After updating to WishList Member 3.33.0 or higher, you may see a “WishList Member Security Notice – Stripe” on your dashboard that reads: “Stripe webhook events cannot be securely verified until WishList Member has a webhook signing secret. Open your Stripe settings and click ‘Refresh Stripe Credentials' and WishList Member will set up the signing secret automatically. WishList Member is accepting them without verification until you do.” This article explains why the notice appears and how to resolve it.
Why You're Seeing This Notice
WishList Member verifies that incoming Stripe webhook events are genuinely from Stripe before acting on them. Stripe signs each event it sends to your site, and WishList Member checks that signature against your Stripe webhook signing secret.
If your active Stripe mode is connected (it has an API key) but does not have a webhook signing secret saved, WishList Member cannot verify those events, so it shows this notice.
This is why you may still see “API Status: Connected” alongside the notice. Being connected to Stripe for payments and having a saved webhook signing secret are two separate things, and the notice is specifically about the signing secret.
What This Means for Your Payments
Your site keeps working in the meantime. Stripe events such as renewals, cancellations, and refunds are still being processed, so your members' access continues to update.
The notice is about verification, not interruption. Until a webhook signing secret is saved for your active mode, WishList Member accepts Stripe events without confirming each one genuinely came from Stripe. Saving the signing secret restores that verification.
The notice stays in place until the signing secret is saved, and it cannot be dismissed. That is intentional: it is a reminder to complete a one-time setup step. Since this step affects how your payments are verified, we encourage you to take care of it soon. Once the signing secret is saved, the notice clears on its own.
Live Mode and Test Mode Are Separate
WishList Member stores a separate webhook signing secret for live mode and for test mode. The notice applies to whichever mode is currently active in your Stripe settings (controlled by the Enable Test Mode option).
This is the most common reason the notice does not clear: a signing secret was added for one mode while the other mode is the one that is active. Please make sure you add the signing secret for the mode you are actually using.
How to Resolve It
Click the “Open Stripe Settings” button in the notice to open your Stripe settings in WishList Member. You can also reach the same place from the Setup > Integrations > Payment Providers section in WishList Member by opening the Stripe configuration (the API tab).
From there, the steps depend on how you connected Stripe.
If You Connected Stripe With the “Connect with Stripe” Button
For accounts connected through Stripe Connect, the signing secret is managed for you and there is no field to enter it by hand. On the API tab of the Stripe configuration, click “Refresh Stripe Credentials.” WishList Member sets up the webhook signing secret for you automatically, and the notice clears.
If You Connected Stripe With Your Own API Keys (Manual Setup)
- In a separate tab, log in to your Stripe account and go to Developers > Webhooks.
- Open your webhook endpoint and reveal the signing secret. It begins with “whsec_”.
- Back in WishList Member, on the API tab, paste that value into the “Webhook Signing Secret” field. If you are working in test mode, use the “Test Webhook Signing Secret” field instead.
- Save your settings.
Once a signing secret is saved for the active mode, the notice clears and WishList Member can verify your Stripe events.
Still Seeing the Notice?
If the notice is still showing after you have saved a signing secret, the most likely cause is a mode mismatch. Please confirm that the signing secret you added is for the mode that is currently active (live or test). If you are connected through Stripe Connect, click “Refresh Stripe Credentials” again to set up the managed signing secret for the active mode.
