Overview

The Webhook Notifications feature of Wordfence’s Vendor Vulnerability Management Portal sends out real-time JSON payloads containing data about events relating to vulnerabilities in WordPress software registered and verified in your Vendor account. Each payload is secured with HMAC using SHA-256 as the signing algorithm to ensure the authenticity and integrity of the data.

Webhook Setup

Endpoint Configuration

• Log into wordfence.com.
• Navigate to “Manage Vulnerabilities” from the Account menu.
• In your portal, navigate to the “Notifications & Webhooks” tab.
• Click on “Add Webhook”, and complete the information below.

URL

Enter the target URL where the JSON payload will be sent as a POST request.

Secret

The secret key is used to generate the HMAC signature. Please ensure the secret key is securely stored and not shared.

• Generate a strong secret key, either manually (we recommend at least 32 characters long) or using the Generate button to create a random key.
• Save the key securely.
• Remember to use the secret key in your webhook processor to validate the authenticity of the webhook payload (see HMAC Signature section below)

Send this webhook in an appropriate format for use on Slack

If this checkbox is checked, the payload will be sent in a format that is more human-friendly, for use on Slack. Note that if this option is checked, your URL must start with https://hooks.slack.com or https://hooks.slack-gov.com.

To get the correct URL for Slack, you will need to configure an “incoming webhook” on your Slack instance. See the Slack documentation for more information.

Enable/Disable the Webhook

You can turn the webhook notification on or off using this toggle. Disabled webhooks will not send notifications, but can be left configured in the portal to be enabled at a later date.

Select Events

You can now configure the events that will trigger this webhook. The events available are:

Click the Create Webhook button to save your webhook. If you chose to enable it, it will immediately be active.

Verifying the Webhook (with HMAC Signature)

Note: This step is not necessary for Slack-formatted notifications.

Each outgoing webhook payload has a signature generated using HMAC with the SHA-256 algorithm and the Secret you defined on the webhook. This signature is sent in the 'X-Wordfence-Signature' HTTP header.

To verify the signature, you should:

• Use the secret key to compute the HMAC of the received payload.
• Compare the computed HMAC with the value in the 'X-Wordfence-Signature' HTTP header.
• If the values match, the payload is verified.

Structure of the Webhook Payload

Note: This structure does not apply to Slack-formatted notifications.

The payload sent via the webhook is a JSON object with the following structure:

{
    "event": "new-vulnerability",
    "event_date": "2025-06-01T10:45:00+00:00"
    "vulnerability_id": "00000000-0000-0000-0000-000000000001",
    "vulnerability_name": "Example Vulnerability",
    "cvss_score": 7.2,
    "cvss_rating": "high",
    "software": [
        {
            "name": "Example Plugin",
            "slug": "example-plugin",
            "type": "plugin"
        }
    ],
    "link": "https://www.wordfence.com/threat-intel/vendor/vulnerability-report/00000000-0000-0000-0000-000000000001"
}

Where:

• event: The type of event (see list above)
• event_date: The date and time that the event occurred, as an ISO-8601 date string.
• vulnerability_id: The ID of the vulnerability report, as a UUID.
• vulnerability_name: The name/title of the vulnerability report.
• cvss_score: If available, our calculated CVSS score (CVSS v3.1) for the vulnerability.
• cvss_rating: The severity of the vulnerability, based on the score. Can be low, medium, high, or critical.
• software: An array of software packages affected by the vulnerability. Each package will detail its name, its slug, and the type (plugin or theme)
• link: The URL to the vulnerability report in your portal, if applicable.

Example Code for Signature Verification in PHP

<?php

$secretKey = $_ENV['WORDFENCE_INTELLIGENCE_SECRET_KEY'];
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WORDFENCE_SIGNATURE'];
$verified = hash_equals(hash_hmac('sha256', $payload, $secretKey), $signature);
if ($verified) {
    // Process webhook payload.
}

Conclusion

The webhook feature of the Vulnerability Management Portal enables you to stay up to date on important events relating to vulnerabilities in your software in real time. Remember to always validate the HMAC signature to ensure you are receiving authentic information.