XenForo IPN - Request not validated


Been following this guide to test out user upgrades before going live. Paypal sees the forum payment hit the sandbox account, however XenForo does not update the user.

I set the IPN call back URL to http://domain/payment_callback.php and in the upgrade user log all I'm seeing is Request not Validated.

Have I missed something obvious?

Jake Bunce

XenForo moderator
Staff member
That error is returned in this file:


Rich (BB code):
	public function validateRequest(&$errorString)
			if ($this->_filtered['test_ipn'] && XenForo_Application::debugMode())
				$validator = XenForo_Helper_Http::getClient('http://www.sandbox.paypal.com/cgi-bin/webscr');
				$validator = XenForo_Helper_Http::getClient('http://www.paypal.com/cgi-bin/webscr');
			$validator->setParameterPost('cmd', '_notify-validate');
			$validatorResponse = $validator->request('POST');

			if (!$validatorResponse || $validatorResponse->getBody() != 'VERIFIED' || $validatorResponse->getStatus() != 200)
				$errorString = 'Request not validated';
				return false;
		catch (Zend_Http_Client_Exception $e)
			$errorString = 'Connection to PayPal failed';
			return false;

		if (strtolower($this->_filtered['business']) != strtolower(XenForo_Application::get('options')->payPalPrimaryAccount))
			$errorString = 'Invalid business';
			return false;

		return true;
In looking at this code it appears you need debug mode enabled to use the sandbox. Try enabling debug mode if you haven't already. Add this line to your library/config.php file:

$config['debug'] = 1;


Active member
The combination of this and the following thread helped me set up the test Paypal payments: http://xenforo.com/community/threads/test-your-account-upgrades-using-the-paypal-sandbox.9909/

However, I was running into an issue that still prevented Paypal from sending the IPN info to the site so I though i'd share if it will help anyone else.

I realized the IPN's were not getting to my site because the directory I was testing in was actually password protected and as soon as I removed the protection, everything worked fine.

It makes sense for people to test a new installation/sandbox under a password protected directory so others could possibly encounter this.