---
schema_version: "1"
id: 8b82fb30d02e880322faa490b26e3d998e7a1f14b1280967cf4796fa8f93fbc6
title: Limit Storefront Order Access
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_limit_storefront_order_access_settings.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_limit_storefront_order_access_settings.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: f5a44064a4bebac73d859a553a83826aaf6a80734a170c841d2202fce2577753
description: Unauthorized access to B2C Commerce storefront orders happens when someone accesses an order through a storefront session using a different customer ID than the one used to create it. This makes it possible for unauthorized users to view the order’s details.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Limit Storefront Order Access

Unauthorized access to B2C Commerce storefront orders happens when someone accesses an order through a storefront session using a different customer ID than the one used to create it. This makes it possible for unauthorized users to view the order’s details.

To enhance the security of your storefront and prevent unauthorized access to orders, Salesforce recommends that you enable two specific preferences:

- Limit Storefront Order Access = Yes
- Allowlist = Storefront controllers and hooks allowed access to storefront orders

Business Manager alerts identify storefront controllers and hooks that can access storefront orders but aren't on the allowlist. Users with access to the Order Preferences module see the alerts and can review whether any of the controllers and hooks are required. You can copy and paste controllers and hooks that need access from the alert into the allowlist.

If you enable the preferences, Salesforce automatically blocks all sources not included on the allowlist for storefront order access. Salesforce recommends that you remove any other sources of storefront order access from the server to avoid unauthorized execution. To keep access to orders secure, maintain a concise allowlist of storefront controllers and implement ‌security checks in the custom code. For example, verification for a guest order lookup ‌can include this information to validate the access request:

- Order number
- Email address
- Shipping information

See Also:

- [Limit Storefront Order Allowlist FAQ](https://help.salesforce.com/s/articleView?id=cc.b2c_allowlist_faq.htm&language=en_US)