Description
Outhook Outbound Webhooks sends compact JSON payloads when selected events happen on your site. It works with n8n, Make, Zapier, and any service that accepts HTTP requests.
Configure up to 10 endpoints under Settings > Outbound Webhooks. Each endpoint can have its own events, public post types, signing secret, and delivery mode.
Events:
- Post published, updated, or trashed.
- Comment posted or approved.
- User registered.
Default delivery is non-blocking. Reliable mode waits up to five seconds and schedules one retry with WP-Cron after five minutes when delivery fails. The delivery log keeps the latest 50 results.
Payloads never include comment email addresses, IP addresses, or user email addresses by default. User email can be enabled per endpoint.
Developer filters: outhook_payload, outhook_should_send, and outhook_headers.
Privacy
This plugin sends selected site event data to the HTTPS endpoints configured by an administrator. It does not contact any service by itself and includes no telemetry, tracking, remote code, or upsell.
Post payloads can contain public post content and author display names. Comment payloads contain the comment author name and content, but never the comment email address or IP address. User registration payloads exclude email by default; an administrator may opt in per endpoint. Review the receiving service’s privacy terms and configure data retention appropriately.
The latest 50 delivery results are stored in the WordPress database. Uninstalling the plugin deletes endpoint settings and the delivery log.
Installation
- Upload the
outhook-outbound-webhooksfolder to/wp-content/plugins/or install the ZIP in Plugins > Add New. - Activate Outhook Outbound Webhooks.
- Open Settings > Outbound Webhooks.
- Add an HTTPS endpoint, select events, and save.
- Use Send test event to verify the connection.
FAQ
-
How is a request signed?
-
When a secret is configured, the plugin sends
X-Outhook-Signatureassha256=followed by the lowercase HMAC-SHA256 oftimestamp + "." + raw_request_body. The timestamp is also sent inX-Outhook-Timestamp.In an n8n Code node, Make code module, Zapier code step, or similar tool, the verification logic is:
expected = "sha256=" + HMAC_SHA256(secret, timestamp_header + "." + raw_body) accept only if constant_time_compare(expected, signature_header)Use the exact raw request body, before parsing JSON. Also reject timestamps outside your acceptable time window to reduce replay risk.
-
Why does the default log say Queued?
-
Default requests are non-blocking, so WordPress does not wait for an HTTP response. Enable Reliable mode when you need an HTTP status and one retry.
-
Does the plugin send old content when activated?
-
No. It only sends newly occurring selected events.
-
Can I change a payload or skip a delivery?
-
Yes. Use
outhook_payloadto filter payload data,outhook_should_sendto skip a matching endpoint, andouthook_headersto change request headers.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Outhook Outbound Webhooks” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Outhook Outbound Webhooks” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
- Initial release.