Search intent: informational/procedural — WooCommerce developers integrating the store with external systems. We cover what events fire, payloads and topics, signature verification, reliability rules, webhooks versus polling, and common consumers. It connects to our Store API and ERP integration coverage.

WooCommerce webhooks — store events, signed payloads, retry delivery and downstream consumers like ERP, CRM and Slack by CodeAtoZ

WooCommerce webhooks are configured under WooCommerce → Settings → Advanced → Webhooks (or via the REST API). Each webhook has a topic — the event it listens for: order created, updated, deleted or refunded; product created, updated or deleted; customer created or updated; coupon events. When the event fires, WooCommerce sends a POST request to your delivery URL with a JSON payload describing the changed resource. The set of topics covers the commercial lifecycle, so most integrations find the trigger they need in core WooCommerce webhooks without custom code. Each delivery carries a signature header for verification.

Doing WooCommerce webhooks right is mostly about reliability. First, security: each delivery includes an HMAC-SHA256 signature in the X-WC-Webhook-Signature header, computed with the webhook’s secret — always verify it before trusting a payload, or anyone who learns your URL can forge events. Second, speed: your endpoint must return a 2xx response quickly, so do not process heavy work inline — acknowledge fast and push the job to a queue. Third, idempotency: WooCommerce webhooks can deliver the same event more than once (retries on failure), so your handler must be safe to run twice on the same event without double-processing. WooCommerce retries failed deliveries and records every attempt in the delivery log. The WooCommerce webhooks documentation and REST API developer docs detail topics and signatures.

import crypto from 'crypto';
import express from 'express';
const app = express();

app.post('/wc-webhook', express.raw({ type: '*/*' }), (req, res) => {
  const sig = req.get('X-WC-Webhook-Signature');
  const expected = crypto
    .createHmac('sha256', process.env.WC_WEBHOOK_SECRET)
    .update(req.body) // raw body, not parsed
    .digest('base64');
  if (sig !== expected) return res.sendStatus(401); // reject forged

  res.sendStatus(200);            // ack FAST (2xx)
  queue.add('process-wc-event', JSON.parse(req.body)); // async work
});

The case for WooCommerce webhooks over polling the REST API is real-time delivery without wasted requests — polling either lags (infrequent) or hammers the API (frequent), while webhooks fire exactly when something changes. Typical consumers of WooCommerce webhooks: an ERP that needs new orders immediately (see our ERPNext sync), a CRM updating on customer changes, Slack alerts on high-value orders, and Zapier or Make scenarios for no-code automation. One event can fan out to many systems. The one caveat: because WooCommerce webhooks depend on your endpoint being reachable and fast, mission-critical syncs should pair them with a periodic reconciliation job to catch any missed deliveries. Our WooCommerce team builds robust webhook integrations.