Guides · Free check · $9 fix pack

Polar webhooks failing or 403?
Check your endpoint in 10 seconds.

Paste the webhook URL you saved in Polar. We test whether Polar can actually reach it, and whether a stranger could fake an order. Built for apps made with Lovable, Bolt, Cursor, Replit and Claude Code.

Can Polar reach it?

Redirects, 404s, login walls (Vercel protection, Supabase JWT, auth middleware) and Cloudflare bot blocks drop every real event. Polar treats redirects and non-2xx answers as failures, times out after 10 seconds, and disables an endpoint after 10 failures in a row.

Can someone fake an order?

We send one unsigned request and one with a forged signature. The check checks the Standard Webhooks headers webhook-id, webhook-timestamp, webhook-signature. If either gets a 2xx, anyone with the URL may be able to unlock your product.

Fix it with one prompt

Each issue comes with a copy-paste Polar prompt for your stack. Re-check in one click.

Polar webhook guides

Polar webhook signature failing? The 8 Sep 2026 secret rule, and other 403 causes

Where to find your webhook URL

Polar → your organization's webhook settings → copy the endpoint URL.

What's free vs. $9

Free: score, every issue we find, and why it matters.
$9 one time, refundable for 14 days: the exact Polar fix prompt for each issue for your stack, the 5-point Polar hardening pack (the two signing schemes (before/after 8 Sep 2026), webhook-id idempotency, the 2-second target, auto-disabled endpoints, Bot Fight Mode), and 30 days of re-checks.

Is this safe to run?

We send at most 3 requests: two POSTs with a made-up event name (webhookproof_probe / webhookproof.probe), one without a signature and one with an all-zero signature, plus one GET. A correctly built endpoint rejects both POSTs. Nothing we send can create an order, a charge or a customer in Polar.

Also checks Stripe · Lemon Squeezy · Paddle. WebhookProof is not affiliated with Polar.