WP Event Webhook Manager

WP Event Webhook Manager is a production-oriented plugin for managing signed outgoing webhooks from core WordPress events.

Features

• Multiple webhook endpoints per event
• Supported events:
  • user_register
  • publish_post
  • comment_approved
• Asynchronous delivery:
  • Action Scheduler (if available)
  • Fallback to WordPress Cron (wp_schedule_single_event)
• HMAC SHA256 request signing
• Retry policy: up to 3 retries, 60-second delay
• Delivery logging in custom DB table ({prefix}wem_logs)
• Replay failed deliveries from the Logs tab
• Delete disabled webhooks from the Webhooks tab
• Delete individual logs or filtered log sets from the Logs tab
• Export logs (all/success/failed filter scope) to CSV

Plugin Structure

wp-event-webhook-manager/
├── wp-event-webhook-manager.php
├── README.md
├── assets/
│   ├── css/admin.css
│   └── js/admin.js
└── includes/
    ├── class-wem-activator.php
    ├── class-wem-admin.php
    ├── class-wem-logger.php
    ├── class-wem-sender.php
    └── class-wem-webhook-manager.php

Architecture

• WEM_Plugin (bootstrap): loads and wires services.
• WEM_Activator: runs activation tasks and creates the wem_logs table.
• WEM_Webhook_Manager: stores webhook definitions and maps WordPress events into queueable payloads.
• WEM_Sender: queues async jobs, sends requests, handles retry logic, and replays failed logs.
• WEM_Logger: writes and reads delivery logs.
• WEM_Admin: renders admin UI and handles nonce-protected actions.

Security Model

• Direct file access is blocked (ABSPATH checks).
• Admin actions require manage_options capability.
• Nonces are enforced for save/toggle/replay operations.
• Destructive actions (delete webhook/delete logs) require nonce-protected POST actions.
• Input is sanitized (sanitize_key, sanitize_text_field, esc_url_raw, absint).
• Output is escaped (esc_html, esc_attr, esc_url).
• Signature comparisons use hash_equals() for timing-safe checks.

Async Delivery & Retry

1. Event handler captures context and builds event payload data.
2. Delivery is queued immediately using Action Scheduler or WP-Cron.
3. Sender signs payload with:
   • hash_hmac('sha256', $payload, $secret)
4. Request headers include:
   • Content-Type: application/json
   • X-Webhook-Signature
   • X-Webhook-Timestamp
   • X-Webhook-Version: v1
5. Failed deliveries are retried up to 3 times with a 60s delay.

Logging System

Table: {prefix}wem_logs

Required fields captured:

• id
• webhook_id
• event
• payload
• response_code
• response_body
• latency
• retries
• status
• created_at

Additional metadata:

• url
• request_headers
• source_log_id (for replay lineage)

Replay Behavior

• Replay is available for failed entries in the Logs tab.
• Replay uses the original payload from the selected log.
• Retry counter is incremented for replay attempts.
• Signature logic is preserved and checked against stored signature values.

Installation

1. Copy folder wp-event-webhook-manager into wp-content/plugins/.
2. Activate WP Event Webhook Manager in Plugins.
3. Go to Tools → WP Event Webhooks.
4. Add webhook endpoints and monitor logs.