Purpose
Document how PayPress identifies a WordPress installation.
Overview
PayPress stores a persistent installation UUID and uses it to mark Stripe Checkout-created objects and validate incoming webhook ownership.
How It Works
If the UUID option is missing or invalid, PayPress generates one and persists it. Once a valid UUID exists, it is treated as immutable and should not rotate because of URL, hostname, scheme, path, proxy, or WP-CLI context changes.
Important Components
manzari_stripe_installation_id.manzari_stripe_installation_home_url.- Identity diagnostics.
- Stored home URL variation warnings.
- Ownership metadata.
Data Flow
Plugin reads installation UUID -> if valid, reuse it -> if missing/invalid, generate and persist -> attach to checkout metadata -> validate matching webhook metadata later.
Security Considerations
A stable UUID protects Stripe events from being processed by the wrong WordPress installation. Silent rotation can cause legitimate events to be rejected as foreign.
Known Limitations
Cloned sites require operational care. PayPress warns about stored home URL changes but does not yet provide a full clone-management UI.