Documentation · WooCommerce
StealthPaid for WooCommerce
Accept card, bank transfer and local method payments on your WooCommerce store, settled by StealthPaid, with the order status driven by a signed webhook rather than the customer's browser.
Download the pluginX-Delivery-Id header of the webhook, visible in WooCommerce, Status, Logs, source stealthpaid, with Debug logging on.Install
- Download the plugin zip:
/downloads/stealthpaid-for-woocommerce.zipon your StealthPaid domain. - In WordPress, go to Plugins, Add New, Upload Plugin, and upload the zip. Or extract it into
wp-content/plugins/so the top-level folder isstealthpaid-for-woocommerce. - Activate StealthPaid for WooCommerce. WooCommerce must already be installed and active.
Configure
Go to WooCommerce, Settings, Payments, and open StealthPaid. You need two things from your StealthPaid dashboard and one from the plugin's own settings page, in this order:
- API key. In your StealthPaid dashboard, go to Settings, API keys, and create a new key. Paste it into the plugin's API key field.
- Webhook URL, one direction. The plugin's settings page shows a read-only Webhook URL field. Copy it exactly, then in your StealthPaid dashboard go to Settings, Webhooks, and register a new endpoint with that URL.
- Webhook secret, the other direction. Registering the endpoint gives you back a secret. Copy it into the plugin's Webhook secret field.
- API base URL. Leave the default unless you run a self-hosted whitelabel deployment on a different domain, in which case set it to that domain.
- Choose the order status to apply once a payment is confirmed paid (default: Processing).
- Save, then enable the gateway.
Both directions matter: the webhook URL tells StealthPaid where to send delivery attempts, and the shared secret is what lets the plugin trust that a request claiming to be that delivery actually is. A URL registered without the matching secret, or a secret that does not match the endpoint that owns that URL, both fail closed.
Test with a small order
Place a real order for a small amount before relying on the gateway for live traffic.
- Add a low-priced product to the cart and check out using StealthPaid.
- Complete the payment on the StealthPaid hosted checkout.
- You should land back on the order-received page, and the order should move to your configured paid status within moments. If it does not move immediately, wait: the page performs one reconciliation check itself, and the webhook can arrive slightly after the redirect.
- Turn on Debug logging in the plugin settings first if you want to see the webhook arrive in WooCommerce, Status, Logs, source
stealthpaid.
What each order status means
| Order status | What happened |
|---|---|
| Pending payment | The order was created but StealthPaid has not yet confirmed payment. Normal for the first few seconds after checkout. |
| Your configured paid status (default Processing) | StealthPaid's webhook confirmed the payment in full, or the order-received page's reconciliation check did. |
| On hold | The customer paid less than the order total. StealthPaid still settles the funds it received; review the order note for the amount received versus expected before deciding whether to ship. |
| Anything else | Not touched by StealthPaid. The plugin only ever moves an order between pending, your configured paid status, and on hold; every other transition is yours or another plugin's. |
The webhook is the source of truth. The reconciliation check on the order-received page exists only to cover the gap before the webhook arrives, in case a customer returns to the store instantly, not as a replacement for it: an order that never receives a webhook and whose customer never revisits the order-received page stays pending until you check it manually.
Troubleshooting
"Signature mismatch" in the logs
The webhook secret in the plugin settings does not match the secret StealthPaid issued for that endpoint. Re-copy the secret from your StealthPaid dashboard, Settings, Webhooks, into the plugin's Webhook secret field, and save. A secret copied from a different endpoint, or with leading or trailing whitespace, will not verify.
The webhook never arrived
Confirm the URL registered in your StealthPaid dashboard matches the plugin's Webhook URL field exactly, including scheme and trailing slash. Confirm your site is reachable from the public internet on that URL: a staging site behind HTTP basic auth or a firewall will silently swallow delivery attempts. StealthPaid retries a failed delivery on a backoff schedule for about 39 hours across six attempts before giving up, so a temporary outage on your side usually still resolves itself.
An order is stuck on pending payment
Check WooCommerce, Status, Logs, source stealthpaid, with Debug logging turned on, for a rejected or missing delivery. If the log shows nothing at all, the webhook has not reached your site yet; if it shows a rejection, the reason is in the log line. As a last resort, check the payment's status directly in your StealthPaid dashboard and, if it shows paid, update the order by hand.
An order shows underpaid or on hold
The customer sent less than the order total. This can happen with certain local payment methods that deduct a processing fee before forwarding funds. Review the order note StealthPaid adds, which states the amount received against the amount expected, before deciding whether to ship, request the difference, or refund.