After updating to WishList Member 3.33.0 or higher, you may see a “WishList Member Security Notice” for PayPal on your dashboard. There are two versions, one for PayPal Express Checkout and one for PayPal Pro, and both read: “PayPal IPN messages cannot be securely verified until you enter your PayPal merchant email. WishList Member is accepting them without verification until you do.” This article explains why the notice appears and how to resolve it.
Why You're Seeing This Notice
Depending on which PayPal integration you use, you'll see one of these notices:
PayPal Express Checkout
PayPal Pro
WishList Member includes an extra layer of security in the way it handles incoming PayPal payment notifications (IPNs).
PayPal sends an Instant Payment Notification (IPN) to your site each time a payment, renewal, refund, or cancellation occurs. PayPal marks these notifications as “VERIFIED” to confirm the notification genuinely came from PayPal. However, a VERIFIED notification only proves that PayPal generated it. On its own, it does not prove that the payment was made to your own PayPal account.
WishList Member now checks that each incoming notification was actually paid to your account. It does this by comparing the receiving email address in the notification against the merchant PayPal email saved in your settings.
If no merchant PayPal email is saved for your PayPal integration, WishList Member cannot make that check, so the notice appears asking you to add it.
What This Means for Your Payments
Your site keeps working in the meantime. New memberships are still being created and existing memberships still renew through PayPal.
The notice is about verification, not interruption. Until you add your merchant PayPal email, WishList Member cannot confirm that incoming PayPal notifications genuinely come from your account, so it accepts them without that verification. Adding your merchant PayPal email restores the verification.
The notice stays in place until your merchant PayPal email is saved, and it cannot be dismissed. That is intentional: it is a reminder to complete a one-time setup step. Since this step affects how your payments are verified, we encourage you to take care of it soon. Once your merchant PayPal email is saved, the notice clears on its own.
Note: if you are setting up PayPal Checkout (also known as PayPal Express Checkout) or PayPal Pro (also known as PayPal Payments Pro) for the first time, rather than having had it active before this update, your merchant PayPal email needs to be saved before payments can be processed.
Which Integrations This Applies To
This notice applies to the PayPal integrations that use PayPal's Instant Payment Notifications (IPN): PayPal Checkout and PayPal Pro.
PayPal Standard (Legacy) has always required a merchant email in order to operate, so it is not part of this change, and most PayPal Standard sites already have the email saved.
This notice does not apply to PayPal Complete Payments. PayPal Complete Payments uses a different, signature-based method to verify notifications, so it does not use a merchant email field and is not affected by this notice.
How to Add Your Merchant PayPal Email
You will add the email for each PayPal integration you use (such as PayPal Checkout and PayPal Pro).
- Click the “Configure PayPal integration settings” link in the notice. You can also navigate to the Setup > Integrations > Payment Providers section in WishList Member.
- Open the configuration for your PayPal integration.
- Locate the “PayPal Email” field.
- Enter the email address on your PayPal account that receives your payments.
- Save your settings.
- If you use more than one PayPal integration, repeat these steps for each one.
Once a valid merchant email is saved, the notice clears and WishList Member can verify your PayPal notifications.
Which Email Address Should I Use?
Use the email address that PayPal reports as the receiver of your payments. In most cases this is the primary email address on the PayPal account you have been using all along.
A few things to keep in mind:
- The value must match what PayPal sends in the notification. If it does not match, WishList Member will not be able to verify the notification.
- If your PayPal account has more than one email address attached to it, use your primary account email.
- The match is not case sensitive, so capitalization will not cause a mismatch.
Sandbox (Test Mode)
If you test payments using a PayPal Sandbox account, enter your sandbox PayPal email in the “Sandbox PayPal Email” field within the integration's sandbox settings. The same matching rule applies in test mode.
Still Seeing the Notice After Adding Your Email?
If the notice is still showing after you have saved a merchant email, the most common cause is that the saved email is not the address PayPal reports as the receiver. The comparison ignores capitalization and surrounding spaces, so those will not cause a mismatch. Please confirm the email you entered is the exact address that receives the funds in your PayPal account, and that you saved it for the correct integration. The notice clears on its own once a matching merchant email is saved for the integration you use.
