Yes, the site is behind Cloudflare. I identified and fixed the webhook blocking issue on our end.

The problem was that Cloudflare's Bot Fight Mode was blocking POST requests from NOWPayments servers to our webhook URL. We added a WAF skip rule for requests containing "nowpayments" in the URI, which resolved the delivery issue.

Additionally, I whitelisted NOWPayments IPs directly on the origin server.

Payments are now being received correctly. However, I noticed that for the older payment that failed, there was no automatic retry — I had to process it manually. If there's a way to trigger a webhook resend from the plugin side for failed deliveries, that would be helpful.

Regarding IPS 4.7 compatibility — we're running IPS 4.7.24 and have no plans to migrate to IPS 5. Is the plugin still maintained for 4.7?

On 4/20/2026 at 3:07 PM, sman said:

hello,
At this point, after the payment is made, the crypto payment enters the NOWPayments account, but nothing appears in Transactions, is there a problem with the callback?
so, can we have a fix?

I have this same issue with IPS5. It was working fine, but now it's not working. I use Cloudflare. Can you tell me how to fix this?

On 6/4/2026 at 12:58 PM, TomCat said:

I have this same issue with IPS5. It was working fine, but now it's not working. I use Cloudflare. Can you tell me how to fix this?

Did the NOWPayments Gateway 2.0.2 update fix this issue?

Hello. No, it's not a gateway problem. To add a gateway to exceptions in Cloudflare:

Go to Cloudflare → Security → WAF → Custom rules → Create rule

Name: Allow NOWPayments webhook

Use this expression:

(
  http.request.method eq "POST"
  and http.request.uri.path eq "/index.php"
  and any(http.request.uri.args["app"][*] == "nowpayments")
  and any(http.request.uri.args["module"][*] == "front")
  and any(http.request.uri.args["controller"][*] == "webhook")
  and has_key(http.request.headers, "x-nowpayments-sig")
)

Select action: Skip, then select:

• All remaining custom rules

• All rate limiting rules

• All managed rules

• All Super Bot Fight Mode rules

• Browser Integrity Check

• Security Level

• Zone Lockdown, only if you use it

Move this rule above any custom Block or Challenge rules. Cloudflare confirms that Skip rules can bypass Managed Rules, rate limiting, Super Bot Fight Mode, Browser Integrity Check, and Security Level.