Fixing Yoco WooCommerce Checkout Errors & Webhook Drops in SA

There is no worse feeling in South African ecommerce than checking your Yoco dashboard, seeing three customer payments for R2,400 each, and then opening WooCommerce only to find those exact orders marked as "Failed" or stuck on "Pending Payment".

The customer thinks their order went through because their bank sent an SMS notification. You think they abandoned checkout because WooCommerce never updated. By the time you reconcile the transaction manually three days later, the customer is furious and asking for a refund.

This is a classic tech plumbing breakdown. When you understand how Yoco's API communicates with WordPress, you can diagnose and fix the root cause in under 30 minutes.

Why Do Yoco Payments Fail to Update WooCommerce?

When a customer pays via Yoco on your store, two distinct communication channels must succeed:

1. The Browser Redirect (Client-Side): The customer's mobile browser is redirected back from the Yoco payment portal to your store's

   order-received

   endpoint.
2. The Server-to-Server Webhook (Asynchronous Callback): Yoco's backend server sends a secure HTTP POST request directly to your WooCommerce REST API endpoint (

   /?wc-api=WC_Gateway_Yoco

   or custom webhook) confirming that funds cleared.

If either of these fail, your order tracking breaks down completely.

The 3 Most Common Culprits in South Africa:

• Cloudflare / Security Plugin Blocks: Security plugins (Wordfence, iThemes) or Cloudflare WAF challenge rules blocking incoming IP addresses from Yoco's webhook servers with a 403 Forbidden.
• Aggressive Server Caching: Nginx or LiteSpeed caching caching the checkout endpoint response, causing nonce mismatches.
• REST API Authorization Headers Stripped: South African shared hosts (Afrihost, Domains.co.za, xneelo) stripping

  Authorization: Bearer

  headers in default

  .htaccess

  configurations.

How to Fix Yoco WooCommerce Webhook Drops

Follow this step-by-step diagnostic workflow to restore 100% order confirmation reliability.

Step 1: Whitelist Yoco's Webhook Endpoints in Wordfence and Cloudflare

If you are running Wordfence or Cloudflare, check your Live Traffic logs immediately after a test checkout. If you see blocked requests to

/?wc-api=yoco

/wp-json/yoco/v1/webhook

wc-api

wc-ajax

Step 2: Pass Authorization Headers in

.htaccess

On Apache/LiteSpeed hosting environments common in SA, FastCGI often drops the authorization headers that Yoco uses to sign webhook payloads. Add this snippet to the top of your

.wordpress/.htaccess

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
</IfModule>

Step 3: Verify Your Yoco Webhook URL & Secret Key

Log into your Yoco Business Portal -> Integrations -> WooCommerce. Confirm that your live Secret Key matches the plugin settings in WooCommerce -> Settings -> Payments -> Yoco. Ensure your webhook URL uses

https://

Step 4: Test with Real Small Transactions (R2.00 Test Item)

Never rely on sandbox mode alone. Create a hidden test product for R2.00, place an order using a real card on a mobile device, and monitor

wp-content/debug.log

yoco-payments.log

What Is the Cost of an Unfixed Payment Gateway?

A broken checkout isn't just an inconvenience — it directly burns your ad spend. If you are spending R200/day on Meta or Google Ads, every payment glitch cuts your effective ROAS in half.

If your payment gateway issues go beyond webhook misconfigurations, or if you are seeing signature mismatches across PayFast or Ozow, you need an emergency fix before running your next marketing campaign.