Webhook Troubleshooting

This guide will help you understand what webhooks are, why they sometimes stop working, and how to fix common webhook issues on your SureCart store. By the end, you’ll know how to diagnose and resolve most webhook problems on your own.

Let’s get started.

What Are Webhooks and Why Do They Matter?

Think of webhooks as the communication channel between the SureCart cloud and your WordPress site.

When something happens in your store — like a customer places an order, a subscription renews, or a refund is processed — SureCart’s cloud sends a notification to your WordPress site so it can react. This is how your site knows to grant access to a membership, fire automations, update a customer’s account, or trigger an email.

Here’s the important part: Your orders, customers, and payment data are always safely stored in the SureCart cloud at app.surecart.com, regardless of whether webhooks are working. Webhook issues don’t mean you’ve lost data — they mean your WordPress site isn’t receiving updates from the cloud.

Note: If you received an email from SureCart saying “We’re having trouble with your webhook endpoint” or “Your webhook endpoint has been disabled,” don’t panic. Your store data is safe, and this guide will walk you through fixing it.

Before You Start

You’ll need:

• WordPress admin access
• SureCart installed and activated
• Access to your hosting control panel (for firewall/caching settings, if needed)

Quick Fix: Resync Your Webhooks

This simple step resolves the majority of webhook issues. Try it first before doing anything else.

1. Go to your WordPress Dashboard → SureCart → Settings.
2. Click on the Connection tab.
3. Scroll down to Advanced Options.
4. Click Resync Webhooks.
5. While you’re there, click Clear Account Cache at the top of the settings page.

After resyncing, go to Tools → Site Health and check whether SureCart shows any errors. If everything looks good, you’re done!

Note: Resyncing re-establishes the connection between the SureCart cloud and your WordPress site. It fixes most temporary issues caused by server restarts, domain changes, or plugin updates.

Check Your Site Health

WordPress has a built-in tool that can tell you if something is blocking SureCart’s communication.

1. Go to WordPress Dashboard → Tools → Site Health.
2. Look for any errors related to:
   • REST API — Messages like “The REST API encountered an error” or “The response is not a valid JSON response.”
   • SureCart webhook processing — The Site Health page shows whether incoming webhooks are functioning normally.

If you see REST API errors, that’s almost always the cause of your webhook issues. Keep reading — the next sections explain the most common reasons and how to fix each one.

Common Causes and How to Fix Them

1. Caching Is Interfering with the REST API

This is the most common cause of webhook problems. SureCart relies on the WordPress REST API (the /wp-json/ routes on your site) to receive webhooks and handle dynamic content. If your caching plugin is caching these routes, SureCart receives outdated or broken responses.

How to fix it:

• Exclude /wp-json/ from caching. Most caching plugins have an option to exclude specific URLs or paths. Add /wp-json/ to the exclusion list.
• Exclude dynamic pages from caching. Pages like checkout, cart, customer dashboard, and login should never be cached.
• Don’t combine JavaScript files. This is unnecessary with HTTP/2 and can break SureCart’s functionality.
• Don’t defer core WordPress scripts. Scripts like wp-api-fetch, wp-a11y, wp-i18n, wp-url, dom-ready, and hooks must load normally.

If you’re using LiteSpeed Cache, we have a dedicated guide with the exact settings: Configuring LiteSpeed Cache for SureCart.

For a full overview of caching best practices, see our Caching Configuration Guide.

2. A Firewall or Security Plugin Is Blocking Webhook Requests

Webhooks are incoming requests from SureCart’s servers to your WordPress site. Firewalls, Web Application Firewalls (WAFs), and security plugins sometimes mistake these requests for threats and block them silently.

Signs this might be the issue:

• Webhooks worked fine before, then suddenly stopped.
• Your site uses Cloudflare, Sucuri, or a similar service.
• You have a security plugin like Wordfence, iThemes Security, or All In One Security installed.
• Your hosting provider recently changed server security settings.

How to fix it:

If you’re using Cloudflare:

1. Log in to your Cloudflare dashboard.
2. Go to Security → Events and look for any blocked requests matching your webhook URL (it will contain /wp-json/ in the path).
3. If you find blocked requests, create a WAF exception rule that allows traffic to your webhook path. You can do this under Security → WAF → Custom Rules.
4. If you have Bot Fight Mode enabled, consider creating an exception for webhook traffic — Bot Fight Mode can block automated requests from SureCart’s servers.

If you’re using Wordfence:

1. Go to Wordfence → Firewall → All Firewall Options.
2. Check the setting “Prevent discovery of usernames through the WordPress REST API” — if enabled, this can restrict the REST API access that SureCart needs.
3. Go to Wordfence → Tools → Live Traffic and look for blocked requests containing /wp-json/surecart/.
4. If you find blocked requests, use the “ADD PARAM TO FIREWALL ALLOWLIST” option, or add the webhook URL to the allowlisted URLs.

For other security plugins or server firewalls: Check your firewall or security logs for any blocked requests around the time webhooks stopped working. Allowlist the /wp-json/ path or your full webhook URL.

3. Your Hosting Provider Is Blocking Outbound or Inbound Connections

Some hosting environments restrict communication between your site and external services. This can prevent SureCart’s cloud from reaching your WordPress REST API.

Signs this might be the issue:

• Site Health shows “SureCart API is not reachable.”
• Your site is on shared hosting with restrictive firewall rules.
• You recently migrated to a new host.

How to fix it:

• Contact your hosting provider and ask them to ensure that incoming POST requests to /wp-json/ are not blocked.
• Ask them to verify that your server allows outbound connections to api.surecart.com and app.surecart.com.
• If your host uses a server-level firewall (such as ModSecurity), ask them to allowlist the REST API path.

4. A Plugin Conflict Is Breaking the REST API

Sometimes another plugin can interfere with the WordPress REST API, which breaks SureCart’s webhook processing.

How to check:

1. Go to WordPress Dashboard → Plugins.
2. Temporarily deactivate all plugins except SureCart.
3. Check if webhooks start working (use Site Health to verify).
4. If they do, reactivate your plugins one by one to identify which one is causing the conflict.

Note: You don’t need to delete any plugins — simply deactivating them is enough for testing. Once you identify the conflicting plugin, you can look for an alternative or adjust its settings to work alongside SureCart.

Understanding the Webhook Error Email

SureCart monitors your webhook endpoint automatically. If your endpoint returns errors (non-successful responses) for 40% or more of requests over a 3-day period, SureCart will disable it and send you an email notification.

When you receive this email:

1. Don’t worry — your data is safe in the SureCart cloud.
2. Follow the troubleshooting steps in this guide to identify and fix the root cause.
3. Once fixed, resync your webhooks (SureCart → Settings → Connection → Advanced Options → Resync Webhooks).

Note: Simply resyncing without fixing the underlying issue may cause the endpoint to be disabled again. Make sure the root cause is resolved first.

Helpful Tips

• After changing domains or migrating your site, always resync your webhooks and clear the SureCart account cache. This ensures the new domain is properly connected.
• Keep WP_DEBUG set to false on your live site. When debug mode is on, PHP warnings or notices can get injected into REST API responses, breaking the JSON format that SureCart expects.
• If you use an external SMTP plugin (like WP Mail SMTP or SureMail), keep in mind that SureCart sends transactional emails from its own cloud — not through your WordPress SMTP setup. If customers aren’t receiving order emails, it’s a separate issue from webhook problems.

Still Need Help?

If you’ve tried the steps above and webhooks are still not working, we’re here to help!

Open a support ticket at surecart.com/contact-us and include the following so we can help you faster:

• A screenshot of your Tools → Site Health page.
• Your SureCart plugin version (found in WordPress → Plugins).
• Your hosting provider name and whether you use Cloudflare or any WAF/security service.
• A description of when the issue started (after an update? a migration? a new plugin?).