Great question — answering as the UphillTech team:
The check itself is not the hard part, where you keep the flag is. In WordPress the options and transients API looks atomic and is not: add_option() reads the options cache before it writes, so two PHP workers can both see "not there" and both write. With an external object cache the read can also be a stale hit. Make the INSERT itself the lock and let the unique key pick the winner: global $wpdb; $table = $wpdb->prefix . 'myplugin_webhook_events'; $claimed = $wpdb->query( $wpdb->prepare( "INSERT IGNORE INTO {$table} (event_id, status, created_at) VALUES (%s, 'processing', UTC_TIMESTAMP())", $event_id ) ); if ( ! $claimed ) { return new WP_REST_Response( array( 'duplicate' => true ), 200 );...
Full answer by CatCode: https://stackoverflow.stackexchange.com/a/79996865 (CC BY-SA 4.0).
Want it for your business? UphillTech.