WAF Blocked Your Payment Callback? How to Whitelist: Check Rule ID First, Then Add IP Precise Allow by Path

Payment succeeds but orders don't update, and the payment platform reports notification failure—most likely the WAF treated the callback request as an attack. This article provides the recovery order: first locate the blocking module and rule ID in the interception logs, then use a combination of 'POST + callback path + payment platform official IP range' to allow only that endpoint and only skip the hit module, finally resend the notification to verify, and retain business-layer signature verification.