Looks like that was it, I don’t remember ever enabling the setting and it hasn’t appeared in the past 2 months that stripe has been in test mode while I’ve been using my phone. Maybe I overreacted a bit since I saw some strange activity in the server logs with someone trying to brute force wp-login.php and then POSTs to xmlrpc.php from a bunch of foreign IP’s.
