← Integrations

Static Shield + WooCommerce Stripe Gateway

Unlike the other payment integrations here, Stripe's webhook still uses WooCommerce's classic "?wc-api=wc_stripe" query-string convention rather than a modern REST route — and that query string lands on your site's root URL, the same path your homepage is served from. We're flagging this honestly as a known open risk rather than a solved one: see Limitations below before putting a live Stripe-powered store behind a static release.

Recommended mode

Hybrid

Static behavior

Nothing about Stripe itself is served static — checkout and order pages are WooCommerce's own dynamic footprint.

Dynamic behavior

The payment webhook needs to reach WordPress live every time, verified against your Stripe webhook signing secret.

Bridges & routes

Marked as a route that must stay dynamic, but — unlike the routes covered by our other integrations — this one is not yet backed by an automatic rule that specifically protects against the collision described below. Treat this as something to verify yourself today, not something Static Shield already guarantees for you.

Setup

Verify with a real Stripe test event that the webhook reaches WordPress before relying on this gateway on a live static release — see Limitations above.

Limitations

This is a genuinely confirmed risk, not a theoretical one: a request to "/?wc-api=wc_stripe" has the exact same request path as your homepage ("/"), and web servers match static-file rules on the path only — they never see the query string. If your homepage is cached as a static file, as it normally is, that cached page can be served back to Stripe instead of the request ever reaching PHP, silently swallowing the webhook while Stripe sees a plain 200 response and considers it delivered. Confirm with a real Stripe test event that this actually reaches WordPress on your release before relying on it, and treat this route as needing explicit, verified protection — including under Zero-WordPress Mode and Vault Mode, which have the same gap for an unrelated reason (they only exempt static files, this plugin's own admin API, and your allowlisted admin IP).