Title: WebEquipe Webhook Manager Author: WebEquipe Published: 24 Jolay 2026 Last modified: 14 Septambra 2026 --- Search plugins ![](https://ps.w.org/webequipe-webhook-manager/assets/banner-772x250.png?rev=3621879) ![](https://ps.w.org/webequipe-webhook-manager/assets/icon-256x256.png?rev=3621879) # WebEquipe Webhook Manager By [WebEquipe](https://profiles.wordpress.org/webequipe/) [Download](https://downloads.wordpress.org/plugin/webequipe-webhook-manager.1.2.0.zip) * [Details](https://mg.wordpress.org/plugins/webequipe-webhook-manager/#description) * [Reviews](https://mg.wordpress.org/plugins/webequipe-webhook-manager/#reviews) * [Installation](https://mg.wordpress.org/plugins/webequipe-webhook-manager/#installation) * [Development](https://mg.wordpress.org/plugins/webequipe-webhook-manager/#developers) [Support](https://wordpress.org/support/plugin/webequipe-webhook-manager/) ## Description **Watch: Full Plugin Walkthrough** WebEquipe Webhook Manager captures events from forms, WooCommerce, and any WordPress action hook, then delivers normalized JSON (or form-encoded) payloads to one or more webhook endpoints you define. It is built around two concepts: * **Connections** — reusable destinations. You set a URL, method, content type, and how to authenticate. Extra headers, Advanced HMAC options, and More settings stay on the same screen. * **Webhooks** — rules that map a trigger (a form submission, a WooCommerce event, or a WordPress action hook) to one or more connections, with optional payload shaping and conditions. **Key features** * Triggers: form submissions (Contact Form 7, WPForms, Fluent Forms, Formidable Forms, Ninja Forms), WooCommerce events, and any WordPress action hook (with an on-demand hook picker). * Payload shaping: send all fields, pick a subset, or remap field keys; add static fields as name/value rows; apply per-field transforms from a type dropdown. * Conditional delivery: only send when field conditions match (AND/OR), using field and operator dropdowns. * Authentication on each connection: - **None** — URL is enough (many catch hooks). - **Bearer / JWT token** — sends `Authorization: Bearer …` (paste the token or JWT; do not type `Bearer` yourself). - **Username and password** — two fields; sends HTTP Basic (`Authorization: Basic …`). Use this for n8n Basic Auth. - **Sign each request** — HMAC with a signing secret and a signature pattern. - **Header-style API keys** (for example n8n Header Auth) — Auth None, then put the exact header name and value under **Extra headers**. * Signature patterns (WebEquipe default, Timestamp + signature, Sign the raw body, Timestamp + prefixed signature, Custom) fill Extra headers when needed. Rename header names there to match your API. Pattern labels are generic. * Help is a document with worked curl examples. **See example** on the connection screen shows a sample request. * Delivery logging with request/response capture, replay, and CSV export. * Dashboard with delivery stats and recent activity. * Secrets (auth tokens, signing secrets) are encrypted at rest. This plugin does not connect to any WebEquipe service. It only sends data to the endpoints **you** configure. ### Getting Started 1. **Create a connection.** Webhook Manager Connections Add Connection. 2. * Enter a name and the destination URL (a request-bin URL is fine for testing). Set method and content type. * Choose **How should we authenticate?** - **None** — for open URLs, or when you will send a custom header under Extra headers (n8n Header Auth: exact name + value). - **Bearer / JWT token** — paste the API token or JWT in Auth Token. - **Username and password** — fill Username and Password (n8n Basic Auth). The plugin Base64-encodes them for HTTP Basic. - **Sign each request** — pick a signature pattern and paste the signing secret( shared HMAC key, not a header). * Patterns that need headers (for example Timestamp + signature) fill **Extra headers** with values like `{{unix}}` and `{{hmac}}`. Rename the left-column names to match your API (for example `X-Relava-Timestamp`). Use Insert token for other tokens. Do not set Content-Type here. * Click **See example** (eye) for a sample on this screen. Click **More in Help**( book) for worked curl examples. * Save, keep it Active, and use **Test Connection** if you want. Check Request/ Response: a 401/403 with `www-authenticate: Basic` means the endpoint wants Username and password, not a raw Authorization Extra header. 3. **Create a webhook.** Webhook Manager Webhooks Add Webhook. 4. * Step 1: name the webhook. * Step 2: choose a trigger (Form submission, WooCommerce event, WordPress action hook, or Manual). WordPress action hook is a list of built-in events. Manual can type any hook or use **Choose hook** to scan installed plugins. * Steps 3–5 unlock after fields are known (immediately for WooCommerce and built- in WordPress events; after the first real delivery for most forms). * Payload: All fields, Pick fields, or Map & rename. Static fields are name/value rows (**Add field**). Transforms: pick a field, pick a type (lowercase, prefix, date format, …); a parameter appears only when that type needs one. Conditions: field, operator, and value (**Add condition**). Each of these has **See example**/** More in Help** and an optional Edit as text fallback. * Step 6–8: choose one or more connections, set delivery options, and enable the webhook. 5. **Test it.** Use **Send Test** on the webhook (or **Test Connection** on the connection). Connection Test sends a small sample (`event` + `data.test`), not a real form lead— a 422 from an API that requires name/email can still mean the URL and signature were accepted. Then fire the real event and review **Logs**. ### Troubleshooting * **Test says “could not reach the server”.** Verify the URL is correct and reachable from your server (from Docker/local WordPress, `localhost` is the container — use `host.docker.internal` to reach an API on your Mac). Check the Logs screen for the captured response. * **401 / 403 Authorization data is wrong.** Match the auth mode to the destination: Basic realm responses need Username and password; Header Auth needs Extra headers with the exact name/value; Bearer/JWT needs Bearer / JWT token. * **No log entries appear.** Confirm the webhook is enabled, the trigger/source matches the event, and at least one connection is selected. * **GET requests.** A request body is not sent with GET/HEAD requests; use POST/ PUT/PATCH to send a body. * **Deliveries are slow.** Reduce the connection timeout, or enable asynchronous delivery in Settings. ### Privacy This plugin stores and transmits data that may include personal information: * **Delivery logs** may contain submitted form field values (which can include names, email addresses, and other personal data), the request URL, request/response headers, and request/response bodies. Some triggers (for example Contact Form 7) may include the submitter’s IP address and user agent. * **Outbound payloads** are sent to the third-party endpoints you configure. The contents and the receiving party are entirely under your control. * **Stored secrets** (authentication tokens and HMAC signing secrets) are encrypted at rest. You control retention via the log retention setting, and you can permanently remove all plugin data on uninstall by enabling “Remove all data on uninstall” in Settings before deleting the plugin. Because payloads are delivered to external services that you choose, review those services’ privacy practices and disclose them in your own site’s privacy policy as needed. ### Third-Party Services This plugin does not bundle or call any predefined third-party service. It transmits data only to the webhook endpoint URLs that the site administrator configures. You are responsible for the terms and privacy policy of any endpoint you send data to. ## Screenshots [⌊Dashboard with delivery stats and recent activity.⌉⌊Dashboard with delivery stats and recent activity.⌉[ Dashboard with delivery stats and recent activity. [⌊Connections list.⌉⌊Connections list.⌉[ Connections list. [⌊Webhook editor.⌉⌊Webhook editor.⌉[ Webhook editor. [⌊Logs with replay and CSV export.⌉⌊Logs with replay and CSV export.⌉[ Logs with replay and CSV export. [⌊Connection signing and Extra headers (HMAC tokens).⌉⌊Connection signing and Extra headers (HMAC tokens).⌉[ Connection signing and Extra headers (HMAC tokens). [⌊Webhook Map & rename with static fields.⌉⌊Webhook Map & rename with static fields .⌉[ Webhook Map & rename with static fields. [⌊Conditional delivery rules and transforms.⌉⌊Conditional delivery rules and transforms .⌉[ Conditional delivery rules and transforms. [⌊Log detail with request and response payload.⌉⌊Log detail with request and response payload.⌉[ Log detail with request and response payload. [⌊In-plugin Help with worked examples.⌉⌊In-plugin Help with worked examples.⌉[ In-plugin Help with worked examples. [⌊Choose-hook modal for scanning installed plugins.⌉⌊Choose-hook modal for scanning installed plugins.⌉[ Choose-hook modal for scanning installed plugins. ## Installation 1. Upload the plugin to `/wp-content/plugins/` or install it from the Plugins screen, then activate it. 2. Go to **Webhook Manager Connections** and add a connection (URL and how to authenticate). Use **See example** if you need a sample request. 3. Go to **Webhook Manager Webhooks** and add a webhook: choose a trigger, pick connection( s), then (optionally) shape the payload with field mode, static fields, transforms, and conditions. 4. Use the **Test Connection** / **Send Test** buttons to confirm delivery. 5. Trigger the real event and confirm a success entry under **Webhook Manager Logs**. ## FAQ ### Which form plugins are supported? Contact Form 7, WPForms, Fluent Forms, Formidable Forms, and Ninja Forms. WooCommerce events and arbitrary WordPress action hooks are also supported. ### How do I verify the HMAC signature on the receiving end? On the connection, choose **Sign each request** and a signature pattern, then paste the signing secret (the shared key — not a header). WebEquipe default sends `X-WEWM-Signature: t=, v1=`. Recompute `hash_hmac(' sha256', "$t.$rawBody", $secret)` and compare it to `v1` using a constant-time comparison. Timestamp + signature fills Extra headers with defaults `X-Timestamp` / `X-Signature`(`{{ unix}}` / `{{hmac}}`). Values are a unix timestamp and HMAC-SHA256 of `timestamp. body`. Rename the header names in Extra headers if the API asks for something else( for example `X-Relava-Timestamp`). For other APIs, put `{{unix}}` / `{{hmac}}` in Extra headers (or pick a signature pattern), and set the signed string under Advanced options if needed. **See example** and **Help** show the matching curl. ### How do I set up n8n (or similar) authentication? * **Basic Auth** in n8n in this plugin choose **Username and password** and enter both fields. Do not put the password in Extra headers as a raw `Authorization` value. * **Header Auth** in n8n choose **None**, open **Extra headers**, and add the exact header name and value from n8n. * **Bearer / JWT** choose **Bearer / JWT token** and paste the token. Rare custom JWT headers (`X-Access-Token`, `Authorization: JWT …`) use Extra headers with Auth None. ### Does the plugin send my data anywhere by default? No. Payloads are sent only to the connection URLs you configure. Nothing is sent to the plugin author. ### Where are delivery logs stored? In custom database tables in your own WordPress database. You can set a retention period and export or replay logs from the Logs screen. ### Does it provide shortcodes or blocks? No. The plugin is configured entirely from the WordPress admin and does not register shortcodes or blocks. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “WebEquipe Webhook Manager” is open source software. The following people have contributed to this plugin. Contributors * [ WebEquipe ](https://profiles.wordpress.org/webequipe/) * [ Sarwar Hossain ](https://profiles.wordpress.org/bdsarwar/) [Translate “WebEquipe Webhook Manager” into your language.](https://translate.wordpress.org/projects/wp-plugins/webequipe-webhook-manager) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/webequipe-webhook-manager/), check out the [SVN repository](https://plugins.svn.wordpress.org/webequipe-webhook-manager/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/webequipe-webhook-manager/) by [RSS](https://plugins.trac.wordpress.org/log/webequipe-webhook-manager/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.0 * Connection editor: How should we authenticate? — None, Bearer / JWT token, Username and password (separate fields), or Sign each request, with signature patterns on the same screen. * Extra headers are name/value rows with Add header and Insert token ({{unix}},{{ uuid}}, {{hmac}}, …). Signature patterns that need headers fill Extra headers; rename names there to match your API. * HMAC signing is configurable (signed string, algorithm, encoding). See example shows a sample request; More in Help opens worked curl examples. Pattern labels are generic. * Webhook static fields, transforms, and conditions use Add-row controls and dropdowns( with Edit as text still available). * Existing connections that only set a signing secret still send X-WEWM-Signature as before. Existing webhook JSON is unchanged. #### 1.0.4 * Deleting a webhook now asks for confirmation before removing it — no more accidental deletions. * Added a Delete button directly on the webhook detail page. * Bulk-deleting webhooks shows a clear warning before anything is removed. * Each webhook and connection now has its own detail page so you can review everything at a glance. * The connection tester now shows the full request and response, making it much easier to debug delivery issues. * Webhook and connection lists are now searchable — just start typing to filter. * Delivery log entries now display the full request and response in a readable, copyable format. * Dashboard now includes a 7-day delivery chart and a daily activity sparkline. * Action-hook webhooks now capture much richer data automatically (post details, user info, order data, and more). * Easier hook discovery — scan your installed plugins for available hooks directly from the webhook editor. * Fix: testing or sending via a GET connection no longer causes an error. * Fix: the Test button no longer gets stuck on “Testing…” when an endpoint is slow or unreachable. #### 1.0.3 * Logs CSV export now matches the on-screen Logs list columns (ID, Date, Webhook, Source, Trigger, Connection, Status, HTTP), including the resolved webhook name and trigger label. * Fix: Logs CSV export could return only the header row (no data) on some hosts; the filtered log query now uses the same reliable query style as the log list. #### 1.0.2 * Security: file publishing (URL file mode) enforces a MIME/extension allowlist before copying uploads to the public uploads folder; unknown types and executable/ script files (php, phtml, phar, exe, js, svg, html, …) are rejected. * Fix: Logs list and detail always query the database directly (no stale object- cache empty lists). * Fix: action-hook logs match hook-name filters; list queries no longer depend on a JOIN to wewm_webhooks. * Fix: default Logs list uses a direct paginated DB query (same reliability as log detail view). * Fix: webhook detail Logs tab uses direct webhook_id queries instead of the complex filter SQL. * Fix: delivery logging auto-recovers when enable logging was accidentally stored off on new installs. * Admin warning on the Logs screen when delivery logging is disabled in Settings. #### 1.0.1 * Form save validation for webhooks and connections (server-side and client-side). * Admin error notices when required fields are missing on save. * Manual trigger label updated to “Manual” (was “Manual / test”). * Delivery logs redact sensitive request/response headers (Authorization, X-WEWM- Signature, API keys). * Log settings now enforced: enable logging, payload snapshots, and response snippets. * WordPress.org compliance: conditional asset loading, no inline admin CSS, sanitized webhook validation input. * Fix: delivery logging no longer silently stops when enable logging was stored off before 1.0.1; connection tests now create log entries. * Fix: fresh installs auto-create log tables, correct logging checkbox saves, and show pending log rows for async deliveries. #### 1.0.0 * Initial release. ## Meta * Version **1.2.0** * Last updated **4 andro ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.0.5** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/webequipe-webhook-manager/) * Tags * [automation](https://mg.wordpress.org/plugins/tags/automation/)[forms](https://mg.wordpress.org/plugins/tags/forms/) [integration](https://mg.wordpress.org/plugins/tags/integration/)[webhook](https://mg.wordpress.org/plugins/tags/webhook/) [woocommerce](https://mg.wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://mg.wordpress.org/plugins/webequipe-webhook-manager/advanced/) ## Ratings Mbola tsy misy domberina voaray hatreto. [Your review](https://wordpress.org/support/plugin/webequipe-webhook-manager/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/webequipe-webhook-manager/reviews/) ## Contributors * [ WebEquipe ](https://profiles.wordpress.org/webequipe/) * [ Sarwar Hossain ](https://profiles.wordpress.org/bdsarwar/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/webequipe-webhook-manager/)