Yak Event Hooks

Stop hand-copying data between WordPress and your automation tools. Yak Event Hooks fires a webhook whenever an event happens on your site, carrying a clean JSON payload with everything your workflow needs — no API keys, no accounts, no third-party servers.

Developed by YakWP. See the plugin homepage for documentation and downloads.

Point it at any endpoint that accepts a JSON POST — n8n, Zapier, Make, IFTTT, your own server, or a cloud automation — and instantly start workflows on:

Posts
* Published — share to social, email subscribers, summarize with AI, republish elsewhere.
* Updated — send diffs, updated titles or URLs to downstream systems.
* Trashed / Deleted — clean up records, sheets, or external feeds.

Comments
* Added — forward new comments (author, content, post) to Slack, ticketing, or AI-reply pipelines.
* Status changed — approve/unapprove/spam moderation notifications.
* Deleted — keep moderation logs in sync.

Media
* Uploaded — every new attachment (image, file) with dimensions, size, and URL — perfect for image pipelines.

Users
* Registered — new-user signups (username, email, role) for membership/CRM automation.

Payload example (post published):

`

{
“event”: “publish”,
“post_id”: 42,
“title”: “How to automate WordPress”,
“slug”: “automate-wordpress”,
“url”: “https://example.com/automate-wordpress”,
“post_type”: “post”,
“status”: “publish”,
“old_status”: “draft”,
“new_status”: “publish”,
“author”: “Oliver”,
“categories”: [“Automation”],
“tags”: [“webhook”],
“timestamp”: “2026-09-05 12:00:00”
}
`

Your webhook URL is all it needs. Each event is toggleable, so you only send what you want.

Two things worth knowing

Requests never hold up your site. Payloads are queued and sent after the page response has been handed to the visitor, so a slow or unreachable endpoint cannot stall an editor save. On hosts with a request-finish function (PHP-FPM, LiteSpeed) the plugin still records the real HTTP status. On other hosts the send is fire-and-forget and the log says so honestly.

You can prove a payload came from your site. Add a shared secret and every request carries an HMAC-SHA256 signature of the raw body plus a timestamp:

`

X-Yak-Signature: sha256=<hmac_sha256(timestamp + “.” + raw_body, secret)>
X-Yak-Timestamp: 1789813016
X-Yak-Delivery: 4f1c…-uuid
X-Yak-Site: https://example.com/
`

Sign the timestamp with the body and reject anything older than a few minutes — that kills replay attacks. Verify with a constant-time comparison before you parse the JSON. Each site should carry its own secret: one shared key across many sites means one compromised site can forge events for all of them.

Is the event list enough to tell a real publish from a scheduled one?

Every post status transition carries both sides of the change (old_status and new_status), so a workflow can tell a brand-new post from a scheduled post flipping over (future → publish), or a draft being published. Comment status events carry the same pair.

Made by YakWP

Developed and maintained by YakWP. YakWP also makes a free AI chatbot plugin for WordPress that answers your visitors’ questions right on your site — pair it with Yak Event Hooks so your site not only fires workflows but also talks to every visitor automatically.

• Plugin homepage — docs and downloads
• YakWP — free AI chatbot for WordPress

Features

• Fires on post lifecycle (publish/update/trash/delete), comments (added/status/deleted), media uploads, and new-user registrations.
• Works with any post type (posts, pages, custom types) and filters events by selected post types.
• Optional excerpt and full-content fields in the post payload.
• Optional HMAC-SHA256 signing of every payload, per site, with replay protection via a signed timestamp.
• Non-blocking delivery: events are sent after the response, so a slow endpoint never delays a save.
• Post status transitions include old_status and new_status.
• Cool-down timer prevents repeat firing during rapid saves.
• Test button — send a sample payload to verify your endpoint before trusting it live.
• Delivery log — see every send, its HTTP status, and any errors, right in wp-admin.
• REST API — read and update settings remotely (/wp-json/yak-event-hooks/v1/settings, /log).
• Lightweight: one HTTP request per event, no database tables, no scheduled tasks, no external services.
• No retry queue: if the endpoint is unreachable the send is logged and not repeated. Build the retry on the receiving side if you need delivery guarantees.

Privacy

No data ever leaves your site except the JSON payload you asked us to send to your own webhook URL. There are no analytics, no tracking, and no third-party requests.