Guest wishlist in WooCommerce: why most plugins get it wrong

Most wishlist plugins treat the wishlist as an account feature: register, then save. But a wishlist is a "not yet" tool - people use it precisely while they are still deciding, which is exactly when they do not have an account.

Why guests matter more than accounts

The guest who saves three products today and buys two next week is the wishlist's core user. Forcing registration at the "save" click is a wall right where the intent is weakest - browse first, commit later.

A proper guest wishlist stores the list on a first-party cookie or token, keeps it server-side in your database, and merges into the customer's account automatically when they eventually log in.

How guest wishlists actually work

• Save without login - a signed, HttpOnly first-party cookie identifies the guest; your database stores a hash of it, not the raw value.
• Merge on login - the guest's saved items join the account wishlist when they register or sign in; nothing is lost.
• Expiry policy - guest lists can expire (e.g. 30-90 days) with clear behavior, or persist.

The crawler trap most plugins miss

The classic implementation adds ?add_to_wishlist=123 GET links. Crawlers, prefetchers, and social-media preview bots follow links - and your wishlist data fills with phantom items added by Googlebot and link unfurlers.

The fix: mutations through POST-only, namespaced AJAX that crawlers do not trigger. Same principle for share links - a public wishlist link should be noindexed and revocable, or it leaks customer intent into search.

Evaluating wishlist plugins: a checklist

• Guest-first? Save without account, merge on login - or is registration required?
• POST mutations? Or crawlable GET links that pollute data?
• Lean storefront? One button + one page, or a heavy drawer/sidebar/option suite patched into every product loop?
• Variation support? Guests saving "size M, blue" need variation-aware items.
• Data stays home? Wishlist data in your database, or shipped to an external service?
• Migration path? Can you import lists from YITH / TI / other plugins if switching?

Where Lightweight Wishlist lands

Guest-first by design: save without account, signed-cookie identity, merge on login. POST-only namespaced mutations so crawlers cannot add items. A shortcode page, an optional loop button, a My Account endpoint - and nothing else on the storefront. Data in dedicated tables on your site, no external service, plus a Wishlist Health dashboard that checks the install for common integration problems.