Test and production payment environments are separate systems. They use different credentials, merchant accounts, webhooks, fraud controls and sometimes different payment methods. A successful sandbox order proves the basic integration path, not that the live merchant setup is ready.
Do not switch a busy store between modes casually. First preserve the failed live transaction state and make sure customers are not charged repeatedly.
Record the live failure precisely
Capture the time, WooCommerce order ID, amount, currency, payment method and customer-safe error. Check the provider dashboard for a transaction or declined attempt.
Do not store card numbers, security codes, wallet tokens or full personal details. Use provider request and transaction IDs to correlate logs.
Determine whether failure occurs before leaving checkout, during authentication, on return or when the order status should update.
Confirm mode and credential pairing
Verify WooCommerce is in live mode and uses live publishable/client and secret keys from the same merchant account. Test keys often have recognisable prefixes, but use the provider’s documentation rather than guessing.
Safe credential check:
- mode selected in WooCommerce
- account/merchant identifier
- key creation environment
- key status and permissions
- no secrets copied into logsRotate an exposed secret immediately. Do not reveal it to prove that the configuration exists.
Check merchant activation
A provider may allow sandbox use before completing business verification, bank setup or acceptance of live payment methods. Inspect the live account for restrictions, payout holds and capability status.
Confirm the selected currency, country and method are enabled for that merchant. A method shown by cached checkout JavaScript may still be rejected by the live API.
Only the account owner or authorised operator should change legal and banking details.
Compare live domains and HTTPS
Wallets and embedded payment forms may require the production domain to be registered or verified. The live site must serve valid HTTPS with no mixed content on checkout.
Check allowed origins, redirect URLs and return URLs for the canonical www or non-www host. Staging domains that worked in test mode do not authorise the production host.
After a domain change, update the gateway dashboard and WooCommerce settings together.
Configure production webhooks separately
Sandbox and live webhooks normally have different endpoints, signing secrets and event histories. Confirm the live endpoint points to the final HTTPS domain and subscribes to the events required by the WooCommerce extension.
Inspect delivery responses. A 403 may be a firewall challenge, while a 500 needs PHP log correlation. Never reuse a sandbox signing secret in production.
Exclude only the documented callback path from incompatible cache or security rules.
Review live-only fraud and authentication
Production uses real issuer decisions, 3-D Secure, address checks, rate limits and fraud scoring. Find the provider decline code and distinguish a customer decline from an integration error.
Do not weaken fraud rules globally to make one payment pass. Test with an authorised low-value transaction and review which rule blocked it.
Browser privacy or consent settings can also affect embedded authentication. Test the affected device and browser.
Compare server reachability
Live API endpoints may be blocked by hosting egress rules, DNS, an outdated certificate store or security software. Correlate gateway logs with PHP/cURL errors.
Verify server time is accurate because signed requests can fail when the clock is wrong. Update PHP or certificate packages through the hosting’s supported path rather than disabling TLS verification.
Repair and run a controlled live test
Correct the proven live-only boundary: credentials, account capability, domain registration, webhook secret, firewall or authentication configuration. Keep a rollback record.
Run one authorised low-value payment and confirm one WooCommerce order, one provider capture, correct transaction ID, webhook delivery, stock and email. Refund it through the normal workflow if appropriate.
Recurring care should monitor live webhooks and run controlled payment checks after domain, SSL, gateway and checkout updates. Sandbox remains valuable, but production readiness requires its own evidence.