Payment help

Allow Stripe webhooks through Cloudflare

Stripe can accept a payment while PaySlate still shows the invoice as unpaid if Cloudflare blocks Stripe's webhook request. The fix is to allow one exact PaySlate URL, only for POST requests.

How to recognize the problem

• The customer sees a successful Stripe payment.
• The invoice does not change to Paid.
• Stripe Workbench shows a failed webhook delivery with HTTP 403.
• The response mentions Cloudflare or says the request was blocked.

Use the webhook URL shown by PaySlate

Open PaySlate → Settings → Payments and copy the Webhook URL displayed under your Stripe settings. Do not guess the URL because it depends on the payment engine in use.

Update your Cloudflare rule

1. Open Cloudflare and select the domain that runs PaySlate.
2. Open Security → WAF → Custom rules.
3. Find the rule that blocks WordPress REST API requests or paths containing /wp-json/.
4. Add a narrow exception for the exact PaySlate webhook path and the POST method.

For the legacy PaySlate payment engine, the exception is:

not (
  http.host eq "your-domain.example"
  and http.request.method eq "POST"
  and lower(http.request.uri.path) eq "/wp-json/payslate/v1/webhook"
)

Append that exception to your existing block expression with and. If PaySlate shows a different webhook path, use the path displayed in PaySlate Settings instead.

Resend the failed Stripe event

1. Open Stripe in sandbox or live mode as appropriate.
2. Open Workbench → Webhooks and select the PaySlate destination.
3. Open the failed payment_intent.succeeded delivery.
4. Select Resend.
5. Confirm that Stripe receives HTTP 200 and that the invoice changes to Paid.

If you still receive HTTP 403

Check Cloudflare Security Events for the webhook request. Another custom rule, managed rule, bot rule, or rate limit may be blocking it. Apply the same exact host, path, and method exception to the rule that generated the block.