Webhooks
13 hooks fired by Webhooks: 12 filters and 1 actions across 17 call sites.
13 hooks fired by Webhooks: 12 filters and 1 actions across 17 call sites. 13 of the 17 call sites are described by a docblock, at the call or on the constant that names the hook; the rest are listed with their signature and call sites only. Paths are relative to the plugin directory.
http_allowed_safe_ports
Filter · 3 arguments · 1 call site
Filters the ports a webhook URL may name, mirroring WordPress core.
This is core's own filter, fired here so the URL is validated against the same list core will apply when the request is actually sent. Without it a URL naming any other port saves, then fails inside core as a transport error, which classifies transient and burns all five retries over two and a half hours on a request that can never succeed.
A URL with no explicit port skips the check entirely.
apply_filters( 'http_allowed_safe_ports', [80, 443, 8080], $parts['host'], $url )$ports(int[]) — Allowed ports. Default[80, 443, 8080].$host(string) — Host from the configured URL.$url(string) — The configured URL.
Fired from:
packages/Webhooks/Addon.php:1550
http_request_host_is_external
Filter · 3 arguments · 1 call site
apply_filters( 'http_request_host_is_external', false, $host, $url )Fired from:
packages/Webhooks/Addon.php:1704
xpac-forms-after-settings-modal-content
Filter · 3 arguments · 1 call site
Content appended inside a settings panel's item modal.
applyFilters( 'xpac-forms-after-settings-modal-content', [], { value: options, onChange: onUpdate, }, 'xpac-webhooks' )Fired from:
assets/packages/webhooks/Components/Modal.js:574
xpac_forms_webhooks_field_value
Filter · 7 arguments · 1 call site
Filters one submitted field value on its way into the webhook payload.
File fields reach this after every attachment has resolved to a public URL. The field name, outgoing key and Submission identify the value without requiring a callback to reverse-map the block. Literals and omitted answers do not reach the filter.
apply_filters( 'xpac_forms_webhooks_field_value', $field_value, $field_type, $data, $blocks, $field_name, $payload_key, $submission )$field_value(mixed) — Submitted value, or a public URL array for files.$field_type(string) — Forms field type.$data(array) — Callback-safe submitted data map.$blocks(array) — Whole field-block map.$field_name(string) — Form field name.$payload_key(string) — Outgoing payload key.$submission(Submission) — Callback-safe delivery clone.
Fired from:
packages/Webhooks/Addon.php:2017
xpac_forms_webhooks_request_body
Filter · 3 arguments · 1 call site
Filters the complete webhook request body before it is encoded.
Return an array or a WP_Error. The latter records a permanent delivery failure without sending a partial payload.
apply_filters( 'xpac_forms_webhooks_request_body', $webhook_data, $config, $submission )$webhook_data(array) — Complete payload.$config(array) — Stored webhook body settings.$submission(Submission) — Callback-safe delivery clone.
Fired from:
packages/Webhooks/Addon.php:2092
xpac_webhooks_allow_unsafe_url
Filter · 2 arguments · 5 call sites
Filters whether a webhook may be sent to an address WordPress refuses by default.
Private and reserved ranges, loopback, and every port outside 80,
443 and 8080 are refused. That is the right default — this endpoint
is configured by anyone who can edit a form, which map_meta_cap
resolves to edit_others_posts plus edit_published_posts, so an
Editor holds it, and the request's URL, method, body and headers
all come from them.
Consulted twice — here, and again in send(), where returning true
is what drops the request from wp_safe_remote_request() to
wp_remote_request(). Allowing it in one place only would pass
this check and then fail inside core as a transport error, which
classifies transient and burns all five retries on a request that
can never succeed.
So a callback should test the host it is handed rather than
returning true outright: true disables core's protections for that
request completely, including the DNS-time check that is the only
thing standing between this and a name repointed at loopback.
Core's own http_allowed_safe_ports is the narrower lever when a
port is the only problem.
Filters whether a webhook may be sent to an address WordPress refuses by default.
apply_filters( 'xpac_webhooks_allow_unsafe_url', false, $request['url'] )
apply_filters( 'xpac_webhooks_allow_unsafe_url', false, $url )$allowed(bool) — Whether to send anyway. Default false.$url(string) — The configured URL.
Fired from:
packages/Webhooks/Addon.php:778packages/Webhooks/Addon.php:1558packages/Webhooks/Addon.php:1599packages/Webhooks/Agent.php:176packages/Webhooks/Notifications/Channel.php:143
xpac_webhooks_request_redirection
Filter · 2 arguments · 1 call site
Filters how many redirects one webhook request follows.
Core's default of 5 is kept, because a receiver that answers 301 on an
http-to-https or a trailing-slash normalisation is common. What a
redirect may carry is limited instead: see headersAfterRedirect(),
which drops every configured header — the Authorization a user
typed for one host included — as soon as the hop leaves that host.
Set 0 to refuse redirects outright, which reports the 3xx as an endpoint error rather than following it. Clamped to 0-10.
apply_filters( 'xpac_webhooks_request_redirection', 5, $request['url'] )$redirection(int) — Redirects to follow. Default 5.$url(string) — The configured URL.
Fired from:
packages/Webhooks/Addon.php:767
xpac_webhooks_request_timeout
Filter · 1 argument · 1 call site
Filters how long, in seconds, to wait for a webhook endpoint to reply.
The request runs after the visitor's submission, not inside it, so this is a tolerance for a slow endpoint rather than a latency budget: nothing is waiting on it, and a timeout shorter than the endpoint's own response time turns a delivery that worked into a needless retry.
Clamped to 1-30 seconds, so a value outside that range is pulled back into it rather than refused.
apply_filters( 'xpac_webhooks_request_timeout', 10 )$timeout(int) — Seconds to wait. Default 10.
Fired from:
packages/Webhooks/Addon.php:748
xpac_webhooks_response
Action · 3 arguments · 1 call site
Fires once a webhook endpoint has answered, successfully or not.
Everything the bounded log keeps, before it is bounded, for a site that wants to ship deliveries somewhere with real retention.
do_action( 'xpac_webhooks_response', $entry, $url, $submission )$entry(array) — Status, elapsed ms, kept headers, body excerpt.$url(string) — Full URL the request was made to.$submission(Submission) — Callback-safe delivery clone.
Fired from:
packages/Webhooks/Addon.php:1194
xpac_webhooks_response_log_entries
Filter · 1 argument · 1 call site
Filters how many response records one webhook keeps.
Zero, the default, stores nothing and leaves the action above as the only sink. Clamped to 0-20.
apply_filters( 'xpac_webhooks_response_log_entries', self::RESPONSE_LOG_ENTRIES )$entries(int) — Records to keep. Default 0.
Fired from:
packages/Webhooks/Addon.php:1204
xpac_webhooks_send_ip_address
Filter · 2 arguments · 1 call site
Filters whether the visitor's IP address is forwarded.
It is personal data, so each webhook has its own setting for it, and a site with a reason not to send it returns false here. Either way the key is sent empty rather than dropped.
The value is the connecting address: REMOTE_ADDR, unless
xpac_trust_proxy_headers allows X-Real-IP and
X-Forwarded-For, which the sender chooses.
apply_filters( 'xpac_webhooks_send_ip_address', $send_ip, $submission )$send(bool) — Whether to include it. Default: the webhook's own setting, which a webhook saved without that setting reads as true.$submission(Submission) — Callback-safe delivery clone.
Fired from:
packages/Webhooks/Addon.php:2075
xpac_webhooks_send_unanswered_fields
Filter · 1 argument · 1 call site
Filters whether "all fields" sends every configured key.
True, the default, sends an empty string for a field that was hidden or left blank — and an empty list for a file field — so the payload's keys are the form's fields rather than this visitor's answers. False omits them, for a receiver that distinguishes "absent" from "empty".
Only consulted in "all fields" mode. A hand-written mapping is never changed by it.
apply_filters( 'xpac_webhooks_send_unanswered_fields', true )$send(bool) — Whether to send unanswered keys. Default true.
Fired from:
packages/Webhooks/Addon.php:2162
xpac_webhooks_signing_secret
Filter · 4 arguments · 1 call site
Filters the shared secret one webhook's payload is signed with.
Return a non-empty string to sign. The default is whatever the webhook stores, which is '' unless something writes one, so a webhook is unsigned by default.
The secret never leaves the site: only the HMAC does.
apply_filters( 'xpac_webhooks_signing_secret', $stored, $item, $url, $submission )$secret(string) — Secret stored on the webhook. Default ''.$item(array) — Whole webhook configuration.$url(string) — Validated request URL.$submission(Submission) — Callback-safe delivery clone.
Fired from:
packages/Webhooks/Addon.php:992