A gifting link is public on purpose. That is the whole point: you paste it into a DM, the creator opens it on their phone, picks what they want, and the order lands in your Shopify admin without a single back-and-forth about sizes or addresses. But anything you can open without a login, anyone can open without a login. Sooner or later one of your links gets forwarded to a friend, screenshotted into a "free stuff" group chat, or posted under a Reel where 4,000 people can tap it.
When that happens, the instinct is to treat it like a security breach and hunt for the leaker. Do not bother. You will never find them, and secrecy was never the defense anyway. The defense is making a leaked link boring: capped, deduped, and scoped tightly enough that even if it ends up in a deals forum, it cannot empty your warehouse. Here is how to set that up before it happens, and what to do in the ten minutes after you realize it already did.
Cap total orders at 2 to 3x your invite list
The single most important setting on any gifting campaign is the total-order cap. This is the number of orders the link will accept before it stops, full stop. Most brands leave it blank because unlimited feels generous, and then they find out what unlimited means the week a link goes wide.
Set it at two to three times the number of creators you actually plan to invite. Inviting 50 creators? Cap the campaign at 100 to 150. That leaves room for the legitimate forwards (a creator who genuinely loops in a peer) and for your own margin of error, while drawing a hard ceiling a leak cannot cross. When the cap is hit, good tooling holds the overflow submissions for review instead of silently creating orders, so you get a pile of held entries as an alarm bell rather than a fulfillment bill.
Dedupe by email so one person cannot claim twice
The second layer is email deduplication: one submission per email address per campaign. This stops the most casual abuse, the person who submits, loves it, and comes back an hour later for a second box. With dedup on, that second attempt bounces.
It is not bulletproof on its own, because a determined person has more than one email address. That is fine. Dedup is not supposed to be the only wall. It is the layer that removes the lazy 80 percent of double-dipping for free, so your caps only have to deal with the motivated few. If you are running gifting at volume, you also want to be tracking creators inside Shopify so the same name showing up across three campaigns is visible instead of buried.
Limit items per order, especially on expensive SKUs
A per-order item cap controls how much a single submission can take. For a $6 lip balm, letting a creator pick three is generous and on-brand. For a $90 serum, one item per order is the only sane setting. Match the cap to the cost of being wrong.
This matters most in combination with the total-order cap. If your campaign cap is 120 orders and your item cap is one, the worst-case exposure of a leaked link is 120 units, a number you chose on purpose. Leave the item cap at "no limit" and the same leak can clear several times that before the order cap even trips.
Use a fresh link for every batch
Here is the operational habit that prevents most of the pain: one campaign link per outreach batch, not one link you reuse all quarter. Spinning up a new campaign for each push costs you about ninety seconds and buys you two things.
First, you can cap each batch independently, so a 20-person micro-creator push and a 200-person seasonal push are not sharing a ceiling. Second, when submissions spike unexpectedly, you know exactly which list leaked, because each list had its own link. A brand running one evergreen link for six months has no idea where the leak came from and no way to shut it without cutting off everyone. A brand running per-batch links just pauses the one campaign and moves on.
When a link has already leaked
If you are reading this because submissions are climbing from people who are not on your list, do this in order. Pause or archive the affected campaign first. That stops new submissions immediately, leaves your real creators' existing orders untouched, and parks anything that came in over the cap in a held state instead of auto-fulfilling it.
Then review the held and recent submissions. Some will be legitimate forwards worth honoring; most will be obvious. Approve the ones you want, ignore the rest, and start your next batch on a brand-new link. Do not try to "fix" the leaked link by editing it. The link is burned. A new campaign is cleaner and takes a minute.
Finally, if you keep getting hit, the leak may not be the real problem. A link that spreads is also a signal your product is in demand, and the same instrumentation that catches leaks, capped orders and per-batch links, is what lets you read whether the seeding is actually working instead of just leaking. Leaks and fraud get conflated a lot, so it is worth reading the five fraud patterns separately. A leak is your real link going too far; fraud is fake people gaming the form. You want defenses against both.
None of this requires a contract, a login wall, or a security review. It requires treating every gifting submission as what it is, a $0 order with a real fulfillment cost, and setting the form up to enforce the limits you already have in your head. Tools built for this, including Seed, bake the caps and dedup straight into the gift link and hold the overflow for you, so a leaked link becomes a non-event instead of a Monday-morning crisis.
FAQ
How many total orders should I cap a gifting campaign at?
Set the cap at two to three times the number of creators you plan to invite. If you are inviting 50, cap it around 100 to 150. That covers everyone you meant to reach plus a margin for forwards, while still stopping a runaway leak before it clears a pallet.
Can the same person claim a gift twice with one link?
Not if your form dedupes by email per campaign. One email gets one submission on that campaign. They can still try a second email address, which is why a per-order item cap and a total-order cap matter as the second and third layers.
Should I use one gifting link for everyone or one per batch?
One per batch. A separate campaign link for each outreach push lets you cap each one independently and see exactly which list leaked when submissions spike. One shared link for a whole quarter is the single most common way brands lose product.
A link clearly leaked. What do I do right now?
Pause or archive that campaign. The link stops accepting submissions immediately, existing orders are untouched, and anything that came in over your cap is held for review rather than auto-fulfilled. Then start the next batch on a fresh link.
Is a leaked link the same problem as gifting fraud?
Related but different. Fraud is bad actors faking accounts or submitting under multiple identities. A leak is your real link spreading past the people you sent it to. The vetting checklist handles the first, caps and per-batch links handle the second, and you want both.