shop the same way every time, and that route works. Customers arrive from listings, ads, old newsletters and typed addresses, each possibly a different version.

How should I test the checkout?

In a private window, through to the confirmation page, in several browsers including Safari on an iPhone, starting from each version of the address customers use.

Should the whole shop be on HTTPS?

It is the simplest choice. The certificate already exists if checkout is secure, and running every page on it removes the switch between http and https.

What kind of redirect should I use?

A permanent redirect from every other version to the chosen one, keeping the rest of the address, so a link to a product page lands on that product page.

What else can empty a cart?

Caching that stores a copy of the cart page, or sessions set to expire too quickly. If every version of the address checks out, look there next.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Customers saying the cart emptied?

Tell us your shop's web address and we will run the full path from every version and show you where the cart disappears.

Start a Conversation