The checkout thank-you page returns HTTP 500, but only to bots

Symptoms

A site check found that the order confirmation page (/step/thank-you/) returns HTTP 500. On a store that looks alarming: customers might see an error right after they pay.

Environment

WordPress with WooCommerce. The checkout and thank-you page are built with the CartFlows plugin (a custom post type called "step"). Yoast SEO generates the sitemap.

Diagnosis

Opened without parameters, the page shows "We can't seem to find an order for you". The plugin prints this through wp_die(), which sends status 500.
A week of access logs settled it. All customer visits after payment (returning from the payment gateway with order parameters) got 200. Status 500 appeared only a few times: search engine and shopping aggregator bots opening the page directly, plus one request with someone else's invalid parameters.
Why bots knew the page at all: Yoast put the "step" post type in the sitemap (cartflows_step-sitemap.xml). The same was true for Elementor header and footer templates (elementor-hf-sitemap.xml).

A customer arrives after payment with the order parameters and gets a 200 page. A bot arrives from the sitemap without parameters and gets error 500.

Cause

Nothing was wrong with the checkout. Helper pages that only make sense with an order were listed in the sitemap as regular content. Bots kept opening them and getting 500.

Risks if left untreated

Until you know who gets the 500 error, you don't know whether paying customers see it too. Meanwhile Google and shopping aggregators see a site with errors and waste crawls on pages with no content. In Search Console it looks like a broken checkout, and a real fault, when it comes, is easy to miss.

Fix

In Yoast SEO → Search appearance → Content types, we turned off "Show in search results" for "Steps" (CartFlows) and "Elementor Header & Footer". This removes them from the sitemap and adds noindex. The checkout itself wasn't touched.

Verification

sitemap_index.xml no longer lists either type, and cartflows_step-sitemap.xml returns 404.
A test checkout and the thank-you page with a valid order both work.

Prevention and lessons

Before you start fixing a 500 error, check the access log to see who is getting it. Checkout builder steps, templates and similar helper post types don't belong in the sitemap. After installing such a plugin, review the list of sub-sitemaps in your SEO plugin.

Related services: Crashes and errors Online store and checkout