Duplicate checkout pages left behind by theme demos and staging copies

You fixed your checkout page and the attack did not stop. Then you searched your own site and found a second checkout page you had forgotten about. Maybe a third. They came with the theme demo, or a staging copy that someone pushed live.

Where the extra pages come from

Duplicate checkout pages are common on WooCommerce sites that have been around for a while. They tend to come from a few places:

• Theme demo imports. Many themes ship demo content with their own Cart, Checkout, and My Account pages. Import the demo on a store that already has those pages, and you get a second set, often with a slug like checkout-2.
• Page builder tests. Someone builds a new checkout design in Elementor, Divi, or another builder on a draft page, publishes it to preview, and never removes it.
• Staging pushes. A staging site gets pushed to live with its own test pages, or a migration plugin merges two page sets.
• WooCommerce setup itself. Running WooCommerce page setup again after the page settings were changed or cleared can create a fresh checkout page instead of reusing the old one.

Why a stray page matters

WooCommerce has one official checkout page, set under WooCommerce, Settings, Advanced. That setting decides where the checkout endpoints live and where the Proceed to checkout button sends people.

But any published page that contains the checkout shortcode or the Checkout block will still render a working checkout. The shortcode or block does not care whether the page is the official one. If it can load a cart, it shows the form.

That gives you a page you are not watching. You protected the official page, perhaps with a widget placed in the page builder layout. The stray page has none of that, and it can post an order like any other checkout.

Stray pages are also often indexed or linked from an old sitemap, so a bot crawling your site can find them without guessing.

How to find them

Start with the page list in the admin. Search for "checkout" and look at every result, including drafts and private pages. Then search the content itself, since the title may not say checkout at all.

If you have WP-CLI, this lists every published page whose content contains the shortcode or the block:

wp post list --post_type=page --post_status=publish --fields=ID,post_title,post_name \
  --s=woocommerce_checkout

wp db query "SELECT ID, post_title, post_name FROM wp_posts WHERE post_type='page' AND post_status='publish' AND post_content LIKE '%wp:woocommerce/checkout%'"

Change the wp_ table prefix if your site uses a different one. The first command searches the shortcode name. The second finds pages that use the Checkout block.

Page builders can make this harder. Elementor, for example, stores layouts in post meta rather than in the main content field, so a checkout widget may not show up in a plain content search. Check builder templates and saved sections too.

What to do with what you find

For each page that is not your official checkout, decide which of these fits:

• Delete it if nothing links to it and nobody needs it. Empty the trash too, because a trashed page can be restored.
• Unpublish it if you want to keep the design for later. Set it to draft or private so it stops answering.
• Remove the checkout element if the page is used for something else, such as a landing page that once had a checkout embedded.
• Redirect the old URL to the real checkout if old links or ads still point at it.

After the cleanup, open the old URLs in a private window. A 404 or a redirect means the page is gone. A working checkout form means something is still rendering it.

Staging copies are their own problem

A staging site on a public URL is a full copy of your store. If it has live gateway keys, it can charge real cards. Bots find staging hosts through certificate logs and search engines more often than people expect.

Put staging behind a password at the server level, use gateway test keys there, and remove staging sites you no longer use. A staging copy with live keys and no protection is a second store you forgot you run.

Where Checkout Bouncer fits

The Checkout Scanner in Checkout Bouncer looks for stray duplicate checkout pages as well as the official one, and tells you how each is rendered, whether by block, shortcode, or a page builder such as Elementor, Divi, or Bricks. You can then protect or block each route, instead of guessing which ones are live.