After updating to WishList Member 3.33.0 or higher, you may see a “WishList Member Security Notice – Plug&Paid” on your dashboard that reads: “Plug&Paid webhooks cannot be securely verified until you re-copy the Thank You / API Notification URL into Plug&Paid. WishList Member is accepting them without verification until you do.” This article explains why the notice appears and how to resolve it.
Why You're Seeing This Notice
Plug&Paid sends webhooks to your site when payments and other events occur. WishList Member now includes a secret in your Thank You / API Notification URL so it can confirm that incoming webhooks genuinely come from your Plug&Paid account.
Your Plug&Paid account is still set up with the older notification URL, which does not contain this secret. Until the URL is updated, WishList Member cannot verify those webhooks, so it shows this notice.
What This Means for Your Payments
Your site keeps working in the meantime. Plug&Paid events are still being processed, so your members' access continues to update.
The notice is about verification, not interruption. Until you update the notification URL, WishList Member accepts Plug&Paid webhooks without confirming they came from your account. Updating the URL restores that verification.
The notice stays in place until an updated webhook is received, and it cannot be dismissed. That is intentional: it is a reminder to complete a one-time setup step. Because this step affects how your payments are verified, we encourage you to take care of it soon.
How to Resolve It
- In WishList Member, go to the Setup > Integrations > Payment Providers section and open the Plug&Paid configuration. You can also click “Configure Plug&Paid” in the notice.
- Copy the Thank You / API Notification URL shown there. This is the updated URL, which now includes the secret.
- Log in to your Plug&Paid account and open the settings where your Thank You / API Notification URL is configured.
- Replace the existing URL with the one you just copied from WishList Member, and save.
- If you have more than one product or integration in Plug&Paid using this URL, update each one.
Once WishList Member receives a webhook at the updated URL, the notice clears.
Still Seeing the Notice?
If the notice is still showing, the most common cause is that the old URL is still in place somewhere in your Plug&Paid account, or the updated URL was not saved. Please confirm you replaced the Thank You / API Notification URL everywhere it appears in Plug&Paid with the current one from WishList Member. The notice clears on its own once WishList Member receives a webhook at the updated URL.
