Session Timeouts at Checkout: Warning Shoppers Before Time Runs Out
2026-10-24
Few checkout moments feel worse than watching a nearly finished order vanish because a session expired. For shoppers who read slowly, use assistive technology, or need to find a card or check an address, the standard timeout window can be genuinely too short.
Security teams set timeouts for good reasons, but the implementation is often lazy: no warning, no extension, and a cart emptied without explanation. That combination hits exactly the shoppers who needed the most time, and it is avoidable.
Warn before time expires
A warning should appear with time to act on it, commonly when a few minutes remain. It must be real text, announced by screen readers, reachable by keyboard, and it must not hide the form or trap focus while the shopper decides.
State what will happen plainly: how much time is left, what extending does, and what happens to the basket if time runs out. Vague warnings create panic clicks, which create errors, which eat the remaining time faster.
Make extending effortless
Extending should take one action, a clearly labelled button or keypress, and it should work as many times as the security policy allows. Do not ask shoppers to solve a puzzle, re enter credentials, or start checkout again just to gain a few minutes.
Where regulations genuinely limit extensions, say so in the warning and explain the limit before it bites. Surprises are the enemy. A shopper who knows they have one extension uses it wisely.
Preserve the basket, always
When a session does expire, keep the cart contents and as much entered information as security allows, and say what was kept. Rebuilding a basket from memory is hard for everyone and hardest for shoppers using assistive technology or buying complex items.
On return, land the shopper back at the step they left, with a short message explaining the timeout and confirming their items are intact. That single courtesy turns a frustrating dead end into a short detour.
Set timeouts from evidence
Measure how long real checkouts take, including the slowest decile, before setting limits. Many stores inherit a default timeout nobody chose, then defend it as policy. Evidence usually shows a longer window costs little risk and saves real orders.
Review timeout data alongside accessibility feedback. If extension requests and timeout abandonments cluster, the limit is wrong regardless of what the default said. Adjust it and watch completion rates respond.
Related reading
These earlier guides go deeper on connected questions: The Error Summary at Checkout: Accessible, Specific, and Worth Reading, Accessible Quantity Controls in the Cart: Steppers, Inputs, and Screen Readers, and Accessible Order Notes and Delivery Instructions: The Forgotten Cart Fields.
Frequently asked questions
Are checkout timeouts required for accessibility compliance?
Rules require that when time limits exist, users are warned and can usually extend them, unless the limit is essential. A silent timeout with no extension and a destroyed cart fails that expectation in most checkout contexts.
How much warning should a timeout give?
Enough time to notice, understand, and act, which in practice means warning at least a couple of minutes before expiry and making the extension control immediately reachable. Test with real assistive technology users, not assumptions.
Can the cart be kept after a session expires?
In almost all retail cases, yes. Payment details must be handled carefully, but items, quantities, and addresses can typically be preserved or restored on sign in. Emptying the whole basket is rarely a security necessity.
What should the timeout message say?
It should say how much time remains, offer the extension clearly, and state what happens to the basket if time runs out. Plain language, presented as text, announced to assistive technology, with no countdown pressure tactics.