WPM Tebex Webhooks

A small WordPress plugin that receives, validates, logs, and stores Tebex webhooks through a regular WordPress REST endpoint.

It is designed for self-hosted WordPress installations that need a transparent webhook receiver without hardcoded domains or secrets in source control. The plugin includes an administration page for endpoint configuration and diagnostics.

The endpoint domain is not hardcoded. WordPress generates it from the site where the plugin is installed. After installation, the settings page shows the exact endpoint for that WordPress site.

The endpoint path is:

https://your-wordpress-domain.example/wp-json/tebex/v1/webhook

Features

The plugin:

• receives Tebex webhooks
• verifies the Tebex X-Signature header
• verifies that the request IP matches the official Tebex webhook IPs
• responds correctly to validation.webhook
• stores valid events in the WordPress database
• logs diagnostic call metadata
• can purge diagnostic logs from the settings page
• returns 200 OK to Tebex for accepted events

Files

The actual plugin folder is:

wpm-tebex-webhooks/

It contains:

wpm-tebex-webhooks.php

Only this folder belongs in WordPress.

Upload As A Regular WordPress Plugin

Use this ready-to-upload ZIP file:

wpm-tebex-webhooks.zip

Do not upload the full desktop project folder. WordPress needs only the wpm-tebex-webhooks plugin folder.

Option 1: Upload ZIP In WordPress Admin

1. Use wpm-tebex-webhooks.zip.
2. Log in to WordPress.
3. Go to Plugins > Add New > Upload Plugin.
4. Upload the ZIP file.
5. Activate the plugin.

Important: The ZIP must contain the wpm-tebex-webhooks folder directly, not the outer desktop project folder and not a folder starting with UPLOAD-.

Option 2: Upload Via FTP Or Hosting File Manager

Upload only the inner wpm-tebex-webhooks folder to:

/wp-content/plugins/wpm-tebex-webhooks/

The final file path must be:

/wp-content/plugins/wpm-tebex-webhooks/wpm-tebex-webhooks.php

After uploading, go to Plugins in WordPress and activate WPM-Tebex-webhooks.

Because this is a regular plugin, you can disable it at any time from the WordPress Plugins page.

Where To Store The Secret

The Tebex webhook secret is not written into the PHP file.

After activating the plugin, configure it here:

WordPress Admin > Settings > WPM-Tebex-webhooks

The field is called:

Tebex Webhook Secret

Paste the secret from Tebex into that field.

You can find the secret in Tebex under:

Developers > Webhooks > Endpoints

Depending on the Tebex UI, it is shown when creating or editing the webhook endpoint.

Which Endpoint To Enter In Tebex

Use the endpoint shown on the plugin settings page:

WordPress Admin > Settings > WPM-Tebex-webhooks

It will look like this, with your own WordPress domain:

https://your-wordpress-domain.example/wp-json/tebex/v1/webhook

Tebex path:

Developers > Webhooks > Endpoints > Add Endpoint

Tebex should then send a validation.webhook. The plugin responds with the expected webhook ID.

Security

The endpoint is publicly reachable. That is normal for webhooks.

The plugin accepts only requests that pass both checks:

• request IP must match the official Tebex webhook IPs
• X-Signature must match the saved webhook secret

If no secret is saved, the plugin does not accept webhooks. Public error responses are intentionally generic.

Additional protections:

• only POST is allowed
• JSON must be valid
• payload size is limited to 1 MB
• request IP must be allowed
• X-Signature must be valid
• events are deduplicated by event_id
• payloads, secrets, and full signatures are not shown in the dashboard

The hardcoded Tebex webhook IP allowlist is:

18.209.80.3
54.87.231.232

If Cloudflare is in front of WordPress, the plugin validates CF-Connecting-IP. Otherwise it validates REMOTE_ADDR.

Diagnostics

The settings page shows the latest webhook attempt and a recent call list:

WordPress Admin > Settings > WPM-Tebex-webhooks

Important fields:

• result
• http_status
• event_type
• signature_header_seen
• signature_length
• remote_addr
• cf_connecting_ip
• validated_ip

Common results:

• validation_ok: Tebex validation succeeded.
• event_stored: A valid non-validation webhook was accepted and stored.
• invalid_ip: The validated IP was not in the Tebex allowlist.
• secret_missing: No webhook secret is saved in WordPress.
• invalid_signature: The request reached WordPress, but the signature did not match the saved secret.
• invalid_json: The request body was not valid JSON.
• payload_too_large: The request body exceeded the 1 MB limit.

The Recent Webhook Calls table shows the last 50 calls. Internally, the plugin keeps at most 200 diagnostic calls and removes older entries automatically. The settings page also includes a purge button to delete all diagnostic call logs and the last-attempt summary without deleting stored valid webhook events.

Diagnostic calls are stored in:

wp_wpm_tebex_webhook_calls

If your WordPress table prefix is different, the table name starts with that prefix instead.

Where Valid Webhooks Are Stored

The plugin creates this WordPress database table:

wp_wpm_tebex_webhooks

If your WordPress installation uses a different table prefix, the table name changes accordingly, for example:

xyz_wpm_tebex_webhooks

Stored fields:

• event_id
• event_type
• full JSON payload
• creation timestamp

The dashboard history uses this separate diagnostic table:

wp_wpm_tebex_webhook_calls

That table does not store payloads, secrets, or full signatures.

Secret Handling

The secret is stored in the WordPress options table under:

wpm_tebex_webhook_secret

The plugin does not render the saved secret into the password field. The field stays empty after saving. If you submit the settings page with the secret field empty, the existing secret is kept.

The dashboard only shows whether a secret is set. It does not show the secret value or its length.

What Happens When The Plugin Is Deactivated

If you deactivate the plugin in WordPress:

• the webhook endpoint is no longer active
• Tebex can no longer validate or deliver to that endpoint
• stored database data remains
• the saved secret remains in WordPress

This is useful if you want to reactivate the plugin later.