Before you start
- A chosen guest, registration or login journey.
- A test customer account separate from administrator access.
Choose the intended journey
Decide whether customers can buy as guests or must register. Physical-product stores may favour quick checkout, while subscriptions or restricted access may require accounts depending on extensions. Match the choice to functions actually sold.
- List new customer, returning customer, guest and subscription scenarios.
- Check requirements of download and subscription extensions.
- Prepare test accounts separate from your administrator account.
Set account creation options
Under WooCommerce → Settings → Accounts & Privacy, review guest checkout, checkout login and account creation options. Labels vary by version. Enable only the journey you intend to support.
- Test creation at checkout and through My Account where enabled.
- Check messages for setting or resetting passwords.
- Never ask customers to share passwords with your team.
Check the My Account page
In advanced settings, review the assigned My Account page. Sections such as Orders and Addresses use endpoints; they do not each need a separate page. Check their links while signed in as a test customer.
- Review order history, addresses and account details.
- Check downloads and subscriptions where used.
- Exclude account pages from public caching that could mix sessions.
Test access recovery
Use password recovery with a mailbox you can check. Verify the message, link and login after resetting. When no message arrives, distinguish a nonexistent account from notification or delivery failures.
- Avoid testing recovery on real customer accounts without a reason.
- Review SMTP settings if website messages are not sent.
- Avoid repeated attempts that could trigger access protection.
Manage privacy and retention
Link the privacy policy appropriate to your business and review retention settings. Automatic deletion may affect information your business needs. Have periods and procedures validated before enabling them.
- Limit collection to data needed for the journey and applicable obligations.
- Distinguish account deletion from treatment of associated orders.
- Do not use real customer databases in public demonstrations.
Validate every visitor profile
Test cart and checkout as a guest, signed-in customer and new registrant where allowed. Check translation, errors and mobile use. An administrator-only test does not represent a buyer's experience.
- Verify customers see only their own information.
- Confirm notification delivery and access after registration.
- For login loops, review caching and URLs before modifying accounts.
Official documentation
Labels and options vary with versions, plugins and your account. Refer to publisher documentation for your configuration.
WooCommerce — Accounts and privacy