Block checkout by state or ZIP on BigCommerce
Stops a shopper before payment when something in the cart cannot ship to their address, and cancels and refunds anything that gets through anyway.
2 checks
on every order: at checkout, then again after it is placed
State + ZIP
both are checked, so a mismatched address is caught
3 actions
per rule: cancel and refund, hold for review, or notify only
The problem
A multi-brand regulated retailer sells products that are legal in some US states and banned in others. Some are also banned in specific ZIP codes, and the rules differ by product type.
BigCommerce has no built-in way to say "this product cannot ship to this state." The stores relied on a hand-maintained checkout script, with the restricted states and thousands of ZIP codes written into the code itself. Every rule change meant editing and re-uploading a file.
Shoppers in banned locations could still reach payment. Each of those orders had to be found, cancelled and refunded by hand, and kept from being shipped.
What we built
A private BigCommerce app that holds the rules in one place and enforces them twice: at checkout before the customer pays, and again on every new order as a backup.
- A checkout check. As soon as a shipping address is entered or a saved address is picked, the cart is checked against the store’s rules. If anything is restricted, the billing and payment steps are hidden and the shopper sees a clear message. Checkout continues as soon as they change to an allowed address.
- A backup on every order. The same rules run again when an order is created. Each rule picks what happens: cancel and refund, hold for staff review, or notify only, which lets staff test a new rule safely.
- A rule editor for staff. Rules read like a sentence: if the cart has these products, and the address is in these places, then block. Products match by category, name or SKU. Places match by state or by a ZIP list. Each rule has a priority and an on/off switch.
- Email alerts when a checkout is blocked, an order is cancelled or held, or a refund fails.
- Administrator, editor and viewer roles, so only the right people can change rules that cancel real orders.
How it works
- The app runs inside the BigCommerce control panel and installs its own script on the checkout page only.
- Checkout and the order backup use the same rule engine, so the two always agree.
- The ZIP and state loophole. Shoppers could pick an allowed state from the dropdown while typing a street address and ZIP in a banned state. The fix maps every US ZIP to its state and checks both the state the shopper selected and the state the ZIP belongs to. If either is restricted, the order is blocked. A few ZIP ranges that cross state lines are left to the selected state, so real customers are not blocked by mistake.
- It fails open. If the check errors or times out, checkout is not blocked, so an outage does not cost real sales. The order backup catches anything that gets through.
- Refunds work in layers. The app first tries to void the payment through BigCommerce, then directly through the payment gateway (Authorize.Net), then issues a refund. If all of that fails, staff get a "refund failed" alert.
- Retries are safe. One run cannot cancel or refund the same order twice.
- Every decision keeps a record of which rule matched and why, so staff can see why an order was stopped.
Results
- Rules moved from a hard-coded file to a database staff edit in the app. Changes take effect without uploading code.
- The ZIP and state mismatch loophole was found and closed.
- The manual find, cancel and refund steps are gone for restricted orders that reach the store.
- The same rules feed the retailer’s other tools, so marketing and public "where can we ship" pages match what checkout enforces.
Could this work for your store?
The checkout check, the ZIP to state table, the order backup and the rule editor are not tied to one product type. They suit any BigCommerce store that ships products with location limits.
What changes per store: your rule lists and the wording of the message. The direct void step is written for Authorize.Net, so a store on another gateway needs that one piece rewritten. A heavily customized checkout needs testing.
This is the build behind our checkout compliance offer. The free check shows you where your own checkout lets restricted orders through.
See the checkout compliance offerRelated work
Turn off free shipping or PO Box delivery for certain products
Rules that remove shipping options at checkout when the cart holds certain products, ships to a PO Box, or falls inside an order value range.
Read the caseStop selling products automatically on a legal cutoff date
On a set date and time, sales of named product lines stop on their own. The pages stay online, so search rankings are kept.
Read the casePromo badges and deals pages that update themselves
Product cards, product pages, the cart and deals pages show which promotions apply, and they update on their own when a promotion changes or ends.
Read the caseSee where your own checkout stands
The first step is the same for every store: a free check of your shipping policy and checkout, sent back as a short video.
BuildPath is run by Ian Mason, a developer with 20 years in ecommerce and search.
- The check is free
- A short video of what we find
- If we find nothing, we tell you that