Webhook Security Best Practices

Protect your webhook endpoints from the 5 most common attacks with code examples and a manual checklist.

Why Webhook Security Matters

Webhooks are powerful, but they expose your server to incoming HTTP traffic from the internet. A misconfigured webhook endpoint can lead to:

• Financial losses — an attacker spoofs a "payment succeeded" event and your system ships products for free
• Data breaches — sensitive customer data in webhook payloads intercepted over unencrypted connections
• Infrastructure compromise — SSRF attacks pivot through your webhook handler to reach internal services
• Service disruption — replay floods overwhelm your handler, taking down your processing pipeline

The good news: every one of these attacks is preventable. Review the security checklist

The 5 Biggest Webhook Security Risks

Audit these risks manually

How to Verify Webhook Signatures

Signature verification is the single most important webhook security measure. Here's how to implement it for the two most popular languages:

Node.js (Express)

const crypto = require('crypto');

function verifyWebhookSignature(req, secret) {
  const signature = req.headers['x-webhook-signature'];
  const timestamp  = req.headers['x-webhook-timestamp'];

  // 1. Reject old timestamps (prevent replay attacks)
  const age = Math.abs(Date.now() / 1000 - parseInt(timestamp));
  if (age > 300) throw new Error('Timestamp too old');

  // 2. Compute expected signature
  const payload  = timestamp + '.' + req.body;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  // 3. Constant-time comparison (prevents timing attacks)
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )) {
    throw new Error('Invalid signature');
  }

  return true;
}

Python (Flask)

import hmac, hashlib, time

def verify_webhook(request, secret):
    signature = request.headers.get('X-Webhook-Signature')
    timestamp = request.headers.get('X-Webhook-Timestamp')

    # 1. Reject old timestamps (prevent replay attacks)
    if abs(time.time() - int(timestamp)) > 300:
        raise ValueError('Timestamp too old')

    # 2. Compute expected signature
    payload = f'{timestamp}.{request.data.decode()}'
    expected = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()

    # 3. Constant-time comparison (prevents timing attacks)
    if not hmac.compare_digest(signature, expected):
        raise ValueError('Invalid signature')

    return True

HTTPS Enforcement

Every webhook endpoint must use HTTPS. Here's a quick checklist:

• TLS 1.2+ — disable TLS 1.0 and 1.1. They have known vulnerabilities.
• Valid certificate — use Let's Encrypt or your provider's managed cert. Check expiry dates.
• HSTS header — add Strict-Transport-Security: max-age=31536000 to prevent protocol downgrades.
• Redirect HTTP — respond to port 80 with a 301 redirect to the HTTPS URL.

Most providers (Stripe, GitHub, Shopify) refuse to send webhooks to HTTP URLs. But if yours doesn't enforce this, you must.

IP Allowlisting

Many webhook providers publish the IP addresses they send from. Configure your firewall or reverse proxy to accept webhook traffic only from these ranges:

• Stripe: publishes IPs at https://stripe.com/files/ips/ips_webhooks.json
• GitHub: publishes IPs in the hooks field at https://api.github.com/meta
• Shopify: publishes IPs in their developer documentation

Rate Limiting

Even with signature verification, you should rate-limit your webhook endpoints:

• Per-source limits — cap the number of requests per minute from any single IP or provider
• Burst protection — use a token bucket algorithm to allow short bursts while capping sustained volume
• Queue-based processing — accept the request, enqueue it, and process asynchronously. This decouples ingestion from processing and prevents overload.
• Circuit breaker — if your handler starts failing, stop accepting new webhooks temporarily rather than building up a backlog of failures

Security Checklist

Use this checklist to audit your webhook endpoints:

• HMAC signature verified on every request
• Timestamp checked — reject requests older than 5 minutes
• HTTPS enforced — no plain HTTP endpoints
• TLS 1.2+ with a valid, non-expired certificate
• Source IP allowlisted to provider's published ranges
• Rate limiting in place (per-IP or per-source)
• Idempotency — duplicate event IDs are skipped
• SSRF protection — private IPs blocked on outbound URLs
• Sensitive fields redacted in logs
• Async processing — 200 OK returned within 3 seconds

Work through each item in staging and record the request, response, and configuration evidence for your review.

Related guides: What is a Webhook? · Webhook vs API · Retry Strategies

More: What is a Webhook? | All Features | Stripe Webhook Guide | Compare Tools