Possibly, and it's worth checking. The webhook endpoint (/wp-json/wpdirectdebit/v1/webhook) is registered with permission_callback => __return_true, meaning WordPress itself imposes no authentication — the plugin verifies each request by checking the Webhook-Signature header against an HMAC of the raw payload using your webhook secret. Some WAFs and security plugins are configured to block or challenge unauthenticated POST requests to /wp-json/, which will silently stop GoCardless's webhook deliveries from ever reaching the handler. Separately, if you run a full-page cache (LiteSpeed Cache, WP Rocket, etc.), make sure the webhook endpoint — and ideally the whole /wp-json/wpdirectdebit/ namespace — is excluded from caching. A cached response to what should be a live webhook POST will look like success to GoCardless while doing nothing.