When a customer pays for an item using an external checkout process (like PayPal Standard or an external credit card modal), they complete the payment on the external provider's platform and are then redirected back to your shop. However, an infrastructure bug occasionally causes these orders to stay stuck as "Pending Payment" in your store, even though the money was successfully deducted from the customer's bank account. This results in "orphaned orders" that are never processed.

This breakdown is caused by a communication failure between the payment gateway's Instant Payment Notification (IPN) system and your server's REST API endpoint. After a transaction completes, the payment processor sends a secure server-to-server webhook request to your site to confirm the payment. If your web host utilizes an aggressive firewall, blocks inbound IP addresses from companies like PayPal, or forces a global trailing slash redirection rule, the payment gateway's notification is blocked or dropped entirely. WooCommerce never receives the payment confirmation, leaving the order in limbo.

The Solution

Resolving orphaned payment loops requires fixing inbound webhost routing and whitelisting your payment processor's notification endpoints.

  1. Check the Webhook Logs: Go to WooCommerce > Status > Logs. Look through the logs dropdown for your payment gateway (e.g., paypal or stripe). Check for connection timeouts or 403 Forbidden messages.

  2. Disable Firewall IP Restrictions: If you use security layers like Cloudflare, Wordfence, or server-level rules, ensure that you explicitly whitelist the official IP address blocks used by PayPal, Stripe, or your specific banking merchant gateway.

  3. Deactivate Trailing Slash Redirect Loops: Ensure your .htaccess routing rules do not modify API URLs. WooCommerce webhooks expect exact endpoints. For example, if a payment gateway sends a notice to /wc-api/callback, a server rule that automatically redirects that path to /wc-api/callback/ will strip out the secure payload data, causing the authentication to fail.

  4. Test with the Gateway Simulator: Use the built-in developer sandbox testing environments provided by your merchant account to track incoming network events and confirm they show a 200 OK success status.