Short answer: a customer’s redirect back to your store proves nothing. It can be skipped, repeated or forged. A safe gateway marks an order paid only when the payment provider sends a signed server-to-server webhook that matches the order’s amount, and it has a backstop for webhooks that never arrive.
What “marked paid on redirect” means
With hosted checkouts, the customer leaves your site to pay and is then sent back to a return URL. Some integrations treat reaching that URL as proof of payment and immediately set the order to Processing.
Three ways that goes wrong
1. The customer never comes back
They close the tab, lose signal or their bank’s 3-D Secure page times out. They’ve paid, but your order still says Pending, so stock isn’t reduced and no confirmation email goes out.
2. The redirect is visited without paying
Return URLs are ordinary links. If the only check is “did someone reach this page”, anyone who works out the pattern can mark orders paid.
3. The amount is wrong
Even a genuine payment can be for the wrong amount if the checkout was created from a tampered request. If your integration doesn’t compare the paid amount with the order total, it won’t notice.
What a safe confirmation flow looks like
- Signed webhooks. The provider sends a server-to-server event signed with a secret only you and it know. Whop uses the Standard Webhooks scheme: an HMAC-SHA256 over the webhook ID, timestamp and raw body.
- Idempotency. Each event ID is processed once. Retries and replays don’t complete an order twice or duplicate a refund.
- Amount matching. The paid amount must equal the order total. If it doesn’t, the order is held for review, not completed.
- A backstop. A scheduled job checks pending orders against the provider’s API, so a lost webhook doesn’t leave a paid order stuck.
- A redirect for the customer only. The return page is for the shopper. It can show “confirming your payment…” and poll for status, but it never changes the order itself.
How WhopWoo handles it
WhopWoo follows this flow for every Whop payment: signature verification, event deduplication, an amount check that puts mismatches on hold, a thank-you page status check, and a 15-minute reconciliation job. In testing, a correctly signed webhook claiming ₹1.00 against a ₹59.97 order was held rather than paid.