Event webhooks
Send a signed JSON POST to your own HTTPS URL when a goal is reached, a traffic spike is recorded, or a custom event is counted.
What it does
One webhook URL per site, on the Alerts page. quietstats POSTs a small JSON body and signs it with HMAC-SHA256, so you can verify it came from us. You choose which of goals, spikes and drops, and custom events to send. Custom events are off until you switch them on. A Send test button posts a sample body with no visitor data.
Why it matters
If you already have a script, a Zapier catch-hook or your own inbox, you can react the moment something that matters happens, without polling the Stats API.
How to use it
- Open Alerts and scroll to Event webhooks. Pick the site, paste your HTTPS URL and choose goals, spikes and (optionally) custom events, then add the webhook.
- Copy the signing secret that is shown once and store it with your receiver, so you can check X-Quietstats-Signature.
- Tap Send test. You should see a JSON body with type “test” and no visitor data. Then complete a goal on your site, or wait for a spike, and check the POST arrives.
How it works
- Nothing is sent until you paste an HTTPS URL. The URL and the signing secret are stored encrypted and never shown again (the secret is shown once, when you add the webhook or rotate it).
- The body is a type (goal, spike, event or test), your site’s domain and public id, a timestamp, and the goal name, event name and path, or the spike title. Never a visitor, an IP address, a user agent or anything typed.
- Failed deliveries are retried up to five times, then dropped. There is a cap on how often a site can fire, so a busy event stream cannot flood your URL or our database.
- The collector does no extra read on sites that have not configured a webhook.
Privacy
- Collected: Nothing new about visitors: the POST only repeats a goal name, an event name and path, or a spike title already stored as totals
- Not collected: Visitor identifiers, IP addresses, user agents, form field values
- No cookies, and nothing stored on the visitor’s device.
- Reports show totals only: never a visitor list, IP address or single visit.
Limits
- One URL per site
- Up to 5 delivery attempts, then the payload is dropped
- Custom events are off by default
- 0 extra script bytes
- A write only when you save the URL, send a test, or a delivery fails and is queued
Plans
Every plan, including Free. quietstats is free during launch: the Free plan covers 1 site and 5,000 pageviews a month, and no card is needed. See pricing.
Questions
Is this the same as Slack, Discord and Teams?
No. Those are incoming webhooks for a weekly summary and alerts in a chat channel. Event webhooks POST a signed JSON body to any HTTPS URL you control.
How do I verify the signature?
HMAC-SHA256 of “timestamp + . + the raw body”, using the signing secret you were shown once. The hex digest is in the X-Quietstats-Signature header as sha256=…
Will it send if I have not set a URL?
No. Nothing is posted anywhere until you save a URL.