Webhooks allow Content Guard Pro to send real-time notifications to external services when security issues are detected. Use webhooks to integrate with monitoring tools, Slack, PagerDuty, or custom applications.

Enabling Webhooks #

1. Go to Content Guard Pro → Settings
2. Find the Notifications section
3. Check Enable Webhook
4. Enter your Webhook URL
5. Optionally set a Webhook Secret
6. Click Save Changes

Configuration Options #

Webhook URL #

The endpoint that receives POST requests:

https://your-service.com/webhook/content-guard

Requirements:

• Must be HTTPS (recommended for security)
• Must accept POST requests
• Must respond within 30 seconds

Webhook Secret #

Optional shared secret for request verification:

• Used to generate HMAC-SHA256 signature
• Sent in X-CGP-Signature header
• Allows recipient to verify authenticity

Severity Threshold #

Control which findings trigger webhooks:

Setting	Webhooks Sent For
———	——————-
Critical only	Only Critical findings (default)
Suspicious and above	Critical + Suspicious
All findings	All severity levels

Webhook Payload #

Headers #

Content-Type: application/json
X-CGP-Signature: sha256=abc123... (if secret configured)
X-CGP-Event: critical_finding
X-CGP-Site: https://yoursite.com

Body Structure #

{
  "site": {
    "url": "https://yoursite.com",
    "name": "Your Site Name",
    "blog_id": 1
  },
  "event": "critical_finding",
  "finding": {
    "id": 12345,
    "fingerprint": "abc123def456...",
    "severity": "critical",
    "confidence": 92,
    "rule_id": "ext_script_non_allowlist",
    "category": "external_resources",
    "object": {
      "type": "post",
      "id": 678,
      "field": "post_content",
      "title": "My Blog Post"
    },
    "summary": "External script from suspicious-domain.example",
    "matched_excerpt": "[script tag pointing to suspicious-domain.example]",
    "domain": "suspicious-domain.example",
    "first_seen": "2025-01-15T10:30:00Z",
    "last_seen": "2025-01-15T10:30:00Z"
  },
  "actions": {
    "review_url": "https://yoursite.com/wp-admin/admin.php?page=content-guard-pro-findings&finding=12345",
    "quarantine_url": "https://yoursite.com/wp-admin/admin.php?page=content-guard-pro-findings&action=quarantine&finding=12345"
  },
  "timestamp": "2025-01-15T10:30:05Z"
}

Verifying Webhook Requests #

Using the Signature #

If you configured a webhook secret, verify incoming requests:

PHP Example:

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_CGP_SIGNATURE'];
$expected = 'sha256=' . hash_hmac('sha256', $payload, $your_secret);
if (hash_equals($expected, $signature)) {
    // Request is authentic
    $data = json_decode($payload, true);
    // Process the webhook...
} else {
    // Invalid signature - reject
    http_response_code(401);
    exit;
}

Node.js Example:

const crypto = require('crypto');
function verifySignature(payload, signature, secret) {
    const expected = 'sha256=' + 
        crypto.createHmac('sha256', secret)
              .update(payload)
              .digest('hex');
    return crypto.timingSafeEqual(
        Buffer.from(expected), 
        Buffer.from(signature)
    );
}

Integration Examples #

Slack Integration #

Create a Slack incoming webhook and forward:

// Your webhook receiver
$cgp_data = json_decode(file_get_contents('php://input'), true);
$slack_message = [
    'text' => "🚨 Security Alert: {$cgp_data['finding']['severity']}",
    'attachments' => [[
        'color' => 'danger',
        'fields' => [
            ['title' => 'Site', 'value' => $cgp_data['site']['url']],
            ['title' => 'Finding', 'value' => $cgp_data['finding']['summary']],
            ['title' => 'Confidence', 'value' => $cgp_data['finding']['confidence'] . '%'],
        ],
        'actions' => [[
            'type' => 'button',
            'text' => 'Review Finding',
            'url' => $cgp_data['actions']['review_url']
        ]]
    ]]
];
// Send to Slack
file_get_contents('https://hooks.slack.com/services/YOUR/WEBHOOK/URL', false, 
    stream_context_create([
        'http' => [
            'method' => 'POST',
            'header' => 'Content-Type: application/json',
            'content' => json_encode($slack_message)
        ]
    ])
);

PagerDuty Integration #

$cgp_data = json_decode(file_get_contents('php://input'), true);
$pagerduty = [
    'routing_key' => 'YOUR_PAGERDUTY_KEY',
    'event_action' => 'trigger',
    'payload' => [
        'summary' => "Content Guard Pro: {$cgp_data['finding']['summary']}",
        'severity' => $cgp_data['finding']['severity'],
        'source' => $cgp_data['site']['url'],
        'custom_details' => $cgp_data['finding']
    ]
];
// Send to PagerDuty Events API

Retry Behavior #

If webhook delivery fails:

1. First attempt: Immediate
2. Retry 1: After 1 minute
3. Retry 2: After 5 minutes
4. Retry 3: After 15 minutes
5. Retry 4: After 1 hour
6. Final retry: After 4 hours

After 5 failed attempts, the webhook is marked as failed in the log.

Webhook History #

View webhook delivery history:

1. Go to Content Guard Pro → Settings
2. Scroll to Webhook section
3. Click View Webhook History

Shows:

• Timestamp of each attempt
• Success/failure status
• Response code
• Payload summary

Testing Webhooks #

Send Test Webhook #

1. Go to Settings
2. Click Send Test Webhook
3. Check your endpoint for the test payload

Test payload includes:

{
  "event": "test",
  "message": "This is a test webhook from Content Guard Pro",
  "timestamp": "2025-01-15T10:30:00Z"
}

Using RequestBin #

For testing without a server:
1. Create a bin at requestbin.com
2. Enter the URL as your webhook
3. Trigger a test
4. View the received payload

Troubleshooting #

Webhooks Not Firing #

1. Check enabled: Verify webhook is enabled in settings
2. Check severity: Finding may be below threshold
3. Check URL: Ensure URL is valid and accessible
4. Check firewall: Your server must allow outbound HTTPS

Signature Verification Failing #

1. Check secret: Ensure secrets match exactly
2. Check encoding: Use raw payload, not parsed JSON
3. Check algorithm: Must be HMAC-SHA256

Timeouts #

1. Reduce processing time: Webhook must respond within 30 seconds
2. Return 200 quickly: Process asynchronously if needed
3. Check server: Ensure endpoint is responsive