WebhookGuard — Retry, Log & Replay Native WooCommerce Webhooks

Description

WooCommerce fires each native webhook once. If your ERP, 3PL, accounting tool or automation platform answers with anything other than a success, core records the failure, counts it against the webhook and after a handful of consecutive failures quietly disables it. There is no backoff, no scheduled retry and no bulk replay. Worse, the delivery log you would use to diagnose it replaces both the request and the response body with a placeholder unless WP_DEBUG is on. You usually find out days later, when a customer or the bookkeeper asks why an order never arrived.

WebhookGuard sits beside the webhooks you already run. It does not replace them, does not ask you to move your endpoints and does not change the payload. It listens to WooCommerce’s own post-delivery action, which fires after every attempt, and stores what core refuses to: the webhook, topic, resource and event, the HTTP status, the round-trip duration, the response body, and the exact request body that was sent. Successes and failures are both recorded, so the log is a complete delivery history rather than a list of problems.

Every delivery, with the payload core throws away

Successful and failed attempts are stored side by side with the status code, the attempt number and the duration. Filter by webhook, outcome and date, and open any row to read the full request and response payload in a plain text panel. Nothing is parsed, executed or rendered as HTML.

Retries that survive the outage

When an attempt fails, WebhookGuard schedules a retry with exponential backoff and jitter. Because the retry re-sends the bytes captured at the time, it still works after the source order, product or customer has been edited or deleted, and it produces the same signed payload every time. The delay doubles from your first-retry setting up to a maximum, so a brief outage is retried quickly and a long one does not hammer a dead endpoint. You set the attempt ceiling; the default is five attempts including the first.

While retries are owed for a webhook, the plugin raises the failure ceiling WooCommerce uses for automatic disabling. An endpoint that is down for an hour no longer costs you the webhook: it stays active, keeps retrying and resumes normal delivery the moment the endpoint recovers. Turn that behaviour off and WooCommerce disables the webhook again.

Replay any stored delivery

Any row in the log can be replayed by an administrator in one click, and every failed delivery for a webhook can be replayed in a bounded batch of up to 50 per request after an outage. Rows that already have a successful re-send are skipped, the original delivery ID is reused so an idempotent endpoint can discard a duplicate, and the signature is recomputed from the webhook’s current secret so the replayed payload is accepted.

Know before your customer does

WebhookGuard can email the address you choose when a webhook starts failing and if one is ever disabled. Alerts are throttled per webhook with a cooldown, so one bad night does not become an inbox outage. The per-webhook summary at the top of the log shows successes, failures, the consecutive-failure streak, the last failure and whether a retry is pending.

What you get — every feature is free

WebhookGuard is a single free product. There is no Pro edition, no Agency tier, no licence key and no feature that switches off:

• The delivery log: every native webhook attempt with HTTP status, duration, response body and the full request payload that core redacts unless WP_DEBUG is on.
• Automatic retry with exponential backoff and jitter, re-sending the captured bytes up to a configurable attempt ceiling.
• Keep-webhook-active protection: the webhook stays enabled while retries are owed instead of being silently disabled.
• One-click replay of any stored delivery and a bounded bulk replay of every failed delivery for a webhook.
• Failure and disabled-webhook email alerts with a per-webhook cooldown.
• A filterable log with per-webhook failure history and a configurable retention window, defaulting to 30 days.
• No external service and no telemetry. The plugin only ever queries its own table.

How it works

1. It listens. WebhookGuard hooks WooCommerce’s own post-delivery action, so it sees every attempt your existing webhooks make without changing them.

2. It records. The attempt is written to the plugin’s own database table with the status, timing and full payload.

3. It retries. A failed attempt is rescheduled through WooCommerce’s Action Scheduler at the next backoff interval, re-sending the captured body.

4. It protects. While a retry is pending, the webhook is kept active rather than disabled.

5. You replay. If an outage is over, replay a single delivery or all failed deliveries for a webhook from the log, behind a capability check and a nonce.

Requirements

• WordPress 6.0 or higher.
• PHP 7.4 or higher.
• WooCommerce, because there are no native webhooks without it. The plugin activates safely without WooCommerce, registers no WooCommerce hooks and shows one dismissible notice on its own screen instead of failing.
• HPOS (High-Performance Order Storage): compatible. The plugin declares compatibility and never reads or writes orders, order items or order meta; it stores only the JSON payload WooCommerce hands it.
• Action Scheduler, which ships with WooCommerce, for scheduled retries. If it is unavailable the retry falls back to a single WP-Cron event rather than being dropped.

Does it work with HPOS?

Yes. WebhookGuard declares compatibility with WooCommerce’s custom order tables and never touches the orders, order items, refunds or order meta tables directly. It observes the payload WooCommerce already produced, so order storage behaves identically with HPOS on or off.

What happens when my licence expires?

There is no licence, so nothing expires. WebhookGuard is free and GPL-licensed, with no key to enter and no activation limit.

Does the free version stop working?

No. The free download is the whole product. Every feature — log, retry, replay, alerts and retention — is included, and none of it is time-limited or switched off.

Can I use it on client sites?

Yes. It is GPL-licensed and there is no per-site licence or activation count, so you can install it on as many sites as you manage. There is no white-label or client-handover workflow; it is a normal WordPress plugin.

Do you offer refunds?

There is nothing to buy, so there is no purchase to refund. If something is not working, contact us at [email protected] and we will help.

Where is my data stored?

On your own server. Deliveries are stored in a single table in your WordPress database, and old rows are pruned automatically after the retention window you set (30 days by default). Nothing is sent to us. The only outbound traffic is the webhook retries and replays the plugin sends to the endpoint you already configured, plus the alert email it sends with WordPress’s mail function to the address you choose.

Does a replay create duplicate records?

It can, which is why replay is always an explicit administrator action. The original delivery ID is reused on every retry and replay, so an endpoint that de-duplicates on that header will discard the duplicate. The payload is re-sent exactly as it was captured.

About the licence

WebhookGuard is free software released under the GPL, version 2 or later. There is no annual fee, no licence key, no activation limit and no paid tier. Updates are delivered through the WordPress.org plugin directory, so you get new versions from your WordPress dashboard like any other free plugin. Because there is no licence client, the plugin does not contact an activation server and reports nothing about your site to us.

If you run a store that depends on order data reaching another system, the rest of the TillFoundry range covers the other jobs around it — background-job monitoring and store operations tooling — built to the same standard and listed in our shop.