How to Test WooCommerce Webhooks

WooCommerce Webhook Events

WooCommerce calls its webhook event types "topics". Each topic is a combination of a resource and an action. Here are the most commonly used topics:

Step 1: Generate Requex Endpoint

Open requex.me in your browser. A unique webhook URL is generated immediately with no account required. Copy it — it looks like:

https://requex.me/hook/a1b2c3d4-e5f6-7890-abcd-ef1234567890

Keep this tab open. WooCommerce webhook deliveries will appear in real time.

Step 2: Create a Webhook in WooCommerce

In your WordPress admin panel, navigate to WooCommerce → Settings → Advanced → Webhooks and click Add webhook. Fill in the form:

1. Name: Give it a descriptive name like Test Order Created.
2. Status: Set to Active.
3. Topic: Choose the event you want to test, e.g. Order created.
4. Delivery URL: Paste your Requex URL here.
5. Secret: WooCommerce auto-generates a secret key — copy this value. You will need it to verify the HMAC signature in your real handler.
6. API version: Leave as the latest (WP REST API v3).

Click Save webhook. WooCommerce immediately sends a ping request to verify the URL — you will see it appear in Requex.

Step 3: Trigger a Test Event

There are two ways to trigger a test event:

Option A — Ping button: On the webhook detail page, click Deliver test ping. WooCommerce sends a test payload to your Requex URL immediately. This is the fastest way to confirm the URL is working.

Option B — Place a real test order: Go to your WooCommerce storefront and add an item to cart, fill in test details, and complete checkout. Choose "Cash on delivery" or any payment method that does not require real credentials in the test environment. A full order.created payload will fire within seconds.

Switch to the Requex tab — the new request will appear with the full WooCommerce order object in the body.

Step 4: Inspect the Payload

Click the request in Requex. A typical order.created payload includes the complete WooCommerce order object:

{
  "id": 1234,
  "status": "pending",
  "currency": "USD",
  "total": "49.99",
  "billing": {
    "first_name": "Jane",
    "last_name": "Smith",
    "email": "jane@example.com",
    "address_1": "123 Main St",
    "city": "Austin",
    "state": "TX",
    "postcode": "78701",
    "country": "US"
  },
  "shipping": { ... },
  "line_items": [
    {
      "id": 1,
      "name": "Test Product",
      "quantity": 2,
      "total": "49.99",
      "sku": "PROD-001"
    }
  ],
  "date_created": "2026-04-05T10:00:00",
  "customer_id": 5
}

The full payload includes billing, shipping, line items, coupon data, shipping methods, and meta data. Use Requex to see the exact fields your handler will receive — the WooCommerce REST API docs describe the schema but real payloads sometimes include additional fields from installed plugins.

WooCommerce HMAC Signature

WooCommerce signs every webhook delivery using HMAC-SHA256 of the raw request body, keyed with the webhook secret you copied during setup. The signature is sent in the X-WC-Webhook-Signature header as a Base64-encoded string.

In Requex, check the Headers tab of the incoming request and confirm you can see the X-WC-Webhook-Signature header. Here is how to verify it in your production handler:

// Node.js / Express — WooCommerce HMAC verification
const crypto = require('crypto');

app.post('/api/webhooks/woocommerce',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-wc-webhook-signature'];
    const secret = process.env.WC_WEBHOOK_SECRET;

    const expected = crypto
      .createHmac('sha256', secret)
      .update(req.body) // raw Buffer — do NOT parse JSON first
      .digest('base64');

    if (signature !== expected) {
      return res.status(401).json({ error: 'Invalid signature' });
    }

    const event = JSON.parse(req.body.toString());
    // Handle the event...
    console.log('Order ID:', event.id, 'Status:', event.status);

    res.status(200).json({ received: true });
  }
);

Common WooCommerce Webhook Issues