Auto-SEO

Webhook publishing

Receive every published article at your own endpoint and do whatever you like with it — publish to Next.js, a custom CMS, Notion, HubSpot, Zapier/Make, or your own pipeline.

How it works

In your WordPress-SEO dashboard, choose Webhook / Custom as your platform and paste your endpoint URL. We generate a signing secret for you. Each time one of your articles is published, we send an HTTP POST to your URL with the article as JSON.

The request

• Method: POST, Content-Type: application/json
• Header X-WordPress-SEO-Timestamp: unix seconds when we sent it
• Header X-WordPress-SEO-Signature: sha256=<hex> where hex = HMAC-SHA256 of "{timestamp}.{rawBody}" using your signing secret
• Timeout: 30s. Return any 2xx status to acknowledge.

Payload

{
  "event": "article.published",
  "sent_at": "2026-08-01T18:00:00+00:00",
  "site": { "brand": "Your Brand", "website": "https://yoursite.com" },
  "article": {
    "id": 123,
    "title": "How to ...",
    "slug": "how-to-...",
    "html": "<h2>...</h2><p>...</p>",
    "meta_description": "A concise summary ...",
    "keyphrase": "your target keyphrase",
    "image_url": "https://wordpress-seo.co.uk/uploads/articles/....webp",
    "published_at": "2026-08-01T18:00:00+00:00"
  }
}

Images are served from our CDN at the URL shown — download and re-host them on your side if you prefer.

Verify the signature (Node.js)

import crypto from 'crypto';

// express example — use the RAW body, not the parsed object
app.post('/api/autoseo-webhook', express.raw({type: 'application/json'}), (req, res) => {
  const ts   = req.get('X-WordPress-SEO-Timestamp');
  const sig  = req.get('X-WordPress-SEO-Signature');            // "sha256=...."
  const raw  = req.body.toString('utf8');
  const want = 'sha256=' + crypto
    .createHmac('sha256', process.env.AUTOSEO_SECRET)
    .update(ts + '.' + raw)
    .digest('hex');
  if (sig !== want) return res.status(401).end();          // reject forgeries

  const { article, site } = JSON.parse(raw);
  // ... create/publish the post however you like ...
  res.json({ ok: true, url: 'https://yoursite.com/blog/' + article.slug });
});

Verify the signature (PHP)

$raw  = file_get_contents('php://input');
$ts   = $_SERVER['HTTP_X_AUTOSEO_TIMESTAMP'] ?? '';
$sig  = $_SERVER['HTTP_X_AUTOSEO_SIGNATURE'] ?? '';
$want = 'sha256=' . hash_hmac('sha256', $ts . '.' . $raw, getenv('AUTOSEO_SECRET'));
if (!hash_equals($want, $sig)) { http_response_code(401); exit; }

$data = json_decode($raw, true);
// ... publish $data['article'] however you like ...
echo json_encode(['ok' => true]);

The response

Return 2xx to acknowledge. Optionally return JSON with a url (and/or id) of the post you created — we'll record it as the live URL for that article in your dashboard.

{ "ok": true, "url": "https://yoursite.com/blog/how-to-...", "id": "abc123" }

Questions? Email hello@wordpress-seo.co.uk and we'll help you wire it up.