Yes — without a webhook, the very first sign-up will usually still go through, but GoCardless has no way to tell your site about anything that happens afterwards, like a payment clearing, failing, or a customer cancelling. That means [...]

Possibly, and it's worth checking. The webhook endpoint (/wp-json/wpdirectdebit/v1/webhook) is registered with permission_callback => __return_true, meaning WordPress itself imposes no authentication — the plugin verifies each request by checking the Webhook-Signature header against an HMAC of the raw payload [...]

Two likely places to check, in order: your error log, and whether the underlying entry can even be found. Each event is processed inside a try/catch specifically so a single malformed or unexpected event can't throw a 500 and [...]

When a billing request combines a Direct Debit mandate with an Instant Bank Pay (or other instant-scheme) joining fee, GoCardless can create two mandates for the same billing request — one Direct Debit, one instant. The webhook handler explicitly [...]

Use the action hooks instead: wpdd_mandate_ready, wpdd_mandate_active, wpdd_payment_confirmed, wpdd_payment_paid_out, wpdd_subscription_created, wpdd_payment_failed, wpdd_subscription_create_failed, and wpdd_mandate_cancelled. All fire with ( $entry_id, $resource_id ). The reason to prefer these over reading wpdd_status meta directly is that the status field is deliberately monotonic [...]

In theory, yes — worth knowing if you're planning a domain migration mid-flight. Idempotency keys sent to GoCardless for payment creation are built from the entry ID plus home_url() (e.g. pay-1234https://example.com), so GoCardless can recognise a retried request as [...]