Stripe sends both test and live webhooks to the live endpoint (docs). However signature validation here does not account for this, so test mode events fail validation and get logged as errors. On WPCOM we have alerts that trigger on these errors, which for test events are spurious.

This patch changes the log severity level to debug for errors in test mode events.

A further improvement would be to change validate_request to account for test mode events, but this is a bigger change. It also doesn't solve the current problem -- test mode signatures would be successfully validated, but any other test mode errors would still get reported as production errors.

Testing

To test manually, we'll need the event ID of a test mode webhook sent to the live site. All test events are sent to the live site so any should work; I'm using setup_intent.succeeded because that was the event type that instigated this PR). There is a log of these at https://dashboard.stripe.com/test/events.

I then redirected stripe setup_intent.succeeded webhooks to a dev site using a stripe CLI command like this (change the event type and site domain as needed):

stripe listen --events setup_intent.succeeded --forward-to 'https://very-demure.example.com/?wc-api=wc_stripe'

We can resend an event with a command like this (use your own event ID):

stripe events resend evt_NNN

I think the event can also be resent from the stripe admin from the dot menu on an attempt log entry like this one:

If that worked the CLI should report something like this:

2025-01-02 14:36:54   --> setup_intent.succeeded [evt_NNN]
2025-01-02 14:36:55  <--  [204] POST https://very-demure.example.com/?wc-api=wc_stripe [evt_NNN]

Since this was a test mode event, it should fail validation and get logged at debug level.

• Covered with tests (or have a good reason not to test in description ☝️)
• Added changelog entry in both changelog.txt and readme.txt (or does not apply)
• Tested on mobile (or does not apply)

Post merge

• Added testing instructions to the Release Testing Instructions wiki page (or does not apply)
• Added the needs docs label (or does not apply)
• Included this PR in the Release Thread scope (or does not apply)