Order not updating / Solution found

Resolved dev1337
(@dev1337)

7 months, 2 weeks ago
After some digging we were able to trace the issue behind Mollie payment statuses not updating automatically in WooCommerce.

The problem is linked to SiteGround’s firewall/security layer. Their system was putting certain Mollie webhook IPs (34.76.201.228 and 34.76.90.110 in our case, might differ) on a greylist because of traffic patterns that resembled mass PHPMail activity. As a result, only a portion of webhook calls reached the store, while others were blocked at the server level.

SiteGround whitelisted those IPs for us, which immediately restored the normal webhook flow. However, they also pointed out that the underlying behavior (these Mollie IPs generating PHPMail-style requests) is unusual and the reason the block was triggered in the first place.

For other SiteGround users: if you face similar symptoms, ask support to review their security logs and check whether Mollie IPs are being filtered. A whitelist entry should fix it.

For Mollie and the plugin maintainers: it would be very useful if you could look into why your webhook servers are associated with PHPMail executions. As long as that pattern exists, hosting providers may continue to flag and block your traffic.
- This topic was modified 7 months, 2 weeks ago by dev1337.

Viewing 15 replies - 1 through 15 (of 16 total)

1 2 →

Cealin
(@cealin)

7 months, 2 weeks ago

Thank you for this. This indeed is a serious problem Mollie has to fix.

firewhisperer
(@firewhisperer)

7 months, 2 weeks ago

Different hosting here, but the same problems. I saw blocked webhook traffic from Mollie in an application layer firewall I am using to block access to the REST API. So it seems the new webhook implementation is suspicious to other security solutions too. Perhaps whitelisting might solve the problem, but we really shouldn’t have to.

spreid
(@spreid)

7 months, 2 weeks ago

Ah, that’s would be nice and fixable by Mollie I asume.

Plugin Support Femi
(@femiyb)

7 months, 2 weeks ago

Hello @dev1337

Thanks for the detailed information, we are cureenctly looking into this, and in contact with Siteground.

@firewhisperer Could you please confirm what hosting you are with?

Thanks.

Cealin
(@cealin)

7 months, 2 weeks ago

This could be a problem as well https://help.mollie.com/hc/en-us/articles/213470829-Which-IP-addresses-does-Mollie-use

Cloudflare could also give problems for some.

firewhisperer
(@firewhisperer)

7 months, 2 weeks ago

My hosting is not siteground and the problem does not seem to be related to my hosting.

I added an exeption to the wordpress security plugin I am using, allowing Mollie to access the REST API. Now order payment updates seem to be working fine. Still I’d rather see the plugin fixed…
Plugin Support Femi
(@femiyb)

7 months, 2 weeks ago
Hello everyone,

Thanks for bearing with us while we dug into this. SiteGround has confirmed that their automated security system was mistakenly blocking Mollie’s webhook callbacks.

What SiteGround has done
- Allowed requests to our webhook endpoints:
- /wp-json/mollie/v1/webhook and /wc-api/mollie_return
- Unblocked IPs that were affected in the last 24 hours
- Clarified that callbacks were flagged due to email-like traffic patterns; these URIs are now excluded from their mitigation, so this shouldn’t recur
What we need from you
- Please test new payments and confirm whether order status updates now work as expected
- If you still see issues, share: store URL, timestamp (UTC), Mollie payment ID/event ID, and hosting details so we can investigate with SiteGround
- If you are using a different hosting provider and still experiencing this problem, kindly confirm your host so we can investigate.
We’re continuing to work with SiteGround on the exact trigger and on any plugin-side adjustments to prevent similar false positives. If you have input or logs that could help, we’d love to hear it.
Thank you for your patience, we’re on this until it’s fully resolved.

Regards,
Femi
Plugin Support Femi
(@femiyb)

7 months, 2 weeks ago

Hello @firewhisperer
Based on your comment:

I added an exeption to the wordpress security plugin I am using, allowing Mollie to access the REST API. Now order payment updates seem to be working fine. Still I’d rather see the plugin fixed…

Could you please confirm which Security Plugin this is?

Thanks.

Plugin Support Syde Joost
(@joostvandevijver)

7 months, 2 weeks ago

Hello @firewhisperer ,

Could you please let us know what security plugin you are using, so we can test this and use it to resolve this issue for that instance? Thank you.

Joost

spreid
(@spreid)

7 months, 2 weeks ago

Thank you @dev1337 for pinpointing the root cause so the Mollie team knew what went wrong and could start looking for a solution.

spreid
(@spreid)

7 months, 2 weeks ago

Today I received two more orders where I had to manually check them. So there’s still a hiccup. Is anyone else experiencing this?
(Siteground Hosting)

mrherrie
(@mrherrie)

7 months, 2 weeks ago

Here also we have to manually check the orderstatus. Also Siteground hosting.

Plugin Support Femi
(@femiyb)

7 months, 2 weeks ago

Hello @mrherrie

We have reached out to SiteGround support, and they confirmed that they have resolved this on their side again. Could you please confirm that paid orders are now being processed on your store?

Regards,
Femi.

octopusmarketing
(@octopusmarketing)

7 months, 1 week ago

Yesterday the payment did not went trough.

I just tested it and it worked fine again.

Can you confirm that the webhook wont be blocked again?

Plugin Support Syde Joost
(@joostvandevijver)

7 months, 1 week ago

Hello @octopusmarketing,

Following further discussions with SiteGround, we learned that the previous allowlisting wasn’t applied correctly/permanently. They’ve now implemented a fix, which should resolve the issue moving forward.

This is outside our direct control, so we can’t guarantee it, but we do believe it’s been handled properly this time. If you’d like additional assurance, we recommend contacting SiteGround for confirmation.

Best regards,
Joost