Promo Codes Testing Checklist (2026)

January 22, 2026 · 20 min read · Testing Checklists

Promo Codes Testing Checklist (2026)

A promo code is a short alphanumeric token that unlocks a discount, free trial, gift, or other incentive when entered during checkout or account creation. Testing promo codes thoroughly prevents revenue leakage, protects brand trust, and avoids regulatory pitfalls. The checklist below groups 38 concrete items into seven functional areas plus a release‑readiness section. Each item includes a pass criterion, a real‑world example, and notes on how manual, automated, or autonomous exploration (e.g., with SUSA) can cover it.

---

Promo Codes Testing Checklist (2026) – Happy Path

Core redemption flow

#	Test Item	Pass Criterion	Example	Automation Hint
1	Valid code entry on checkout page	Discount applied correctly, order total reflects new amount, confirmation shows code used	Code “SPRING20” gives 20 % off a $100 cart → $80 total	UI test enters code, asserts price change
2	Code applied before payment	Discount visible on cart summary before proceeding to payment	User sees “- $20” line item after code entry	Assert DOM element text before “Pay” button click
3	Code works on first‑time user	New account receives discount, no prior purchase required	Guest checkout with code “WELCOME10” → 10 % off	Create fresh test user, run flow
4	Code works for returning user	Existing logged‑in user can redeem without re‑authentication	Logged‑in user applies “LOYALTY15” → discount applied	Use session cookie or login API
5	Code works across devices	Same code yields identical discount on mobile web, native app, and desktop	Code “BLACKFRIDAY” works on iOS app, Android web, Chrome	Run matrix of device/OS combos
6	Code works with multiple items	Discount applies to cart total, not per‑item unless specified	Cart with 3 items ($30 each) → 10 % off total $90 → $81	Assert total after code entry
7	Code works with shipping taxes	Discount calculated before tax/shipping or after, per business rule	If discount pre‑tax: $100 + $10 tax → 20 % off $100 = $80 + $10 tax = $90	Verify tax line matches rule
8	Code works with gift cards	Gift‑card balance + promo discount both applied	$50 gift card + “SAVE5” → $5 off → final $45 charge	Check both balances updated
9	Code works with subscription plans	Recurring discount applied to first billing cycle	Code “FIRSTMONTHFREE” → $0 first month, then regular price	Verify subscription object shows discount flag
10	Code works with bundled offers	Bundle discount stacks or does not stack per policy	Bundle “BOXSET” 15 % off + code “EXTRA10” → either 23.5 % stacked or 15 % only	Validate against promo‑stacking rule

Success messaging & receipt

#	Test Item	Pass Criterion	Example	Automation Hint
11	Success toast/message appears	Non‑blocking toast with code name and discount amount displayed for ≥2 s	“SPRING20 applied – saved $20”	Wait for toast element, assert text
12	Order confirmation email includes code	Email body lists redeemed promo and discounted amount	“Promo: SPRING20 – Discount: $20.00”	Parse email fixture, assert substring
13	Order history shows promo usage	User’s order detail page shows promo code field populated	Order #12345 → Promo: WELCOME10	API GET /orders/{id} assert promo field
14	Loyalty points adjusted (if applicable)	Points earned reflect discounted spend, not original	Spend $80 after 20 % off → earn 8 points (10 pts/$)	Check points balance after order
15	Referral credit not double‑counted	If promo and referral both apply, each credited once	Referral gives $5, promo gives 10 % → total correct	Verify both credits in ledger

---

Promo Codes Testing Checklist (2026) – Error Handling

Invalid code detection

#	Test Item	Pass Criterion	Example	Automation Hint
16	Non‑existent code	Error message “Invalid promo code” displayed, no discount applied	Enter “FAKE123” → toast: “Code not found”	Assert error element visible, price unchanged
17	Expired code	Message “This promo has expired”	Enter “SUMMER21” after 30 Sep 2021 → error	Set system date or use backend flag
18	Code used beyond usage limit	Message “This promo has reached its usage limit”	Code limited to 100 uses, 101st entry fails	Pre‑populate usage counter via API
19	Code not applicable to cart items	Message “Promo not valid for selected items”	Code for “Shoes only”, cart contains a shirt	Verify error, discount not applied
20	Code requires minimum spend	Message “Spend $50 to use this promo”	Cart $30 + code “SAVE10” → error	Test cart just below and just above threshold
21	Code restricted to user segment	Message “This promo is for new users only”	Existing user tries “NEWUSER20” → error	Attach user‑type flag, assert denial
22	Code case‑sensitivity handling	System treats code as case‑insensitive (or as defined)	If case‑insensitive, “spring20” works; if strict, fails	Try both variations
23	Code with special characters	Accepts hyphen, underscore, or rejects per spec	“SPRING-20” accepted; “SPRING@20” rejected if not allowed	Send varied strings, check response
24	Leading/trailing whitespace	System trims whitespace before validation	Enter “ SPRING20 ” → accepted	Send code with spaces, assert success
25	Code length limits	Rejects codes shorter than min length or longer than max	Min 5, max 12 → “ABCD” rejected, “ABCDEFGHIJKL” rejected	Boundary test with 4,5,12,13 chars
26	Duplicate submission prevention	Second submit of same code shows “already applied” not error	After first apply, clicking Apply again → toast “Code already used”	Click button twice, verify state
27	Network timeout fallback	UI shows retry option, does not apply discount twice	Simulate 5 s delay on /apply endpoint → show retry	Mock server delay, assert UI behavior
28	Server error (5xx) handling	Shows generic “Try again later”, does not consume code	Return 500 on apply → error toast, code still valid	Mock 500, verify code not marked used
29	Client‑side validation bypass	Even if JS disabled, server rejects invalid code	Disable JS, submit “BADCODE” → server error	Use curl or fetch without JS, assert 400
30	Race condition under high load	Concurrent requests for same limited‑use code grant discount to only one user	10 users submit same code simultaneously → only 1 succeeds	Use k6 or Locust to fire parallel requests, check counts

---

Promo Codes Testing Checklist (2026) – Edge / Boundary Cases

Discount calculations

#	Test Item	Pass Criterion	Example	Automation Hint
31	Percentage >100%	System rejects or caps at 100 % (per policy)	Code “FREE200” → error or free item	Try 150 % code, assert rejection or zero price
32	Fixed amount > cart total	Discount cannot make total negative; total set to $0	Cart $5, code “TAKE10” → $0 total, not –$5	Assert max(0, total‑discount)
33	Fractional cents handling	Rounding follows bankers’ rounding or defined rule	$49.99 with 33 % off → $33.4935 → $33.49 or $33.50	Compute expected, assert exact cents
34	Multiple percentage stacks	If stacking allowed, apply sequentially not additively	10 % then 10 % on $100 → $81, not $80	Apply two codes, verify final
35	Tiered discount thresholds	Different % based on spend brackets	$0‑$49 → 5 %; $50‑$99 → 10 %; $100+ → 15 %	Test cart values at each boundary
36	Time‑zone sensitivity	Promo active based on UTC start/end, not local	Code active 00:00 UTC Jan 1 – 23:59 UTC Jan 31	Set device TZ, verify activation/inactivation
37	Daylight‑saving shift	No double‑count or skip when clocks change	Promo runs 01:00‑03:00 local, DSB shift → still 2 h window	Simulate clock change, check active period
38	Leap year February 29	Promo scheduled for Feb 29 works only on leap years	Code “LEAP2024” active Feb 29 2024, not 2025	Set date to 2024‑02‑29, assert active; 2025‑02‑28 assert inactive

Input & UI edge cases

#	Test Item	Pass Criterion	Example	Automation Hint
39	Max length field	Input field accepts up to defined max, blocks extra	Field max 12 → typing 13th char blocked or trimmed	Send long string, assert length
40	Paste from clipboard	Pasted code validated same as typed	Paste “SPRING20” → works	Use clipboard API in test
41	Autocomplete suggestions	No suggestion reveals inactive or expired codes	Typing “SPR” shows only active codes	Observe dropdown, assert no expired
42	Right‑to‑left language layout	Field aligns correctly, cursor moves as expected	Arabic UI: code entry right‑aligned	Switch locale, inspect direction
43	Zoom level 200%	All elements readable, no overlap	Promo entry visible at 200% zoom	Set browser zoom, assert no overflow
44	Screen orientation change	State preserved on rotate	Enter code, rotate to landscape → code still shown	Rotate device/emulator, assert field value
45	Hardware keyboard vs on‑keyboard	Both produce same result	Desktop keyboard entry works, mobile OSK works	Test both input methods
46	Voice input transcription	Voice‑to‑text yields correct code	Say “spring two zero” → “SPRING20”	Use speech API, verify result
47	Barcode/QR code scan	Scanned code populates field and validates	Scan QR encoding “SPRING20” → field filled	Use camera mock, assert success
48	Copy‑protected field	Right‑click copy disabled if required	Attempt to copy code from tooltip → blocked	Try document.execCommand('copy'), expect failure
49	Invalid Unicode normalization	Different visual forms treated same	“SPRING20” with full‑width chars → accepted	Send full‑width variants, assert same outcome
50	Emoji injection	Emoji ignored or causes validation error	Enter “SPRING20😀” → rejected	Send emoji, assert error

---

Promo Codes Testing Checklist (2026) – Accessibility

#	Test Item	Pass Criterion	Example	Automation Hint
51	Label association	Each input has associated or `aria-label`	`Promo code`	axe-core asserts label present
52	Keyboard navigable	Tab moves focus to code field, Apply button, then next	Tab order: field → button → continue	Simulate Tab key, check focus order
53	Visible focus indicator	Field shows outline ≥2 px when focused	CSS `outline: 2px solid #005fcc`	Check computed style on focus
54	Error message ARIA live	Invalid code triggers `aria-live="assertive"` region		Assert live region updates on error
55	Contrast ratio	Text and background meet WCAG AA (≥4.5:1)	Promo text #212529 on #fff → 7.5:1	Use axe or manual contrast tool
56	Scalable text	Up to 200% text size does not break layout	Increase browser font size → field still usable	Set `font-size: 200%`, assert no overflow
57	Screen reader announces discount	After successful apply, reader says “Promo SPRING20 applied, saved $20”	Use NVDA or TalkBack to verify	Record utterance, assert phrase
58	Touch target size	Apply button ≥44 dp × 44 dp	Button dimensions 48 × 48 dp	Measure via UIAutomator or Espresso
59	Reduced motion respected	Animation disabled if `prefers-reduced-motion`	No fade/tooltip slide when setting enabled	Check CSS media query, assert no animation
60	High contrast mode	Colors invert or adapt correctly	In Windows HC mode, promo field uses system colors	Enable HC, assert readable contrast
61	Language switch preserves state	Changing language does not clear entered code	Enter code, switch to French → code still present	Change `lang` attribute, assert field value
62	Error announcement timing	Error announced within 400 ms of invalid entry	Live region triggers promptly	Measure time between input and screen reader output
63	Focus returned after modal	After promo‑info modal closes, focus returns to field	Close “How promo works” dialog → focus on field	Trigger modal, close, assert activeElement
64	No placeholder as sole label	Placeholder not used as only label (fails WCAG)	Field has both placeholder and visible label	Inspect DOM, fail if only placeholder
65	Accessible name for icon-only button	Apply button with icon has `aria-label="Apply promo"`	Icon button	Assert aria-label present
66	Skip link to promo field	Early skip link jumps directly to promo entry	`Skip to promo`	Activate link, assert focus on field
67	Responsive breakpoint accessibility	Layout does not hide promo field on small screens	@media (max-width:320px) field still visible	Resize viewport, assert field present
68	No autoplay audio on promo page	Page does not play sound automatically	No	Scan DOM for audio elements without user gesture
69	Error message announced in user language	If UI language is Spanish, error appears in Spanish	“Código no válido”	Change locale, assert translated message
70	Focus trap in modal	When promo‑info modal opens, tab does not escape	Tab cycles within modal until closed	Open modal, press Tab repeatedly, assert focus stays inside

---

Promo Codes Testing Checklist (2026) – Security & Privacy

#	Test Item	Pass Criterion	Example	Automation Hint
71	Code leakage in URL	Promo code never appears in query string or fragment	`https://shop.example/cart?promo=SPRING20` → forbidden	Inspect network calls, assert no promo in URL
72	Code masked in logs	Backend logs replace promo with `*`	Log line: `Applied promo: ****`	Check log samples, assert masking
73	Rate limiting on apply endpoint	Max N requests per IP/minute to prevent brute force	10 requests/min → 11th returns 429	Use curl loop, assert 429 after limit
74	JWT/session binding	Promo apply requires valid authenticated session	Anonymous POST to /apply returns 401	Send request without cookie, assert 401
75	Code entropy check	System rejects predictable sequences (e.g., “111111”)	“111111” → error “code too weak”	Try weak patterns, assert rejection
76	No SQL injection via promo field	Input sanitized, injection attempt fails	`' OR 1=1--` → error, no DB error	Send payload, assert no 500, DB unchanged
77	No XSS via promo display	Rendered code escaped, no script execution	rendered as text	Inject script, assert not executed in DOM
78	CSP blocks inline script	Content‑Security‑Policy prevents inline JS from promo UI	`script-src 'self'` blocks attempts	Verify CSP header, try to inject