If you see a notice in your Charitable Lite dashboard that reads “X webhook events failed signature verification in the last 24 hours”, this article explains what it means, what causes it, and how to fix it.
What is this notice?
When Stripe sends payment events to your site – like confirming a donation was paid – Charitable checks that the event genuinely came from Stripe using a webhook signing secret. This is a private key shared between your site and Stripe that acts as a handshake to confirm the event is legitimate.
If that verification check fails, Charitable logs it. When 5 or more failures occur within 24 hours, the notice appears in your admin.
This does not mean your site was attacked or compromised. The most common cause is a configuration change – such as reconnecting Stripe or upgrading Charitable – that might have left the signing secret out of sync.
What gets updated automatically
| Situation | What Charitable does |
|---|---|
| First-time Stripe connection | Creates a webhook endpoint and saves the signing secret automatically |
| Disconnect and reconnect Stripe | Deletes the old webhook, creates a new one, and saves a fresh signing secret |
| Upgrading to Charitable 1.8.9.9 or later | Runs a one-time migration to generate signing secrets for existing connections |
| Upgrading to Charitable 1.8.10.3 or later | Fixes a bug where reconnecting could overwrite the signing secret with an empty value |
What does NOT update automatically
| Situation | What you need to do |
|---|---|
| You manually deleted a webhook in your Stripe dashboard | Disconnect and reconnect Stripe in Charitable settings |
| You manually created or edited a webhook in your Stripe dashboard | Disconnect and reconnect so Charitable fully controls the webhook |
| The upgrade migration failed (signing secret was never saved) | Disconnect and reconnect Stripe |
How to fix it: disconnect and reconnect Stripe
- Go to Charitable → Settings → Payment Gateways → Stripe
- Click Disconnect from Stripe
- Click Connect with Stripe and complete the authorization flow
- Charitable will automatically create a fresh webhook endpoint with a new signing secret
The notice will disappear once no new failures are recorded for 24 hours.
What about donations that are stuck as Pending?
If the webhook notice was present for some time before you noticed it, some donations may have stayed in Pending status because Charitable couldn’t verify the payment confirmation events from Stripe.
Charitable includes a built-in tool to recover these:
- Go to Charitable → Settings → Payment Gateways → Stripe
- Scroll down to the Sync Pending Donations section
- Click Sync Pending Donations
This tool checks your pending Stripe donations from the last 30 days against the Stripe API directly and updates any that were successfully paid. You do not need to ask donors to re-submit – this runs silently in the background.
Note: Run this tool after completing the disconnect/reconnect step above, so that future webhooks will also be verified correctly.
Frequently Asked Questions
Does this affect donations that already completed successfully? No. Donations that were already marked Paid are not affected. This notice only relates to incoming webhook events – the signals Stripe sends to your site after a payment. Past completed donations are safe.
Why did this start appearing after I upgraded Charitable Lite? Lite version 1.8.9.9 introduced webhook signature verification as a security improvement. If your site had an existing Stripe connection before that version, the signing secret may not have been saved during the upgrade migration. A disconnect/reconnect resolves this. If you are on 1.8.10.2 or earlier, upgrade to 1.8.10.3 first – it fixes a bug where reconnecting could overwrite the signing secret.
Can I just ignore the notice? We don’t recommend it. While past donations are unaffected, new donations made while webhook verification is failing may stay stuck in Pending status and never automatically move to Paid. Use the Sync Pending Donations tool to recover any affected donations, then reconnect Stripe to prevent new ones.
I reconnected Stripe but the notice is still showing. The notice clears after 24 hours with no new failures – it does not disappear immediately. If it reappears after 24 hours, check that you are running Charitable 1.8.10.3 or later, then disconnect and reconnect once more. Also confirm you are not using a manually created or edited webhook in your Stripe dashboard, as this can conflict with Charitable’s automatically managed endpoint.
