Security

Treat webhook URLs like passwords.

A webhook URL is a direct address for sending alerts to a Space. Keep it private and use it only in systems you trust.

Do not publish the URL

Avoid placing webhook URLs in public GitHub repos, screenshots, browser JavaScript, forum posts, or support tickets unless specifically requested.

Avoid sensitive information

Do not send passwords, payment card data, full private records, or unnecessary personal details. Send only what someone needs to act on the alert.

Prefer server-side sending

Use WordPress webhooks, backend code, n8n, Zapier, Make, or a same-origin proxy so the webhook URL is not visible to every website visitor.

Rotate if exposed

If a webhook URL is accidentally shared, replace it in the connected system and stop using the exposed URL.

Safer alert shape

{
  "title": "New lead",
  "message": "Call Taylor today",
  "leadId": "CRM-1042"
}

Link to the full record inside your CRM or admin tool instead of sending all details in the notification payload.

General webhook practices

  • Use HTTPS URLs only.
  • Limit who can access tools that store the webhook URL.
  • Keep test payloads free of real customer data.
  • Add retry limits so a broken workflow does not flood alerts.
  • Review connected systems after employee or contractor access changes.