All Features — Fillin Forge Features

Webhook Integration — Connect Any App

Fillin Forge’s webhook integration sends every form submission to any external URL as a JSON payload. Use it to connect forms to Zapier, Make (formerly Integromat), n8n, your own API endpoint, or any service that accepts HTTP POST.

How webhooks work in Fillin Forge

Per-form webhook URL

Every form has a Webhook card in the form builder. Enter the destination URL and Fillin Forge posts the submission to it after every successful submission.

JSON payload

The payload is a JSON object containing:

form_id: the Fillin Forge form ID
form_title: the human-readable form title
submission_id: a unique ID for this submission
timestamp: ISO 8601 date and time of the submission
fields: an object mapping field IDs to the field label and value

Custom headers

Add custom HTTP headers to the request — useful for authentication:

Authorization: Bearer your-api-token
X-API-Key: your-key-here

Headers are stored as plain text in the WordPress database. Fillin Forge sets Content-Type: application/json itself; a Content-Type, Host, Content-Length, Connection or Transfer-Encoding line is ignored. The request is not signed, so a secret in a custom header is how your endpoint recognizes your site.

No automatic retry

Fillin Forge sends each webhook once and waits up to 10 seconds for an answer. If the endpoint returns an error or times out, the webhook is not sent again.

When webhooks run

Webhooks are sent while the form is being submitted, so keep your endpoint fast: Fillin Forge waits up to 10 seconds for it.

Security: SSRF protection

Server-Side Request Forgery (SSRF) is a common web vulnerability where an attacker tricks your server into making requests to internal network addresses or cloud metadata endpoints. Without protection, someone could configure a webhook to point at http://localhost/ or http://169.254.169.254/ (AWS metadata) and extract information from your infrastructure.

Fillin Forge’s webhook integration blocks:

Private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
Loopback (127.0.0.0/8)
Link-local (169.254.0.0/16)
IPv6 equivalents
Non-HTTP(S) schemes

The destination URL is resolved and validated before the request is sent. Attempts to hit forbidden addresses are rejected and logged.

Use cases

Zapier or Make

Connect Fillin Forge submissions to Zapier / Make workflows that trigger any of their thousands of integrations. Create records in Airtable, send SMS via Twilio, add rows to Google Sheets (via Zapier, if you prefer over the native Google Sheets integration), and more.

Custom backend

POST submissions to your own REST API for processing — scoring leads, running business logic, syncing to your CRM, triggering custom workflows.

n8n automation on your own server

If you run n8n on your own infrastructure, Fillin Forge can POST to your n8n webhook endpoint and trigger complex automations without giving up data control.

Discord / Slack alerts (custom format)

While Fillin Forge has native Slack and Discord integrations with Block Kit / Embed formatting, sometimes you want a custom format. Point the webhook at a Slack/Discord webhook URL and format the payload your way via a simple webhook receiver.

Your own database

POST to a serverless function (AWS Lambda, Cloudflare Workers, Vercel) that writes the submission to your own database. Keeps form data in your infrastructure, not WordPress.

Testing webhooks

To test an endpoint, submit one of your forms and check what arrives at the URL.

Failed requests

Fillin Forge writes a short diagnostic note when a webhook request fails or is skipped. It is for debugging: there is no log screen in the admin and no replay.

Ready to connect your forms to any app?

See pricing →

Webhook integration is included in every plan — free and paid. Webhooks are part of the Free plugin.