Report abuse

Send the report to abuse@trywebhook.com — and send it quickly. Storage here is deleted 7 days after the last request a URL received, so a report that arrives a week late arrives after the evidence has already been erased.

What to include

The first item is the one that matters; everything else is helpful but optional.

• The full URL, including the identifier after /w/. Each URL's storage is completely separate and there is no index across them, so without the identifier we cannot find anything — we cannot search for a URL by what is in it, and nor can anyone else.
• Where you encountered it — a phishing email, a fake login page, a script found on a compromised server, a browser extension, an app's network traffic.
• What you believe it is doing, in a sentence. "The form at this address posts the password to it" is more useful than a category name.
• Evidence, if you have it — the email with headers intact, the page source, a screenshot, the request you observed. Do not include real credentials or card numbers in the report; describe them instead.
• Whether you are affected personally, and whether you need a reply.

Anonymous reports are accepted and acted on. You do not need to identify yourself or explain how you found it.

What we act on

• Credential and payment harvesting. A URL here set as the target of a fake login form, a bogus payment page, or a one-time-code prompt. This is the most common abuse of tools like this by a wide margin.
• Malware and exploit staging — using an endpoint here to deliver or coordinate anything intended to compromise a device.
• Exfiltration, command-and-control and beaconing from a system the operator does not own.
• Illegal content. Material that sexually exploits children is reported to the relevant authority without exception and without waiting for a second opinion.
• Someone else's personal data sent to an open endpoint without a lawful basis — including a live production integration accidentally left pointing here.
• Impersonation — presenting a URL on this domain as an official endpoint of a company or a government service.
• Attacks on the service itself, and attempts to reach webhook URLs belonging to other people.

What happens next

TryWebhook is run by one developer, not a trust-and-safety department, so the process is short and honest about its limits.

• We look at the URL. Anyone holding the identifier can read the requests it captured, which includes us once you have sent it.
• If the report holds up, the URL is destroyed. Its stored requests go with it, immediately and unrecoverably, and the identifier stops accepting traffic.
• Sources are blocked where blocking helps — rate limits tightened, or a network refused outright.
• Clear criminal abuse is escalated to the relevant authority, and we preserve what is necessary for that rather than deleting it, for as long as we are required to.
• Expect a reply within a couple of working days where you asked for one. Child exploitation material and active phishing campaigns are handled ahead of everything else. This is a best-effort commitment, not a contractual one.

If you were sent one of these links

A URL on this domain is a developer's debugging endpoint. It is never a login page, a payment page, a package tracker, a tax refund form or a document viewer. TryWebhook will never ask you for a password, a card number or a verification code, on this domain or any other.

If you entered something into a page that sent it here, treat it as compromised: change that password everywhere you used it, turn on two-factor authentication, and tell your bank if payment details were involved. Then send us the URL and we will delete what was captured. Deleting it does not undo the disclosure, which is why the first two steps come first.

What data actually exists

Worth stating plainly, because it changes what a report or a legal request can usefully ask for.

• Per captured request: the method, path, query string, all headers, up to the first256 KB of the body, and the sending IP address with the country and network Cloudflare reported for it.
• Per URL: when it was created and when it expires. Nothing else.
• Not stored at all: who created a URL. There is no account, and no IP address, cookie or fingerprint is recorded at creation time. We can often tell you which addressessent requests to a URL; we can never tell you who made it.
• Retention: 7 days from the last delivery, 30 days from creation at the outside. There are no backups and no archive, so anything past that window does not exist in any form.

Law enforcement and legal requests

Send requests to abuse@trywebhook.com from an official address, with the webhook identifier and the legal basis. Read the section above first: the retention window is days, not months, so a preservation request needs to arrive immediately — by the time a formal order follows, the data it names will usually have been deleted automatically.

We respond to valid requests under the law that applies to us, disclose no more than they require, and tell the affected party where we are permitted to.

Security vulnerabilities

Report those to hello@trywebhook.com rather than here. Please do not test against other people's data, run automated scanners that degrade the service, or publish before we have had a chance to fix it. There is no bug bounty — this is a free tool with no revenue beyond ads — but credit is given gladly and reports are taken seriously.

Findings that are already documented rather than defects: webhook URLs are unauthenticated by design and anyone holding one can read it; there is no rate limit on creating URLs from separate networks beyond the published caps; and captured payloads are displayed as inert text, which is what the inspector's strict Content Security Policy exists to guarantee.

Something else

Wrong or outdated information in a provider guide, a broken page, or a feature that behaves oddly:hello@trywebhook.com. Data and privacy questions are covered by theprivacy policy, and what is and is not allowed is set out in theterms.