After a WooCommerce, Stripe gateway, hosting, proxy, or security update, Stripe webhooks can start failing signature verification. The most common cause is the wrong endpoint secret, but request-body changes, endpoint URL changes, WAF rules, and duplicated endpoints can create the same symptom.
Use this when Stripe shows webhook delivery failures, WooCommerce orders stay pending after successful payment, or refund and dispute events stop updating WordPress.
Quick answer
WooCommerce Stripe Webhook Signature Failure After Update should be handled with a narrow evidence-first workflow: match endpoint url, verify signing secret, check raw body, then verify the result before making broader changes.
What to check first
- Confirm the exact webhook endpoint URL in Stripe matches the WooCommerce Stripe settings.
- Reveal and compare the endpoint signing secret used by the live webhook endpoint.
- Check whether a proxy, WAF, security plugin, or middleware changes the raw request body.
- Review Stripe delivery logs and WooCommerce logs for the same event ID and timestamp.
- Send a test event and confirm the related WooCommerce order status changes as expected.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Match endpoint URL | Confirm the exact webhook endpoint URL in Stripe matches the WooCommerce Stripe settings. | Stripe test events return a successful HTTP response. |
| Verify signing secret | Reveal and compare the endpoint signing secret used by the live webhook endpoint. | A paid test order moves to the expected WooCommerce status. |
| Check raw body | Check whether a proxy, WAF, security plugin, or middleware changes the raw request body. | Refund or dispute events create the correct order note. |
| Compare logs | Review Stripe delivery logs and WooCommerce logs for the same event ID and timestamp. | Only one live endpoint is responsible for production WooCommerce events. |
Why this usually happens
- Test and live endpoint secrets can be copied into the wrong environment.
- Changing the domain, path, or plugin endpoint can leave Stripe posting to an old URL.
- Webhook signature verification depends on the raw request body, so middleware changes can break it.
- A payment can succeed at Stripe while WooCommerce misses the event that completes the order.
Field notes
- Never paste the full signing secret into a client ticket or public log.
- Use one Stripe event ID as the common key across Stripe, WooCommerce, and server logs.
- Check both payment success and refund events before closing the update.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
stripe_webhook_trace:
endpoint: /?wc-api=wc_stripe
event_id: evt_test_123
error: signature_verification_failed
checks: endpoint_url, signing_secret, raw_body, waf, duplicate_endpoint
expected_order_state: processing
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Match endpoint URL
- Verify signing secret
- Check raw body
- Compare logs
- Send test event
What to tell the client or owner
Give the owner the endpoint URL, Stripe event IDs tested, WooCommerce order IDs affected, and the exact reason signature verification failed.
Production verification checklist
- Stripe test events return a successful HTTP response.
- A paid test order moves to the expected WooCommerce status.
- Refund or dispute events create the correct order note.
- Only one live endpoint is responsible for production WooCommerce events.
Mistakes to avoid
- Do not judge the fix by one browser or the homepage only.
- Do not delete evidence before recording usernames, file paths, timestamps, and response headers.
- Do not add a cache, security, or tracking plugin while the original problem is still unclear.
- Do not leave test users, temporary debug logs, or broad API keys active after verification.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, malware risk, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, fix WooCommerce Stripe webhook failures.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Trace the complete Stripe event and order transition
Use the WooCommerce Stripe webhook troubleshooting guide to join endpoint delivery, raw-body signature verification, event and object IDs, order notes, retries, scheduled actions, stock, email, and analytics without unsafe replay.
Helpful references
Verify one safe webhook retry
After correcting the signature or endpoint failure, follow the WooCommerce Stripe webhook retry and idempotency test to prove that stock, email, order status, and fulfillment actions run once.
Separate signatures from rate limits
When Stripe reports HTTP 429 instead of a signature failure, follow the WooCommerce Stripe webhook 429 runbook to identify the limiting layer, respect Retry-After, and replay one event safely.