Hi @rubenecho,
Thanks for reaching out and for sharing the information you received from Stripe support.
If the webhook signing secret stored in WooCommerce no longer matches the one in your Stripe account, the easiest way to resolve this is to recreate the webhooks from within the WooCommerce Stripe plugin.
Before proceeding, I’d recommend creating a staging site and testing the following steps there first:
- Navigate to WooCommerce → Settings → Payments → Stripe → Settings.
- In the Account details section, click Configure connection.
- Under the Live tab, click Reconfigure webhooks.
- Under the Test tab, click Reconfigure webhooks.
This process will recreate the correct webhooks in your Stripe account and remove any older webhook configurations that may be pointing to your site with an outdated signing secret.
After reconfiguring the webhooks, please test a new transaction and check whether the 400 errors continue to appear in your Stripe Dashboard.
If the issue persists, please share:
- A screenshot of the webhook error from your Stripe Dashboard. You can use the following tool to share a screenshot:https://snipboard.io
- Any relevant entries from WooCommerce → Status → Logs related to Stripe.
- Your WooCommerce System Status Report.
Please use https://pastebin.com/ or https://gist.github.com/ and share a link to that paste in reply here. Once we have more information, we’ll be able to assist you further.
Thread Starter
Ruben
(@rubenecho)
Hi team,
The issue is still presisting so here is a link to the screenshot https://snipboard.io/nwjUNb.jpg of stripe dashboard.
System report – https://pastebin.com/Qzz5ahxG
Stripe log for today – https://gist.github.com/rdsardinha/7f395e386f0fec545a8c1ada6323e733
I will wait for your response
Regards
Ruben
Hi @rubenecho,
Thanks for sharing those. That’s really useful.
Looking at everything together: your payments are actually going through fine (I can see a successful charge in the logs), but Stripe is getting a 400 back from your site each time it tries to deliver a webhook event to https://www.sitandsleep.co.uk/?wc-api=wc_stripe. A 400 from that endpoint means WordPress received the request but rejected it, which happens when the signing secret stored in the plugin doesn’t match the signature on the incoming event.
First question: did you get a chance to try the Reconfigure webhooks step from the previous reply? If so, and I suspect this is the case, Cloudflare is likely still the underlying cause. You mentioned Cloudflare in your original message, and it’s a common source of exactly this problem. If Cloudflare modifies the request body or headers in any way before the request reaches your server (compression, security scanning, Rocket Loader, etc.), it invalidates the HMAC signature Stripe uses to sign the payload, and the plugin will reject it with a 400 regardless of whether the signing secret itself is correct.
To rule this out, please add a bypass rule in Cloudflare for the webhook URL: https://developers.cloudflare.com/waf/custom-rules/skip/. While you’re there, make sure Rocket Loader is disabled for that URL too.
You’ll also want to exclude that URL from WP Rocket (which is active on your site): go to WP Rocket → Advanced Rules → Never Cache URL(s) and add /?wc-api=wc_stripe.
Once those are in place, hit the Resend button on one of the failed webhook events in your Stripe Dashboard and let us know if the 400 clears. A test transaction will also suffice.
I hope that helps. Let us know how that goes!
Thread Starter
Ruben
(@rubenecho)
Hi team,
I hope you are well.
I have created a Skip Rule on Cloudflare to exclude the wc_stripe as per your instructions but for WP Rocket when I add the expression you mentions its converted to a slash
Can you please help?
Regards
Ruben
Hi @rubenecho,
No worries, that’s a known WP Rocket quirk. The “Never Cache URL(s)” field doesn’t support query strings, which is why /?wc-api=wc_stripe is being converted to just /.
The fix is to use a different field: go to WP Rocket → Advanced Rules → Never Cache Query String(s) and add wc-api there (just the parameter name, without the ? or = part). This tells WP Rocket to bypass the cache for any request containing that query string, which covers your webhook URL correctly. If you need further assistance, please check with their support team.
Once that’s saved, resend one of the failed webhook events from your Stripe Dashboard and let us know if the 400 clears.
I hope that helps. Let us know if you need anything else.
Thread Starter
Ruben
(@rubenecho)
Hi there,
I added the rule as per the screenshot – https://snipboard.io/MpHPO3.jpg. This is the only place that mentions query strings
Would this be the correct area?
I have resended one of the failed webhook events from your Stripe Dashboard but still showing with 400 error
Dont know if its better to wait for another live order
Best Regards
Ruben
Hi @rubenecho
Thank you for the update.
If adding the query string exclusion did not resolve the issue and the resent webhook event is still returning a 400 error, I would recommend reaching out to the WP Rocket support team. They are the experts on their plugin’s configuration and can help verify whether the query string has been excluded correctly or whether additional cache settings may be affecting the webhook requests.
You can contact them here:
https://wp-rocket.me/contact/
Please note that in this forum we only provide support for the core features and functionality of Stripe Gateway for WooCommerce. Since this appears to involve WP Rocket’s caching configuration, their support team will be in the best position to assist further.
If you continue to experience the same issue after confirming that the correct rule has been added, I checked the System Status Report again and noticed that you’re using outdated versions of WooCommerce and Stripe Gateway for WooCommerce.
If you continue to experience the same issue after confirming that the correct rule has been added, I checked the System Status Report again and noticed that you’re using outdated versions of WooCommerce and Stripe Gateway for WooCommerce.
If you haven’t already done so, could you please update WooCommerce to version 10.8.1 and Stripe Gateway for WooCommerce to version 10.8.2? As a best practice, I recommend performing these updates on a staging site first to ensure everything works as expected before applying the changes to your live site.
After updating, temporarily deactivate the WP Rocket plugin on the staging site and test again to see whether the issue persists.
Please let us know how it goes, and we’ll be happy to assist further.
Thread Starter
Ruben
(@rubenecho)
Hi team,
Thank you for the help. I will contact WP Rocket team and let’s see if they can help me with this.
If I do require anything else I will let you know
Kind Regards
Ruben
Hi @rubenecho,
Sounds good! WP Rocket (or Cloudflare caching rules) interfering with the webhook endpoint is a reasonable direction to investigate, so hopefully their team can help get it sorted.
Feel free to come back here if you need anything further. We’re happy to keep digging if needed.
And if you found our support helpful, we’d really appreciate it if you could leave a review here: https://wordpress.org/support/plugin/woocommerce-gateway-stripe/reviews/
