Webhooks Explained for Store Owners: Why a Missed One Costs You Orders
What a webhook is, how Shopify and payment gateways use them, what goes wrong when one is missed or duplicated, and how to make order flows reliable.
When a customer pays for an order, a lot happens behind the scenes. Your payment provider confirms the money, your store marks the order as paid, your stock goes down, an email goes out, and maybe your accounting or delivery system hears about it too. Very often, the thing that connects those steps is a webhook.
You don’t need to be a developer to understand them, and it’s worth doing so, because when webhooks fail, they fail quietly. This guide explains what they are, what can go wrong, and what to ask whoever builds or manages your integrations.
What a webhook is, in plain terms
There are two ways your store can find out that a customer has paid. It can keep asking the payment provider “did anything come through yet?” over and over, or the provider can simply tell the store the moment it happens.
That second way is a webhook. Think of a delivery rider who texts you “I’m outside” rather than you walking to the gate every few minutes to check. It’s faster, it uses less effort, and nothing is checked for nothing.
Technically, your system gives the other service a web address. When an event happens, the service sends a small message to that address with the details: which order, how much, what changed.
Where webhooks show up in an online store
- Payments. A gateway tells your store that a GCash, Maya or card payment succeeded or failed. This is the most important one, because it decides whether an order counts as paid.
- Orders. Shopify can tell another system whenever an order is created, updated or cancelled.
- Stock. A change in inventory can be passed to a warehouse, POS or marketplace listing.
- Subscriptions. A renewal, a failed charge or a cancellation updates what the customer can access.
- Shipping. A courier tells you a parcel was picked up or delivered, so the customer is notified.
Tools like Zapier and Make use webhooks too. Behind a lot of “when this happens, do that” automations, a webhook is the thing that starts them.
What can go wrong
1. A message never arrives
If your system is down or slow when the message is sent, it can be missed. Providers usually try again for a while, but not forever. Once they give up, an order can sit unpaid in your store even though the customer has already paid.
2. The same message arrives twice
Retries mean duplicates are normal. If your system treats every message as new, one payment can create two orders, send two emails, or subtract stock twice.
3. Messages arrive out of order
A “payment refunded” message can land before the “payment succeeded” one. A system that simply believes whatever came last can end up with the wrong status.
4. A message is fake
A webhook address is just a web address. Without a check, anyone who finds it could send a made-up “order paid” message and get free goods. Providers include a signature so you can tell a real message from a fake, but your system has to actually verify it.
5. The work takes too long
If your system does heavy work before replying, the sender may decide the delivery failed and send it again. A good receiver replies quickly, then does the work afterwards.
6. It fails silently
This is the worst one. Nothing crashes and no customer complains for days, but orders have quietly stopped syncing. By the time someone notices, there may be weeks of records to untangle.
What a reliable webhook setup does
| Risk | What a reliable setup does |
|---|---|
| Fake messages | Verifies the provider’s signature on every message and rejects anything that doesn’t match |
| Duplicates | Records each message’s unique ID, so a repeat has no extra effect |
| Slow processing | Replies right away, then does the work in the background |
| Missed messages | Can catch up by asking the provider for recent orders or payments and comparing them with what it has |
| Wrong order | Checks the current status with the provider before acting on an old message |
| Silent failure | Keeps a log of what arrived and what happened, and alerts someone when something fails |
Both Shopify and the main payment gateways support this. Shopify signs every webhook so you can verify it and gives each delivery an ID you can use to spot repeats, and PayMongo signs its requests and lets you resend a missed event from its dashboard. These are the tools; the work is in using them properly.
Questions to ask whoever manages your integrations
What it looks like when it goes wrong
Deal Dunk runs a subscription membership storefront on Shopify. A single missing database write meant paid orders weren’t being linked to their subscriptions, and a growing backlog quietly stalled. The cause was in how events from the store and the subscription billing system were being handled, and nothing visibly broke. We traced it across both webhook streams, fixed it, and safely released more than 2,000 stalled orders.
That’s the pattern to watch for: not a dramatic outage, but a slow gap between what your customers did and what your systems recorded.
Next steps
If you run on automations, our guide to Zapier vs a custom integration explains when a no-code tool is enough and when it isn’t. If you take GCash or Maya payments on Shopify, start with how to accept GCash on Shopify, and for apps that react to your store’s events, see Shopify custom app vs app store app.
If your orders or payments aren’t syncing the way they should, see our API and systems integration service.