PayPal confirms a payment by calling back to your site after the fact, verified through a server-to-server check against PayPal's own API. That callback is bridged, never served from the static cache, so a payment, dispute, or refund can't go unnoticed.
Hybrid
Nothing about PayPal Payments itself is served static — checkout and order pages are WooCommerce's own dynamic footprint.
The payment webhook needs to reach WordPress live every time, verified against PayPal's own verify-webhook-signature API.
The webhook route (/wp-json/paypal/v1/incoming) already reaches WordPress rather than a cached page, since it sits under /wp-json/ — a path already excluded from static serving. Additional protections like rate limiting on this specific route are recommended by its compatibility profile but, like most third-party bridge routes, aren't yet wired into an active dispatcher the way our own first-party form bridges are.
No special setup for Hybrid or Static + Bridges mode. If you use Zero-WordPress Mode or Vault Mode, explicitly bridge the PayPal webhook route first.
Zero-WordPress Mode and Vault Mode only exempt static files, this plugin's own admin API, and your allowlisted admin IP — not /wp-json/ generally — so PayPal's webhook needs to be explicitly bridged before turning on either of those stricter modes, or payment confirmations will be blocked outright.
Static Shield Lite is free to install and inspects your actual plugins, not just what's publicly visible.
Get Static Shield
Tulapp