After the order has been placed in WooCommerce and with Qliro, there are a number of http requests back and forth to keep WooCommerce and Qliro in sync. It’s important that these requests can be executed without being blocked, otherwise the customer will not be able to create an order in WooCommerce.

This article specifically addresses measures regarding Qliro. For a general overview of what you might need to do to prevent callback issues, please see this Krokedil general support info: Callbacks article.

Be aware of firewalls and security plugins

If you have a firewall solution or a security plugin installed, it could block access to the WC-API and REST API endpoints which causes the callbacks to fail. If you are using Cloudflare CDN and their WAF Firewall (or other WAF/CDN services like Sucuri or similar server hosting firewalls) you need to create a specific Page Rule to whitelist the API-calls that are needed for the Qliro plugin to work properly.

We recommend (if possible) to whitelist:

https://domain.topdomain/wc-api/*

https://domain.topdomain/wp-json/qliro/*

But if you want to specify what URLs to whitelist you can use these:

https://domain.topdomain/wc-api/QOC_OM_Status/*

https://domain.topdomain/wc-api/QOC_Checkout_Status/*

https://domain.topdomain/wp-json/qliro/v1/callback/save-card

https://domain.topdomain/wp-json/qliro/v1/callback/notifications