You went live. The store looked fine. Then a customer emailed to say their payment failed.
Not a dashboard alert — an email. By the time that message arrived, you had lost sales you will never count.
That is not a Stripe problem or a WooCommerce problem. It is a testing problem. Every major payment gateway guide makes it worse by treating sandbox testing as the final safety check.
This is the payment gateway integration checklist for small e-commerce stores. It catches real production failures before your customers hit them. Not the generic API walkthrough you have already read twice.
What’s the most dangerous assumption in payment gateway setup?
The most dangerous assumption is that a successful sandbox test means your live integration will work. It does not. Sandbox and production environments behave differently in ways that directly cost you orders.
Most guides walk you through API keys, sandbox testing, and a dashboard confirmation. Then they say go live. That sequence feels complete — here is what it costs when it is not.
What most store owners do: They follow a setup tutorial and flip to live mode. They send the launch announcement. Then they wait for revenue.
What that actually costs: Webhooks that fire correctly in sandbox often fail silently in production. The cause is usually an SSL certificate mismatch or a wrong endpoint URL. A missing trailing slash in the callback URL also breaks it.
When webhooks fail, your order management system never receives payment confirmation. Orders sit in "pending" forever. Fulfillment stalls.
Order confirmation emails never fire. Customers who were charged get nothing — a gap that proper transactional email setup cannot fix if your webhook is broken. They chargeback.
A $30k/month store losing fulfillment visibility for 48 hours can absorb $800–$2,000 in chargebacks before anyone notices. That is not a worst-case number. That is a pattern.
The 20% move that actually works: Run one live transaction in production before you announce launch. Not a sandbox transaction. A real $1 charge on a real card through your actual gateway.
The next two sections show exactly how and why.
A Shopify home goods store at $22k/month switched from "sandbox pass = done" to a live transaction drill. They caught a webhook URL mismatch that would have killed order notifications silently. The fix took 11 minutes.
The alternative was days of invisible failed fulfillments.
What actually breaks when a payment gateway goes live on Shopify or WooCommerce?
The two failure points that cause the most real-world damage are webhook misconfiguration and SSL enforcement mismatch. Both are invisible in sandbox testing. Both surface only after real customers hit your checkout.
On WooCommerce with Stripe: The most common break is the webhook endpoint URL. Your live store URL must match the URL in your Stripe dashboard exactly. Check for www, trailing slashes, and your SSL certificate on that exact domain.
If you configured webhooks on a staging URL, you go live with the wrong endpoint. Stripe fires events. Your store never receives them.
No errors surface in WooCommerce. Orders sit in pending.
To check: go to your Stripe dashboard → Developers → Webhooks. Confirm the endpoint URL matches your live store exactly. Confirm status shows "Enabled."
Then check recent events. You want 200 responses, not 4xx or 5xx errors.
On Shopify with Stripe or PayPal: Shopify handles more of the integration natively, which reduces certain failure points. The break that catches Shopify stores is usually the order status page redirect.
Any theme change, checkout setting update, or new fulfillment app can break your order status page. A customer completes checkout, gets charged, and lands on a blank page. No confirmation.
Instant distrust.
A Shopify apparel store at $45k/month discovered this after a theme update. Customers paid but landed on a broken order status page. They took 14 chargebacks in three days before a customer screenshot surfaced it.
The fix was a single notification URL correction in Shopify settings. The chargeback dispute process took six weeks.
How do you run a payment gateway integration checklist before going live?
You run a live transaction validation drill before you announce launch. Twenty minutes. Four checkpoints.
No sandbox. No exceptions.
This four-step checklist separates the stores that catch failures before launch from those that find out via customer emails.
Step 1: Run a real $1 transaction. Use your actual production gateway — not test mode. Use a real card. Complete the full checkout flow from your product page, exactly as a customer would.
Do not jump to a backend payment entry.
Step 2: Check order status in your dashboard immediately. Open your WooCommerce orders page or Shopify admin. The order should appear. Payment status should show "paid" — not "pending," not "processing," not blank.
If it shows "pending" after a charge that went through, your webhook is broken. The gateway received the payment. Your store did not receive confirmation.
Step 3: Check your webhook log in Stripe or PayPal. In Stripe: Developers → Webhooks → click your endpoint → Recent Deliveries. You want a 200 response on a payment_intent.succeeded or charge.succeeded event within the last five minutes.
A 400 or 500 response means your store rejected or failed to process the webhook. A missing event means the webhook never fired — recheck your endpoint URL.
Step 4: Confirm the order confirmation email landed in your inbox. It should arrive within 60 seconds of payment. If it does not, check your WooCommerce email settings or Shopify notification templates. A missing confirmation means your customer also received nothing.
If all four pass, your integration is live-safe. Refund the $1 to yourself and launch. If any fail, fix the break before any customer touches your checkout.
A WooCommerce candle store at $18k/month ran this drill 48 hours before their holiday sale. Step 3 showed a 403 response — their server was blocking incoming Stripe webhook requests via a firewall rule. Their hosting provider whitelisted Stripe’s IP range in 20 minutes.
Without the drill, they would have launched into a silent failure on their highest-revenue weekend of the year.
How do you choose between Stripe, PayPal, and other gateways — and does the choice affect your risk?
For stores under $10M/year, Stripe is the default choice for documented, debuggable integrations. The gateway choice affects both your per-transaction cost and your ability to troubleshoot failures when they happen.
Fee comparison at $10k/month volume (2026 domestic rates):
- Stripe: 2.9% + $0.30 per transaction. At $10k/month across 100 transactions: approximately $320/month.
- PayPal standard: 3.49% + $0.49 per transaction. Same volume: approximately $398/month.
That $78/month difference compounds to $936 per year. PayPal also costs more per incident to diagnose. Its IPN dashboard is less transparent than Stripe’s webhook delivery log.
Stripe’s webhook dashboard shows delivery attempts, response codes, and retry history by default. That visibility alone is worth the fee difference when something breaks at 11pm on a Friday.
Platform-specific note: For WooCommerce, Stripe’s official plugin handles webhook registration automatically. That reduces registration errors — but SSL and endpoint URL mismatches still apply. Run the drill regardless.
For Shopify, Stripe integrates through Shopify Payments in most regions. If Shopify Payments is available to you, use it. It removes the webhook layer entirely for most order events.
Your failure risk drops significantly compared to a third-party integration.
What security measures does a small store actually need before going live?
Three measures are required. Everything else depends on your volume and customer geography.
Required for every store:
First, HTTPS with a valid SSL certificate on your checkout URL specifically — not just your homepage. Test it directly. Go to sslshopper.com/ssl-checker.html, enter your full checkout URL, and confirm the certificate is valid and not expiring within 60 days.
Second, PCI DSS compliance through your gateway’s hosted fields or redirect checkout. If you use Stripe Elements or WooCommerce’s hosted checkout, Stripe handles card data. You do not touch raw card numbers.
That is your compliance path. Do not build a custom card form that posts data to your server.
Third, 3D Secure 2.0 enabled if any of your customers are in the EU or UK. PSD2 regulations require strong customer authentication for European transactions. Stripe enables this by default now — confirm it is active in your Stripe Radar settings before launch.
What to skip at first: Address Verification (AVS) and fraud scoring tools like Kount become relevant above $50k/month. Below that, Stripe’s default Radar rules cover most fraud patterns. Adding AVS early adds checkout friction.
Test your conversion rate before enabling it. Our guide to checkout conversion optimization covers the friction tradeoffs at each store size.
A Shopify supplement store at $40k/month set a Stripe Radar alert for five or more declines in 24 hours. On day 11 post-launch, the alert fired. They found a 3D Secure authentication failure affecting EU customers only — a Radar setting they had not configured.
They fixed it the same day. Without the alert, that failure would have persisted for weeks across every European order.
Set that alert before you go live. In Stripe: Radar → Rules → configure an email notification for failed payment intents. Three declines in 24 hours is a reasonable threshold for a store under $20k/month.
The stores that lose real revenue to payment failures did not skip all of this. They skipped one step — usually the live transaction drill. Twenty minutes would have saved them weeks of chargebacks and customer service emails.
Your pre-launch gate is four steps: $1 live transaction, "paid" in dashboard, 200 in webhook log, confirmation email in inbox. That is the complete check.
If your store is already live and you have never run this drill, run it today. Silent webhook failures can sit undetected for months.
