2 min read
By Mike
Discord Webhook: What It Is and How to Keep It Safe
A Discord webhook is a private URL that lets an outside app post messages into one channel without a bot account. Anyone who holds the URL can post there, so a webhook link should be kept as private as a password.
What a webhook does
You create a webhook in Channel Settings, Integrations. Discord gives you a URL that contains the webhook ID and a secret token. When another program sends a message to that URL, Discord posts it in the channel under the webhook's name and avatar. There is no login and no bot to invite.
That makes webhooks the simplest way to connect outside services: a code host announcing a commit, a store posting a sale, a status page reporting an outage, a feed reader sharing new articles.
What a webhook cannot do
A webhook can only send. It does not read messages, react to commands, see members or manage roles. For anything interactive you need a bot that uses slash commands or buttons. A webhook also posts to just one channel, though it can post into threads of that channel.
Webhook messages can carry embeds, files and a custom username, and are subject to Discord's rate limits like everything else.
Why the URL must stay private
The token inside the URL is the only protection. If it leaks, a stranger can post into your channel, mention people and send convincing fake announcements. Discord cannot tell the difference between you and them.
- Never paste a webhook URL in a public channel, a support thread or a screenshot.
- Give each integration its own webhook so you can remove one without breaking the rest.
- If a URL leaks, delete the webhook in Channel Settings, Integrations and create a new one. Deleting it cuts off the old link immediately.
- Review the list now and then. Any webhook you do not recognise should go.
Only grant Manage Webhooks to people you trust. Anyone with it can create a webhook and post as any name they like.
Webhooks and Noxyr
Noxyr's server health check looks at the webhooks in your server as part of its security score out of 100, along with permissions on @everyone and how many roles have Administrator. The score and fixes are described in the protection docs. Noxyr itself posts through the bot, not through webhooks you have to create.
For staying aware of what happens in your channels, see server logs, and for the bigger picture on locking a server down, the security bot page.
Common questions
What is a Discord webhook used for?
Posting messages into a channel from another service, such as a status page, store or code host, without running a bot.
Is a webhook URL a secret?
Yes. Anyone with the URL can post to the channel. Delete and recreate the webhook if it leaks.
Can a webhook read messages or run commands?
No. A webhook only sends messages. For commands and buttons you need a bot.
