Event webhooks: signed POSTs for goals, spikes and events
Send a signed JSON POST to your own HTTPS URL when a goal is reached, a traffic spike is recorded, or a custom event is counted.
In every plan, including Free. Data in and out.
What it is
One webhook URL per site, on the Alerts page. quietstats POSTs a small JSON body and signs it with HMAC-SHA256, so you can verify it came from us. You choose which of goals, spikes and drops, and custom events to send. Custom events are off until you switch them on. A Send test button posts a sample body with no visitor data.
Why it matters
If you already have a script, a Zapier catch-hook or your own inbox, you can react the moment something that matters happens, without polling the Stats API.
How it works
- Nothing is sent until you paste an HTTPS URL. The URL and the signing secret are stored encrypted and never shown again (the secret is shown once, when you add the webhook or rotate it).
- The body is a type (goal, spike, event or test), your site’s domain and public id, a timestamp, and the goal name, event name and path, or the spike title. Never a visitor, an IP address, a user agent or anything typed.
- Failed deliveries are retried up to five times, then dropped. There is a cap on how often a site can fire, so a busy event stream cannot flood your URL or our database.
- The collector does no extra read on sites that have not configured a webhook.
Privacy: what is and isn’t collected
Collected
- Nothing new about visitors: the POST only repeats a goal name, an event name and path, or a spike title already stored as totals
Never collected
- Visitor identifiers, IP addresses, user agents, form field values
- Cookies, localStorage or anything else stored on the visitor’s device
- IP addresses or user agents (used in memory, then discarded)
- Anything that links a visitor across days (the visitor ID resets daily)
Rows and limits
- One URL per site
- Up to 5 delivery attempts, then the payload is dropped
- Custom events are off by default
- 0 extra script bytes
- A write only when you save the URL, send a test, or a delivery fails and is queued
“Rows” are database rows written, which is what our hosting is billed on. Reads are not rows written. Methodology →
Questions
Is this the same as Slack, Discord and Teams?
No. Those are incoming webhooks for a weekly summary and alerts in a chat channel. Event webhooks POST a signed JSON body to any HTTPS URL you control.
How do I verify the signature?
HMAC-SHA256 of “timestamp + . + the raw body”, using the signing secret you were shown once. The hex digest is in the X-Quietstats-Signature header as sha256=…
Will it send if I have not set a URL?
No. Nothing is posted anywhere until you save a URL.
Related features
Set it up
Nothing to set up: it works with the standard one-line script.
<script data-host="https://quietstats.co.uk" data-dnt="true" src="https://quietstats.co.uk/js/script.js" id="YOUR_SITE_ID" async defer></script>Try it on your own site
Free during launch: one site and 5,000 pageviews a month, no card needed. After launch, paid plans start at £5 a month.