Check webhook delivery when an external system is not receiving WooCommerce events such as order updates. Separate the store's outgoing webhook from a payment provider's incoming callback, because they are configured and logged in different systems.
IN THIS ARTICLE
01 Identify the exact event and destination
Record the webhook name, topic, destination URL and expected event time. Confirm the destination belongs to the intended integration and environment. A staging copy must not send live fulfilment or accounting events merely because it inherited production webhook settings.
02 Inspect the delivery path
- Open WooCommerce > Settings > Advanced > Webhooks.
- Check that the intended webhook is active and uses the correct topic and HTTPS delivery URL.
- Review the related delivery logs under WooCommerce's status/logging tools.
- Compare the response code and timestamp with the receiving application's logs.
- Check authentication or signature configuration, endpoint routing, firewall rules and timeouts.
- After fixing the cause, perform one controlled test event and confirm it is processed once.
Why did a webhook become disabled?
Repeated unsuccessful deliveries can cause WooCommerce to disable a webhook. Investigate the failing destination before reactivating it, otherwise the same failures will recur. A successful HTTP response also does not prove that the receiving application completed the intended business action; check its own processing record.
Is it safe to replay every failed event?
Not without understanding duplicate handling. The receiver should recognise events or business records already processed. Replaying an order event can otherwise create duplicate shipments, invoices or messages. Agree the recovery scope with the integration owner and preserve the original event references.
03 Protect webhook data
Payloads and logs can contain customer addresses, order details and secrets. Share only redacted excerpts through private support channels. Use the integration's supported signature verification and rotate a secret if it has been exposed.
04 Verify sustained operation
Monitor several subsequent legitimate events and check scheduled-action health if deliveries are queued. Record the endpoint owner and alerting process. When an integration ends, pause or remove its webhook as part of access cleanup rather than leaving customer data flowing to an unused destination.