WooPayments works a little differently from a typical gateway: Stripe never calls your site directly — Automattic's WooPayments server receives events centrally and relays the relevant ones to your site over your Jetpack connection, authenticated as a real logged-in WooCommerce manager rather than a plain public webhook.
Hybrid
Nothing about WooPayments itself is served static — checkout and order pages are WooCommerce's own dynamic footprint.
The webhook relay needs to reach WordPress live every time, authenticated through your site's Jetpack connection.
The webhook relay route (/wp-json/wc/v3/payments/webhook) already reaches WordPress rather than a cached page, since it sits under /wp-json/ — a path already excluded from static serving, and it's also gated by WordPress's own manage_woocommerce capability check, a real layer of protection independent of anything Static Shield adds.
No special setup for Hybrid or Static + Bridges mode. If you use Zero-WordPress Mode or Vault Mode, explicitly bridge the WooPayments webhook route first.
Zero-WordPress Mode and Vault Mode only exempt static files, this plugin's own admin API, and your allowlisted admin IP — not /wp-json/ generally — and the relay's source is neither, so it needs to be explicitly bridged before turning on either of those stricter modes.
Static Shield Lite is free to install and inspects your actual plugins, not just what's publicly visible.
Get Static Shield
Tulapp