Webhook Actions by Flow Systems

Description

Operate WordPress like modern infrastructure — turn any WordPress do_action into a first-class automation trigger your CRMs, n8n flows, AI agents, and internal services can consume.

📖 Full documentation at wpwebhooks.org/docs/

Core features (free)

  • Persistent delivery queue with smart retry and exponential backoff — powered by WP-Cron, auto-upgrades to Action Scheduler or System Cron when available, (Pro) External Cron for guaranteed reliability
  • Per-event UUID and ISO 8601 timestamp — enable downstream deduplication
  • Delivery logs with full attempt history, request/response inspection, replay, and bulk retry
  • Synchronous execution mode — fire inline without queue delay
  • Payload mapping — rename, restructure, exclude, and type-cast fields with dot-notation paths
  • Conditional dispatch — filter events by payload field values before dispatch
  • HTTP method, custom headers, and URL query parameters per webhook
  • Dynamic endpoint URLs — {{ field.path }} placeholders resolved at dispatch time (free via fswa_webhook_url filter)
  • Webhook Chains — wire 2xx completions to downstream webhooks with full observability
  • Credentials Vault — store reusable auth secrets (Bearer, Basic, API key, custom) encrypted at rest; reference them from webhooks instead of pasting raw Authorization headers. Secrets are write-only over the API — never returned, only a masked hint
  • Activity History — persistent audit log of every admin and API-token action
  • Built-in CF7 and IvyForms integrations — structured payloads, no extra plugins
  • Action Scheduler auto-detection — more reliable delivery on high-traffic sites
  • Full REST API with scoped API token authentication (read / operational / full / agent) — the agent scope grants full write access for AI assistants while never exposing stored secrets
  • Developer extensibility — 16 filters and 7 action hooks (reference)

Pro features

  • Code Glue — attach PHP snippets to any webhook+trigger (pre-dispatch payload enrichment, post-dispatch side effects)
  • External Cron — replace unreliable visitor-triggered WP-Cron with a managed external pinger, provisioned automatically on license activation. Two modes: plugin queue endpoint (down to 20 s interval, configurable batch size) or WP-Cron endpoint (60 s, covers all WordPress background work). No server crontab or external dashboard — controlled entirely from wp-admin, with a live heartbeat chart and inline error alerts
  • Unlimited conditions per trigger with AND/OR groups
  • Per-webhook retry limit and backoff strategy overrides
  • Dynamic URL templates — {{ }} syntax with no custom PHP required

See pricing and upgrade

Examples

Screenshots

Installation

  1. Upload the plugin files to the /wp-content/plugins/flowsystems-webhook-actions directory, or install the plugin through the WordPress plugins screen.
  2. Activate the plugin through the ‘Plugins’ screen in WordPress.
  3. Navigate to Webhook Actions in the admin menu.
  4. Add your webhook endpoint URL and select the desired WordPress action triggers.

FAQ

Is this plugin free?

Yes. The core plugin is completely free and licensed under GPL. Webhook Actions Pro is an optional paid upgrade that adds unlimited conditions, per-webhook retry and backoff settings, Code Glue snippets, External Cron (activated automatically on license activation), and more. Learn more

Does it work with WooCommerce, n8n, Make, Zapier, and AI agents?

Yes. Any WordPress or WooCommerce action can be a trigger. The plugin delivers to any HTTP endpoint — n8n, Make, Zapier webhook nodes, internal services, or AI agent APIs. Scoped API tokens let Claude Code, Cursor, or any automation tool read logs, retry deliveries, and toggle webhooks without WordPress credentials.

Do I need extra plugins for Contact Form 7 or IvyForms?

No. Both integrations are built in. When CF7 or IvyForms is active, submissions are automatically normalized into clean JSON payloads — no additional plugins or custom code required.

How does retry work?

5xx and 429 responses retry automatically with exponential backoff (delays of ~30s, 60s, 120s, 240s, 480s, capped at 1 hour). 4xx and 3xx responses are marked permanently_failed immediately — bad payloads are not worth retrying. Default maximum is 5 attempts; override with the fswa_max_attempts filter or (Pro) per-webhook settings.

Can I access the REST API without a WordPress login?

Yes. Create a token from the API Tokens screen and pass it as X-FSWA-Token: <token> (or Authorization: Bearer). Three scopes available — read, operational, full — so you can grant exactly the access each integration needs. Full API reference at wpwebhooks.org/webhook-wordpress-plugin-api/

Reviews

March 5, 2026 1 reply
Solid plugin. Super easy to set up and it just works. If you need reliable webhooks this makes the whole process a lot easier.
February 19, 2026 1 reply
Used it in WooCommerce project, async processing works well and retry logic saved us from silent webhook failures.
Read all 2 reviews

Contributors & Developers

“Webhook Actions by Flow Systems” is open source software. The following people have contributed to this plugin.

Contributors

Changelog

For the full release history see wpwebhooks.org/changelog/

1.15.0 — 2026-06-07

  • New: Credentials Vault — store reusable authentication secrets (Bearer token, Basic auth, API key, custom header) encrypted at rest with AES-256-GCM, and reference them from webhooks via a saved credential instead of a raw Authorization header
  • New: Write-only secrets — vault values are never returned by the REST API; only a masked hint is shown. Decrypted only at dispatch time to build the outgoing header
  • New: agent API token scope — full write access (create/update/delete webhooks and credentials) for AI assistants, but can never reveal auth headers or vault secrets
  • New: FSWA_SECRET_KEY wp-config constant (optional) — move the encryption key out of the database for stronger protection, with a one-click in-app migration that re-encrypts existing credentials and removes the database key
  • New: “Save to vault” action on the webhook form — migrate an existing manual Authorization header into the vault in one step
  • Improved: Resolved Authorization/custom auth headers are redacted in delivery logs
  • Developer: New REST endpoints under /fswa/v1/credentials (CRUD, key-status, reencrypt); webhooks accept an auth_credential_id reference