Your Stripe webhook stops firing. For three days, no one notices.
Customers are paying, but their accounts aren't being activated. Subscriptions are created, but access isn't granted. Your support inbox fills up with confused users wondering why their purchase didn't work.
Webhook failures are silent killers. They don't throw errors you can see. They don't crash your app. They just... stop working. And by the time you notice, the damage is done.
In this guide, we'll cover how to monitor webhooks properly — both the ones you receive and the ones you send.
Why Webhooks Fail (And Why You Don't Notice)
Webhooks are the glue that holds modern applications together. They power:
- Payment processing (Stripe, PayPal, Square)
- Authentication events (Auth0, Clerk, Firebase)
- Communication (Twilio, SendGrid, Slack)
- E-commerce (Shopify, WooCommerce)
- DevOps (GitHub, GitLab, CI/CD pipelines)
But unlike API calls you initiate, webhooks are pushed to you. If they fail, you don't get an error — you just don't get the data.
Common webhook failure modes
1. Your endpoint goes down
Your server restarts. Your deployment breaks something. Your SSL certificate expires. The webhook sender tries to deliver, gets a 500 error, and eventually gives up.
2. The sender has problems
Third-party services have outages too. Stripe, GitHub, Twilio — they all have incident histories. When they can't send webhooks, your integration breaks.
3. Network issues
Timeouts, DNS problems, firewall changes, rate limiting. Any network hiccup can cause webhook deliveries to fail.
4. Authentication failures
Webhook signatures that don't validate. API keys that expired. Secrets that were rotated without updating your code.
5. Processing failures
The webhook arrives, but your code throws an exception. You return a 500, the sender retries a few times, then marks it as failed.
6. Silent processing bugs
The webhook arrives, your code runs, but a bug means the data isn't processed correctly. No error, no alert, just broken functionality.
The Two Sides of Webhook Monitoring
Incoming webhooks (webhooks you receive)
These are webhooks from external services to your application:
- Stripe payment events → Your billing system
- GitHub push events → Your deployment pipeline
- Twilio SMS events → Your communication logs
What can go wrong:
- Your endpoint is unreachable
- Your code fails to process the event
- The sender has an outage
Outgoing webhooks (webhooks you send)
If your application sends webhooks to customers or other services:
- Your app → Customer's endpoint
- Your app → Zapier/IFTTT/n8n
- Your app → Partner integrations
What can go wrong:
- The recipient's endpoint is down
- Network issues prevent delivery
- Your sending service has problems
Both directions need monitoring, but the approaches differ.
Monitoring Incoming Webhooks
Strategy 1: Endpoint availability monitoring
The simplest check: make sure your webhook endpoints are reachable.
Set up HTTP monitors for each webhook endpoint:
https://yourapp.com/webhooks/stripe
https://yourapp.com/webhooks/github
https://yourapp.com/api/webhooks/twilio
Configure these monitors to:
- Check every 1-5 minutes
- Alert if the endpoint returns non-2xx status
- Verify SSL certificates are valid
This catches the most obvious failures — your endpoint being completely down.
Strategy 2: Heartbeat monitoring for regular webhooks
Many webhooks fire on predictable schedules:
- Subscription renewal events (daily/monthly)
- Scheduled report deliveries
- Recurring payment processing
Set up heartbeat monitors that expect these webhooks to arrive. If 24 hours pass without a subscription event, something might be wrong.
Strategy 3: Event counting and anomaly detection
Track how many webhook events you receive per hour/day. A sudden drop often indicates a problem:
| Normal Day | Problem Day |
|---|---|
| 500 Stripe events | 12 Stripe events |
| 200 GitHub events | 0 GitHub events |
If you typically receive 500 Stripe webhooks daily and suddenly get 12, that's a red flag.
Strategy 4: Processing verification
Monitor that webhooks are actually being processed:
# After processing a webhook
def handle_stripe_webhook(event):
# Process the event
process_payment(event)
# Ping your monitor to confirm processing
requests.get("https://ping.web-alert.io/stripe-webhook-123")
If the ping stops arriving, you know processing has stopped — even if the endpoint itself is up.
Strategy 5: End-to-end transaction monitoring
The ultimate test: verify the full flow works.
For a payment webhook:
- Customer pays → Stripe sends webhook → Account is activated
Monitor the end result: are accounts being activated? If activations stop, something in the chain is broken.
Monitoring Outgoing Webhooks
If your application sends webhooks, you need different monitoring:
Track delivery status
Log every webhook delivery attempt:
async function sendWebhook(url, payload) {
const startTime = Date.now();
try {
const response = await fetch(url, {
method: 'POST',
body: JSON.stringify(payload),
headers: { 'Content-Type': 'application/json' }
});
logWebhookDelivery({
url,
status: response.status,
duration: Date.now() - startTime,
success: response.ok
});
return response.ok;
} catch (error) {
logWebhookDelivery({
url,
error: error.message,
duration: Date.now() - startTime,
success: false
});
return false;
}
}
Monitor failure rates
Set up alerts when delivery failure rates exceed thresholds:
- Warning: > 5% failure rate
- Critical: > 20% failure rate
A spike in failures often indicates a problem with a specific customer's endpoint or a broader network issue.
Implement retry with exponential backoff
Don't give up after one failure:
const RETRY_DELAYS = [0, 60, 300, 3600, 86400]; // 0s, 1m, 5m, 1h, 24h
async function deliverWithRetry(webhook) {
for (let attempt = 0; attempt < RETRY_DELAYS.length; attempt++) {
await sleep(RETRY_DELAYS[attempt] * 1000);
const success = await sendWebhook(webhook.url, webhook.payload);
if (success) return true;
}
// All retries failed - alert
alertWebhookFailed(webhook);
return false;
}
Provide visibility to customers
Give webhook recipients a way to see delivery status:
- Recent delivery attempts
- Response codes received
- Retry schedule
- Manual retry option
This reduces support burden and helps customers debug their own endpoints.
Webhook Security Monitoring
Webhooks are also a security concern. Monitor for:
Invalid signatures
Track webhook requests that fail signature verification. A spike might indicate:
- Someone probing your endpoints
- A misconfiguration in the sender
- An attempted attack
Unexpected sources
Log the IP addresses of webhook senders. Alert if webhooks arrive from unexpected IPs.
Replay attacks
Track webhook IDs to detect duplicate deliveries. Alert if the same webhook ID arrives multiple times.
Building a Webhook Health Dashboard
Create visibility into your webhook ecosystem:
Key metrics to track
| Metric | Description | Alert Threshold |
|---|---|---|
| Delivery success rate | % of webhooks successfully processed | < 95% |
| Average processing time | How long webhook handling takes | > 5 seconds |
| Event volume | Number of webhooks per hour | 50% drop |
| Retry rate | % of webhooks requiring retries | > 10% |
| Failed permanently | Webhooks that failed all retries | Any |
Per-integration monitoring
Track metrics separately for each integration:
Stripe: ✓ 99.8% success, 342 events/day
GitHub: ✓ 100% success, 89 events/day
Twilio: ⚠ 94.2% success, 156 events/day (investigate)
SendGrid: ✓ 99.5% success, 1,204 events/day
A problem with one integration shouldn't be hidden by others performing well.
Common Webhook Monitoring Mistakes
Mistake 1: Only monitoring endpoint availability
Your endpoint might return 200 OK while completely failing to process webhooks. Monitor the actual processing, not just reachability.
Mistake 2: No alerting for "zero events"
If you normally receive 100 webhooks per hour and suddenly receive 0, that's just as bad as your endpoint being down. Monitor for absence, not just errors.
Mistake 3: Ignoring retry exhaustion
Webhook senders eventually give up retrying. If you don't monitor for permanently failed deliveries, you'll miss events entirely.
Mistake 4: Not testing the full flow
A webhook might be received and processed, but the downstream action might fail. Test the complete workflow, not just webhook receipt.
Mistake 5: Manual checking instead of automated monitoring
"I'll just check the Stripe dashboard" isn't monitoring. Automate your checks so problems are caught immediately, 24/7.
Webhook Monitoring Checklist
Use this checklist for each webhook integration:
Incoming webhooks
- Endpoint availability monitored (HTTP checks)
- SSL certificate monitored
- Processing success tracked (heartbeat pings)
- Event volume monitored (anomaly detection)
- Error logging in place
- Alert contacts configured
- Runbook documented for failures
Outgoing webhooks
- Delivery attempts logged
- Failure rate tracked
- Retry mechanism implemented
- Customer visibility provided
- Permanent failures alerted
- Delivery status dashboard available
How Webalert Helps Monitor Webhooks
Webalert provides the building blocks for comprehensive webhook monitoring:
HTTP monitoring for endpoints
Monitor your webhook endpoints are reachable:
- 1-minute checks catch outages fast
- SSL monitoring prevents certificate failures
- Response time tracking spots slowdowns
Heartbeat monitoring for processing
Verify webhooks are being processed:
- Ping when each webhook type is handled
- Alert if expected pings don't arrive
- Track processing patterns over time
Multi-channel alerts
Get notified instantly when things break:
- Email, SMS, Slack, Discord
- Alert the right team for each integration
- Escalation for critical webhooks
See features for full capabilities and pricing for plans.
Final Thoughts
Webhooks are critical infrastructure. They handle payments, trigger deployments, send notifications, and synchronize data across your entire system.
But their fire-and-forget nature makes them dangerous. When they fail, they fail silently.
The fix is systematic monitoring:
- Check endpoint availability
- Verify processing is happening
- Monitor event volumes for anomalies
- Alert on permanent failures
Don't wait for a customer to tell you their payment webhook hasn't worked in a week.
Never miss a failed webhook again
Start monitoring your integrations free with Webalert →
Explore features or see pricing.
Free forever. Instant alerts. Reliable integrations.