How to test checkout address validation: formats, tax, and shipping the happy path misses
How to test checkout address validation without writing scripts: international formats, missing and reordered fields, invalid postcodes, region-based tax, and shipping methods that recompute the total. The rules the happy-path test never touches, in plain English.
How to test checkout address validation: formats, tax, and shipping the happy path misses
The address form is the part of checkout everyone tests once and never revisits. Type a real address, watch it get accepted, move on. But the address field is doing far more than collecting text — it decides whether the package can be delivered, which tax rate applies, which shipping methods appear, and what the final total is. Every one of those is a downstream consequence of what the form accepts, and every one of them is a place the happy-path test never looks, because the happy-path test only ever enters one address: a valid one, in the tester's own country, that the app already handles. Address validation is the logic that runs on all the other addresses. That's what this playbook tests.
What "correct" address validation actually looks like
Before testing the behavior, it helps to name it, because "validate the address" hides three different outcomes. Google's own address validation for checkout guidance sorts every submitted address into three buckets: Fix — the address is low quality, so prompt for more information; Confirm — high quality but the system changed something (a corrected city, a standardized street), so ask the user to confirm; and Accept — high quality, proceed with no prompt. A good checkout does something sensible in all three, and the interesting bugs are in the first two, because Accept is just the happy path wearing a badge.
There's a second principle in that same guidance that teams get wrong in the opposite direction — being too strict. Google is explicit: your implementation "doesn't block customers from checking out due to entering an invalid address," and recommends giving customers "up to two chances to enter their address, and on the second attempt, accept their entry, even if it does not validate," optionally flagging it for review. The reason is concrete: a newly constructed building has a real address that isn't in the postal database yet. Reject it outright and you've refused a paying customer for being early. So address validation has two failure modes — too loose (garbage gets through to fulfillment) and too tight (real customers get locked out) — and a test that only enters valid addresses proves neither is under control.
Prompt 1: international formats and reordered fields
The fastest way to find an address-validation bug is to submit an address that's valid somewhere your dev team doesn't live. Postal codes that contain letters, addresses with no state/province, countries where the house number comes after the street — a form built and tested against one country's shape tends to reject or mangle the rest.
The finding here is usually a required field that shouldn't be, or a postcode regex written for five US digits. Neither shows up when the only address you ever test is your office. The agent works from the described intent — "enter a valid UK address, report if it's refused" — so it's testing the behavior, not a memorized set of selectors that a form redesign would break.
Prompt 2: missing, malformed, and the two-attempt rule
Now push on the invalid side. An empty required field, a postcode that's the right length but nonexistent, a house number of 0, a city that doesn't match the postcode. The correct behavior isn't "accept everything" or "reject everything" — it's the graduated Fix/Confirm/Accept response, including the escape hatch Google recommends so a real customer isn't trapped.
Step 3 is the one nobody tests, because it requires deliberately failing validation twice — behavior a scripted happy-path test is structurally incapable of, and exactly the kind of accidental-path bug an agent catches that your scripts miss. An infinite validation loop is a checkout you can't complete, which is a revenue bug wearing a UX costume.
Prompt 3: the correction the customer never confirmed
The Confirm case is the subtle one. The validator decides your address is basically fine but tweaks something — corrects a misspelled city, standardizes "Street" to "St", adds a ZIP+4. Google's guidance is specific that this should not happen silently, because "the changes made by the API might fundamentally alter what was originally entered"; the recommended pattern is an interstitial that gives the customer three choices — confirm the corrected version, keep the address exactly as they typed it (optionally flagged for review), or cancel back to the form. The bug is a checkout that silently overwrites what the customer entered with the "corrected" version and ships to an address they never saw.
A silent correction feels harmless until it turns a valid apartment into the wrong unit, or "re-corrects" an address the customer deliberately entered because they know their new building isn't in the database yet. Surfacing the change and letting the customer decide is the difference between helpful and presumptuous — and it's invisible to a happy-path test that only ever enters addresses the validator leaves untouched.
Prompt 4: tax and shipping recompute with the address
Here's where the address stops being a form and starts being money. In most stores the shipping address determines the tax rate and the available shipping methods, and both must recompute — visibly — when the address changes. The bug is a total that doesn't update: you enter a tax-free state, the tax line stays, and the customer is overcharged, or the reverse and you eat the difference.
Assert on what's presented, not on a tax table you're maintaining separately — the agent reads the tax line and total off the summary and reports them for each address, and the failure is a total that stayed the same across two regions that should tax differently. This is the same "test the seams between screen, provider, and total" logic the subscription-billing playbook uses on plan changes, applied to geography instead of time. One honest scope note: a browser agent confirms the total changed correctly relative to the address; it isn't a tax engine and won't tell you the rate itself is legally right for a jurisdiction — that's a job for your tax provider's own tests. What it owns is the far more common bug: the total that didn't move when it should have.
There's a related shipping edge worth its own attention: the type of address, not just its region. Many carriers won't deliver to a PO box, expedited or freight methods often aren't available to every destination, and some stores price residential and commercial addresses differently — Google's validation even returns a residential-or-commercial indicator in select regions for exactly this reason. Enter a PO box and confirm the methods that can't serve it actually disappear rather than staying selectable and failing at fulfillment; enter an address that only qualifies for standard shipping and confirm the express option isn't quietly offered. The pattern is the same as the region test — the available methods and their prices are a function of the address — but the trigger is the address's category, which is precisely the input a happy-path test using one familiar home address will never vary.
Prompt 5: the address that survives to the confirmation
The last mile of address testing is persistence: the address the customer confirmed is the address the order actually ships to. Corrections made mid-checkout, an apartment number added after autocomplete, a "confirm this standardized version?" prompt — any of these can end with the order storing a different address than the one on screen at the final step.
A dropped unit number is the address bug that generates a "where's my package" ticket a week later, long after the checkout looked perfect. This is the address-specific cousin of confirming the discount and total reconcile at checkout and that a Stripe charge matches the order — the through-line is that what the customer saw and approved has to equal what the system stored, and multi-step forms are where those quietly diverge, the same drift the multi-step form playbook chases.
Reading the results
Each run returns a Monito Session: a screenshot timeline of every address state, plus the network log. For address validation the network log matters because the total, tax, and shipping options are usually recomputed by a request the app fires when the address changes — captured with its method, URL, and status — so a total that didn't update is visible as a request that didn't fire or a response that came back unchanged. The screenshot timeline is where the format-rejection and dropped-field bugs show themselves.
The one to run right now
If you run one address test today, run the tax-and-total recompute — it's the one that costs real money in both directions. Save it as a Test Scenario, point it at staging, and wire it into CI against every deploy that touches checkout, tax, or shipping.
A full run is typically 8–13 credits — about $0.08–$0.13 — and your first run is free. Monito plans start at $99/mo, Enterprise at $129/mo. The address form looks like the simplest thing in checkout; it's quietly the field that decides whether the package arrives, what the customer pays, and whether the total is right. Test the addresses you don't live at — that's where it breaks.