WooCommerce Order Stuck Pending Payment After Successful Customer Payment: How to Fix It

Quick Answer: Fix WooCommerce Orders Stuck in Pending Payment

When a customer successfully completes checkout and payment is captured by your payment processor, but the WooCommerce order remains stuck in Pending Payment, the issue is almost always a failure in the asynchronous payment callback (such as a Webhook or Instant Payment Notification/IPN).

To fix this problem immediately:

1. Check Gateway Logs: Go to WooCommerce > Status > Logs and select your payment gateway log (e.g., Stripe or PayPal) to check for missing callbacks or signature verification errors.
2. Inspect Merchant Dashboard: Log into Stripe, PayPal, or your payment provider dashboard and check the Webhook or IPN event log. Look for non-200 HTTP response codes (such as 403 Forbidden, 401 Unauthorized, or 500 Internal Server Error) when sending signals to your domain.
3. Bypass Security Blocks: Ensure Cloudflare, security plugins (like Wordfence or iThemes Security), or server-level HTTP basic authentication are not blocking incoming POST requests to your site's payment REST API endpoints.
4. Verify Webhook Secrets and API Keys: Confirm that the API keys and Webhook signing secrets matched in WooCommerce match those listed in your payment processor dashboard.

Understanding Order Status Transitions in WooCommerce

When a customer initiates checkout in WooCommerce, an order record is created with the status Pending Payment. This indicates that the order has been created in the database, but payment confirmation has not yet been received.

Because credit card processors, digital wallets, and bank transfers operate asynchronously, WooCommerce relies on webhooks or IPN callbacks from payment processors like Stripe, PayPal, or Square. Once the processor successfully charges the customer, it sends an incoming HTTP POST request to a unique endpoint on your WordPress site. Upon receiving this signed notification, WooCommerce updates the order status to Processing (for physical goods) or Completed (for downloadable digital items).

If this incoming payment signal is blocked, dropped, or fails authentication, your payment processor retains the funds, but WooCommerce never receives the instruction to update the order. If you are experiencing related callback issues where webhooks stop functioning entirely, check our detailed guide on WooCommerce Webhooks Automatically Disabled After Delivery Failures.

Common Causes of Orders Stuck in Pending Payment

• Firewall or WAF Blocks: Cloudflare or WordPress security plugins mistake incoming webhook POST requests from Stripe or PayPal servers as automated bot attacks or brute-force requests, returning a 403 Forbidden response.
• Incorrect API Keys or Webhook Secrets: Outdated or improperly copied webhook signing secrets cause signature verification checks in WooCommerce to fail, silently discarding valid payment confirmations.
• Disabled or Misconfigured IPN Settings: For legacy PayPal integrations, if Instant Payment Notification (IPN) is disabled or pointing to an invalid URL within PayPal account settings, notifications are never transmitted.
• Server-Level Access Restrictions: Password protection, HTTP Basic Authentication on staging sites, or aggressive server caching blocking /wp-json/ REST API routes prevent processors from delivering HTTP POST payloads.
• Cron or REST API Failures: If your WordPress REST API is unreachable due to permission misconfigurations, payment updates cannot be processed. If you encounter REST authorization issues, see how to fix WooCommerce REST API 401 Unauthorized Error.

Step-by-Step Diagnostic & Troubleshooting Procedure

Step 1: Check Payment Gateway Logs in WooCommerce

Your first step is to inspect internal gateway logs generated by WooCommerce to see if incoming notifications are reaching your server.

1. Log in to your WordPress admin panel.
2. Navigate to WooCommerce > Status > Logs.
3. In the drop-down menu on the top right, look for log files related to your active payment processor (e.g., stripe-... or paypal-...) and click View.
4. Scroll down to inspect recent entries timestamped at the time of the stuck order. Look for errors such as Signature verification failed, 403 Forbidden, or missing webhook entries entirely.

Step 2: Inspect Webhook Deliveries in Payment Processor Dashboard

If no logs appear in WooCommerce, check whether the payment processor attempted to send the notification.

1. Log in to your payment gateway account (e.g., Stripe Dashboard or PayPal Developer Console).
2. Navigate to the Webhooks or IPN History section.
3. Review recent delivery attempts sent to your domain's webhook URL (typically formatted like https://yourdomain.com/wp-json/wc/v3/connect/stripe/webhook or https://yourdomain.com/?wc-api=WC_Gateway_Paypal).
4. Check the HTTP response status code for failed attempts:
   • HTTP 200 OK: The payment processor successfully delivered the payload. If the order remains pending, check for database conflicts or theme plugin hook overrides.
   • HTTP 403 Forbidden: Firewalls, WAFs, or security plugins are blocking the request.
   • HTTP 401 / 500: Authentication secrets are incorrect, or a server PHP error occurred during payload parsing.

Step 3: Resolve Webhook Secret and API Key Mismatches

If your gateway logs report signature mismatches or validation errors, resynchronize your webhook secrets.

1. In your payment gateway dashboard, open your webhook endpoint settings and copy the Signing Secret (e.g., starting with whsec_ for Stripe).
2. Go to WooCommerce > Settings > Payments and select your active payment gateway.
3. Paste the correct signing secret into the appropriate configuration field and save your changes.

Caution: Regenerating API keys or webhook secrets breaks active live checkouts until updated in both WooCommerce and the payment processor dashboard. Ensure you perform key rotations during low-traffic hours.

Step 4: Configure Firewall and WAF Rules

If your payment processor log reports HTTP 403 Forbidden errors, adjust your firewall configuration to allow callback traffic.

1. If using Cloudflare, go to Security > WAF > Events and search for blocked requests targeting /wp-json/ or ?wc-api=.
2. Create a WAF bypass rule allowing traffic targeting payment webhook endpoints, or explicitly allow payment processor IP ranges supplied in official gateway documentation.
3. If using a WordPress security plugin (such as Wordfence), check the blocked IP log and allow requests hitting the payment gateway callback path.

Caution: Modifying firewall or WAF rules can expose endpoints if IP filtering or signature verification is disabled incorrectly. Never disable signature verification in gateway settings.

Verification and Manual Order Audit

After adjusting firewall rules and verifying API credentials, perform a test transaction or resend a failed event from your payment processor dashboard.

1. In your gateway dashboard (such as Stripe), open the failed webhook event and click Resend Event.
2. Check the HTTP status returned by your site to ensure it now returns a 200 OK response.
3. Refresh the order in WooCommerce > Orders and confirm that status automatically updates from Pending Payment to Processing.

For orders that remained stuck while troubleshooting took place, manually cross-reference the transaction ID in your payment processor dashboard to confirm funds were successfully captured before manually updating the WooCommerce status to Processing.

Caution: Manually changing order status from Pending Payment to Processing without verifying payment capture in the gateway dashboard risks fulfilling unpaid or abandoned orders.

When to Contact Hosting or Payment Gateway Support

If webhooks continue returning 500 internal server errors or timeout responses despite clear firewall permissions, contact your web hosting provider or payment gateway support under the following conditions:

• Your host enforces server-level security or custom NGINX/Apache rewrite rules that block HTTP POST calls to WordPress REST API endpoints.
• Your server experiences timeout errors due to slow database response times when receiving incoming webhooks. For related timeout issues, review Cloudflare Error 524 (A Timeout Occurred): Causes and How to Fix It.
• The payment gateway's IP ranges are being blocked by host-level network firewalls completely outside of your control.

Frequently Asked Questions

Why did the customer get charged if WooCommerce says Pending Payment?

The payment capture happens on the payment processor's servers first. WooCommerce relies on an asynchronous HTTP callback (Webhook or IPN) sent from the processor to confirm the charge. If that notification is blocked or fails to authenticate, money is collected, but WooCommerce never receives the signal to update the order status.

Is it safe to manually change an order status to Processing?

It is only safe after you log into your payment provider's dashboard (Stripe, PayPal, etc.), search for the transaction, and confirm that funds were successfully captured. Never manually mark orders as Processing without verifying payment receipt first.

Will WooCommerce automatically retry pending orders?

WooCommerce itself does not retry payment checks automatically. However, payment processors like Stripe will retry sending failed webhook notifications periodically over several hours or days until a 200 OK response is received.

Sources & References

• Troubleshooting Orders Documentation - WooCommerce
• Webhooks Documentation - WooCommerce
• Payment Pending in WooCommerce: What It Means & What to Check