This one deserves its own article, because it is invisible when it works and baffling when it does not.
What a webhook actually is
Forget the word. Here is what happens.
Your customer pays at Mollie. Mollie now knows the payment succeeded, but your website does not, because your customer’s browser might have closed, crashed or wandered off to another tab.
So Mollie calls your website directly and says: this payment is done.
That call is the webhook. It is Mollie ringing your doorbell.
When your website hears it, it activates the package, generates the invoice and sends the email.
Why this matters so much
If Mollie cannot reach your website, the doorbell never rings.
The payment is perfectly fine. The money is in your Mollie account. But your website never heard about it, so nothing happens: no package, no invoice, no email.
From your customer’s point of view, they paid you and got nothing. It is the single most damaging thing that can go wrong, and it has nothing to do with the payment itself.
You do not have to set it up
The plugin creates the webhook for you and tells Mollie where to find it. There is nothing to configure.
You will find it on the API keys tab, under Webhook URL, with a Copy button next to it.
The address includes a secret token, which is how your website knows the call really came from Mollie and not from somebody poking at your site. Do not share it around.
Test it
On the same tab, click Test webhook.
Green means Mollie can reach you. That is the whole test, and it is worth doing every time you change hosting, add a security plugin, or move a site from staging to live.
What blocks a webhook
Something on your side is refusing the call. It is nearly always one of these.
A security plugin. Wordfence, iThemes Security and their cousins block incoming requests they do not recognise. Add an exception, or switch the plugin off briefly to confirm that is the cause.
A firewall at your host. Some hosts are aggressive about unfamiliar traffic. Ask them to allow incoming requests from Mollie.
Maintenance mode, or a “coming soon” page. These hide your entire site from the outside world, and Mollie is part of the outside world.
Password protection. Staging sites often sit behind an HTTP password. Mollie does not know it.
A site that is not publicly reachable at all. A local machine, or an internal network. Mollie cannot ring a doorbell it cannot find.
Your safety net
Even if the webhook fails completely, you are not lost.
The plugin checks in with Mollie every hour and picks up anything it missed. A payment that got stuck will usually sort itself out within the hour, without you touching anything.
That is a safety net, not a solution. An hour is a long time for a customer who just paid you and is staring at a page that says nothing happened. Fix the webhook.