What should I check for woocommerce stripe webhook signature mismatch?

Confirm the exact Stripe account, endpoint URL, mode and signing secret currently configured in WooCommerce. Check whether staging/live settings, multiple plugins or multiple Stripe accounts are sharing webhook destinations. Review recent updates, environment moves, and custom checkout or webhook code. Check Stripe delivery response codes and WooCommerce order notes for the same event timestamps. Run the free scan to surface whether payment records and WooCommerce order state already diverged.

Evidence guide

WooCommerce Stripe webhook signature mismatch

What to check when WooCommerce and Stripe report a webhook signature mismatch, failed webhook validation or payment/order drift.

Request Payment Rescue Review Review webhook security

Evidence before edits

No automatic changes

Clear next action

Decision map

01 · Observed signal

WooCommerce or gateway logs mention signature mismatch, invalid signature or failed webhook validation.

02 · Evidence to inspect

Stripe webhook endpoint URL, mode, recent delivery attempts, response codes and event IDs.

03 · Safe next move

Use the free scan if you need to see whether payment/order evidence has already drifted.

Start here

Understand the problem before changing the system.

Webhook signature mismatch errors usually mean WooCommerce rejected a Stripe event because the signing secret, endpoint URL, raw-body handling or live/test context did not match what the plugin expected. That can leave Stripe payment records and WooCommerce order state drifting apart, and it can also signal that webhook trust boundaries need review.

Signals

What the issue can look like.

01WooCommerce or gateway logs mention signature mismatch, invalid signature or failed webhook validation.
02Stripe shows event delivery attempts, but WooCommerce does not create the expected paid or processing order note.
03The issue starts after a plugin update, staging/live move, endpoint edit, secret rotation or account change.
04Multiple Stripe endpoints, accounts or plugins appear to be sending events to the same store.

Possible causes

What may have interrupted the expected path.

The webhook signing secret in WooCommerce does not match the active Stripe endpoint secret.
Multiple Stripe accounts or environments are pointing at the same store with conflicting secrets.
A plugin update, environment change, or copied configuration left old webhook values in place.
A proxy, security layer, serverless function or custom code changed request body handling enough to break signature verification.
The endpoint accepts events from the wrong environment or does not fail closed consistently on invalid signatures.

Evidence checks

What to verify first.

Confirm the exact Stripe account, endpoint URL, mode and signing secret currently configured in WooCommerce.
Check whether staging/live settings, multiple plugins or multiple Stripe accounts are sharing webhook destinations.
Review recent updates, environment moves, and custom checkout or webhook code.
Check Stripe delivery response codes and WooCommerce order notes for the same event timestamps.
Run the free scan to surface whether payment records and WooCommerce order state already diverged.

Evidence to collect

Stripe webhook endpoint URL, mode, recent delivery attempts, response codes and event IDs.
WooCommerce gateway logs, order notes and plugin settings showing the active signing secret context.
Recent plugin, hosting, proxy, cache, security or custom webhook code changes.
Example order/payment IDs where Stripe and WooCommerce no longer tell the same story.

What not to do

Do not paste webhook signing secrets into email or support tickets.
Do not disable signature verification to make orders process.
Do not replay real production events or edit customer orders until evidence is matched.
Do not treat a signature mismatch as only an operational issue if public webhook exposure or fail-open behaviour is possible.

Decision path

Move from signal to evidence to action.

Use the smallest safe step that resolves uncertainty. Implementation comes after the evidence is clear.

01Use the free scan if you need to see whether payment/order evidence has already drifted.
02Request Payment Rescue Review when a specific order or customer-support decision is blocked.
03Request Stripe Webhook Security Review when you need approved endpoint exposure, invalid-signature rejection and webhook boundary evidence.

Supporting evidence

Continue with the most relevant next resource.

Check WooCommerce and Stripe records firstUse the free read-only scan to find payment/order drift before changing webhook settings.Inspect the synthetic reconciliation evidenceFollow a fixed Stripe-succeeded, WooCommerce-pending timeline and see why HTTP 200 alone does not prove the order changed.

Quick answer

What does this usually mean?

First check

What should be checked first?

Confirm the exact Stripe account, endpoint URL, mode and signing secret currently configured in WooCommerce.

Need a human decision?

Check the evidence before changing a live system.

If a live WooCommerce order is stuck, start with payment evidence. If the concern is whether the webhook boundary rejects invalid callers and exposes only the right routes, request Stripe Webhook Security Review.

Request Payment Rescue Review Review webhook security