Webhook Signing
Webhook signing is a mechanism where the sender adds an HMAC signature of the payload to an HTTP header, and the receiver verifies the signature with a shared secret. Without signing, anyone who knows the webhook URL can send fake events. Standard pattern: HMAC-SHA256(secret, timestamp + body) → header X-Hub-Signature-256. Used by Stripe, GitHub, Telegram, YooKassa, Slack.
Below: details, example, related terms, FAQ.
Details
- HMAC algorithm: SHA-256 (standard). SHA-1 deprecated
- Payload: usually includes timestamp for replay protection
- Header name: not standardized — X-Signature, X-Hub-Signature-256, Stripe-Signature
- Timing-safe comparison:
hash_equals()in PHP,crypto.timingSafeEqual()in Node - Secret rotation: provider gives a grace period — 2 secrets valid concurrently
Example
// PHP verification
$expected = hash_hmac("sha256", $body, $secret);
$actual = $_SERVER["HTTP_X_SIGNATURE_256"];
if (!hash_equals($expected, $actual)) return 401;Related Terms
Why teams trust us
How it works
Enter site URL
Security headers analyzed
Get grade A–F
What Does the Security Analysis Check?
The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade fromA to F shows overall security level.
Header Analysis
Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.
SSL Check
TLS version, certificate expiry, chain of trust, HSTS support.
Leak Detection
Finding exposed server versions, debug modes, open configs, and directories.
Report with Recommendations
Detailed report explaining each issue with specific steps to fix it.
Who uses this
Security teams
HTTP header audit
DevOps
config verification
Developers
CSP & HSTS setup
Auditors
compliance checks
Common Mistakes
Strict-Transport-Security.Server: Apache/2.4.52 helps attackers find exploits. Hide the version.DENY or SAMEORIGIN.nosniff, browsers may misinterpret file types (MIME sniffing).Best Practices
Content-Security-Policy-Report-Only, monitor violations, then enforce.Server, X-Powered-By, X-AspNet-Version from responses.Get more with a free account
Security check history and HTTP security header monitoring.
Sign up freeLearn more
How-to
Frequently Asked Questions
Why HMAC instead of just a shared secret in a header?
A secret in a header travels in plain. HMAC signs the body; the secret is never transmitted.
Replay attack protection?
Timestamp + nonce in payload. Receiver confirms fresh timestamp (5 min window) and unused nonce.
Which providers use it?
Stripe (Stripe-Signature), GitHub (X-Hub-Signature-256), Slack (X-Slack-Signature), Telegram (X-Telegram-Bot-Api-Secret-Token), YooKassa.