Failed payment, grace period and expiring card aren't the same risk

Lumping every payment problem into one "at risk" bucket is how stores lose track of what actually needs a human. Subscription Health Check scores three distinct situations, each one with its own trigger, its own severity logic and its own lookback window.

Failed payment — retries are already exhausted

WooCommerce moves a subscription to on-hold once its retry schedule runs out with nothing succeeding. By the time that happens, the automatic recovery window has already closed, so the plugin always scores this Critical — it needs a person, not another retry. One nuance: an on-hold subscription with zero recorded retry attempts is treated as healthy rather than flagged, since that combination usually means the subscription hasn't actually failed yet. A 12-month lookback (default) keeps very old failures out of new alerts.

Grace period — still active, still retrying

A subscription in its grace window is still active and WooCommerce is still attempting to collect. Severity here climbs with days elapsed — Info, then Warning at 3 days, then Critical at 7 (both configurable) — rather than being fixed at one level. Its lookback window defaults to 6 months.

Expiring card — a problem that hasn't happened yet

This one is different: it's not reacting to a failure, it's predicting one. The plugin compares the saved card's expiry to the subscription's next renewal date. If that card would no longer be valid by then, it's flagged — always Critical, because the fix (updating the card) needs to happen before the charge attempt, not after. The comparison only fires when renewal is due within a configurable window (30 days by default). If a subscription has no next-payment date on file, the plugin falls back to flagging already-expired or near-expiry cards directly, subject to a 3-month lookback.

Why non-card gateways don't show up here

Expiring-card detection depends on reading a saved payment token's expiry date. Gateways like PayPal don't store that kind of token, so subscriptions paying that way simply never enter this particular risk check — they're still covered by the failed-payment and grace-period checks, which don't depend on card data at all.