Webhooks

Webhooks allow you to receive real-time notifications when ClickDefender detects suspicious or fraudulent activity. Configure up to 5 webhooks per property to integrate with your CRM, Slack, or custom systems.

Every webhook request includes an X-ClickDefender-Signature header containing an HMAC-SHA256 signature. Always verify this signature to ensure the request came from ClickDefender.

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// In your webhook handler:
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-clickdefender-signature'];
  const payload = JSON.stringify(req.body);

  if (!verifyWebhookSignature(payload, signature, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // Process the webhook...
  const event = req.body;
  console.log('Received:', event.event);

  res.status(200).send('OK');
});

import hmac
import hashlib

def verify_webhook_signature(payload: str, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

# In your Flask handler:
@app.route('/webhook', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-ClickDefender-Signature')
    payload = request.get_data(as_text=True)

    if not verify_webhook_signature(payload, signature, WEBHOOK_SECRET):
        return 'Invalid signature', 401

    event = request.json
    print(f"Received: {event['event']}")

    return 'OK', 200

1. Navigate to Property Settings

   Go to your property in the dashboard and click the Settings tab.

2. Open Webhooks Section

   Scroll down to the Webhooks section and click "Add Webhook".

3. Configure Your Webhook

   Enter your endpoint URL (must be HTTPS) and select which events to subscribe to.

4. Save the Secret

   Copy and securely store the webhook secret—it's only shown once.

5. Test Your Integration

   Use the "Send Test" button to verify your endpoint receives and processes webhooks correctly.

If your endpoint returns a non-2xx status code or times out (30 second limit), ClickDefender will retry the webhook with exponential backoff:

• 1st retry: 1 minute after initial failure
• 2nd retry: 5 minutes after 1st retry
• 3rd retry: 30 minutes after 2nd retry
• 4th retry: 2 hours after 3rd retry
• Final retry: 24 hours after 4th retry

After 5 failed attempts, the webhook delivery is marked as failed. You can view delivery history in your property settings.