How to apply an IP restriction for Stripe webhooks

How To
1

I would like to add an IP restriction to my Stripe webhooks, as I do for WooCommerce.

This help be to prevent exclude incoming requests from from development websites, which basically block my scenarios, when not coming from the expected website.

It’d be much easier to do that rather than scripting configurations for WordPress to remove these webhooks.

I can see the option on WooCommerce webhooks, to restrict IP, but not from Stripe webhooks.
Why is that so?
Is there another way to do that?

Thanks

2

Stripe IP and domains list https://docs.stripe.com/ips

Make IP and domains list https://www.make.com/en/help/connections/allowing-connections-to-and-from-make-ip-addresses

If you need further assistance, please provide the following:

  • Screenshots of whatever you’re looking at
2 Likes
3

Hi,
Thanks for your help. Unfortunately, your solution doesn’t really help me.
Let me clarify, since I just realized my question contains typos, and may not be very clear.

I want to add a layer of IPs restrictions, which would:

  • allow only incoming webhooks from a specific website (live website) towards Make,
  • prevent those from its copies (test/development websites, which comes with the live websites webhooks duplicated) to trigger anything inside Make.

I couldn’t find a way to script the deletion of these webhooks from the website during the duplication process, besides direct to base, which I’d rather avoid.

I can set this kind of restrictions the Make > Webhooks > Edit panel for WooCommerce webhooks, as you can see below:

image
image1053×645 86.6 KB

Unfortunately, I can’t do the same for Stripe’s webhooks, for which there’s no “Edit” button.

The solutions you offer requires server-side setup, so that it’s not portable:
For both solutions, I would need to set them from every environment.
And for the Make restriction, it would prevent every communications towards make from these environment, which is not what I want.

I hope this explanations make things clearer.

Thanks

4

Hi,
For those interested, I finally found a WP CLI syntax that would allow to suppress all existing webhooks from a specific WordPress environment:

wp wc webhook list --field=id  --user=<user> | xargs -I % wp wc webhook delete % --force=true --user=<user>

If prefered, it’s also possible to tweak this request to remove only the required webhook(s), based on their IDs.

1 Like