# Guest order lookup

> Let shoppers without an account check one order with its number, email and a second factor, and the limits that protect it.

Source: https://shopassist.coec.dk/docs/orders-and-identity/guest-order-lookup · Updated 2026-10-01

Guests can ask "where is my order?" and give the order number and email. The assistant then shows the status, items and tracking of that one order, as your platform's own guest order tracking would.

## Second factor [#factor]

| Platform    | Second factor                                                 |
| ----------- | ------------------------------------------------------------- |
| Shopify     | Billing last name (always)                                    |
| Magento 2   | Billing last name or postcode (always)                        |
| WooCommerce | Billing postcode, when **Require second factor** is on        |
| PrestaShop  | None (reference and email, as in PrestaShop)                  |
| Generic     | As your [order RPC](/docs/install/generic/order-rpc) declares |

## What guests see [#scope]

Status, items, totals, shipment and tracking for 30 minutes. Never addresses, phone numbers, payment details or the order status page link. Actions need the stronger [email verification](/docs/orders-and-identity/email-verification).

## Protection against guessing [#limits]

* 5 lookups per 15 minutes per chat session, 20 per hour per network, 200 per hour per store.
* 3 failed attempts for the same order number within an hour lock it for an hour; a locked order always answers "not found".
* A wrong combination never says which field was wrong.
* The typed email is stored only as a keyed hash.

Switch guest lookup off in **Orders & actions → Order status**.