| 开发者 | svtxvt1 |
|---|---|
| 更新时间 | 2026年9月11日 21:35 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
outhook_payload, outhook_should_send, and outhook_headers.
outhook-outbound-webhooks folder to /wp-content/plugins/ or install the ZIP in Plugins > Add New.When a secret is configured, the plugin sends X-Outhook-Signature as sha256= followed by the lowercase HMAC-SHA256 of timestamp + "." + raw_request_body. The timestamp is also sent in X-Outhook-Timestamp.
In an n8n Code node, Make code module, Zapier code step, or similar tool, the verification logic is:
expected = "sha256=" + HMAC_SHA256(secret, timestamp_header + "." + raw_body) accept only if constant_time_compare(expected, signature_header)
Use the exact raw request body, before parsing JSON. Also reject timestamps outside your acceptable time window to reduce replay risk.
Default requests are non-blocking, so WordPress does not wait for an HTTP response. Enable Reliable mode when you need an HTTP status and one retry.
No. It only sends newly occurring selected events.
Yes. Use outhook_payload to filter payload data, outhook_should_send to skip a matching endpoint, and outhook_headers to change request headers.