Guides · Free check · $9 fix pack

Paddle webhooks failing?
Check your endpoint in 10 seconds.

Paste the webhook URL you saved in Paddle. We test whether Paddle can actually reach it, and whether a stranger could fake an order. Built for apps made with Lovable, Bolt, Cursor, Replit and Claude Code.

Can Paddle reach it?

Redirects, 404s, login walls (Vercel protection, Supabase JWT, auth middleware) and Cloudflare bot blocks drop every real event. Paddle needs an HTTP 200 within five seconds, or it retries and eventually marks the notification failed.

Can someone fake an order?

We send one unsigned request and one with a forged signature. The check checks Paddle-Signature: ts=…;h1=…. If either gets a 2xx, anyone with the URL may be able to unlock your product.

Fix it with one prompt

Each issue comes with a copy-paste Paddle prompt for your stack. Re-check in one click.

Paddle webhook guides

Paddle webhook signature verification failed? Check these 6 things

Where to find your webhook URL

Paddle > Events > Notifications → your notification destination → copy the URL. Sandbox and live are separate accounts with separate destinations.

What's free vs. $9

Free: score, every issue we find, and why it matters.
$9 one time, refundable for 14 days: the exact Paddle fix prompt for each issue for your stack, the 5-point Paddle hardening pack (the five-second rule, out-of-order events, per-destination secrets, firewall rules, failed-notification replays), and 30 days of re-checks.

Is this safe to run?

We send at most 3 requests: two POSTs with a made-up event name (webhookproof_probe / webhookproof.probe), one without a signature and one with an all-zero signature, plus one GET. A correctly built endpoint rejects both POSTs. Nothing we send can create an order, a charge or a customer in Paddle.

Also checks Stripe · Lemon Squeezy · Polar. WebhookProof is not affiliated with Paddle.