benecaster_donation_webhook_rejected

Fires inside POST /benecaster/v1/listener-support/donations when webhook signature verification fails — after the 403 signature_invalid response is prepared but before it is sent. The donation row is NOT written. A single debug log line is also written: [benecaster] webhook verification failed for platform=<canonical> from IP=<hash> (the IP address is hashed — raw addresses are never logged).

Use this action to route rejection alerts to Slack, log to an external security service, or trigger rate-limiting or blocklist logic.

This action only fires when a secret was configured for the platform and that secret check failed. Requests from platforms without a configured secret are accepted silently — they do not fire this action and do not fire _verified.

The rejection action deliberately omits the failure reason. The debug log line records that verification failed, but neither this action nor its parameters reveal which part of the signature check failed. Consumers that need to bucket failures by cause should parse the [benecaster] webhook verification failed … line from debug.log instead — exposing failure details through a PHP action would make it easier for an attacker iterating against the endpoint to learn what they got wrong.

<?php
add_action( 'benecaster_donation_webhook_rejected', function ( string $canonical_platform, string $raw_platform ): void {
    wp_remote_post( 'https://hooks.slack.com/services/T00/B00/xxx', [
        'timeout'  => 3,
        'blocking' => false,
        'headers'  => [ 'Content-Type' => 'application/json' ],
        'body'     => wp_json_encode( [
            'text' => sprintf(
                ':warning: Benecaster donation webhook rejected — platform=%s (raw=%s). Verify the secret in Settings → Listener Support → Webhooks matches the sender.',
                $canonical_platform,
                $raw_platform
            ),
        ] ),
    ] );
}, 10, 2 );

// Optional — fire an "all clear" heartbeat when verification succeeds
// again, so the on-call knows the incident closed itself.
add_action( 'benecaster_donation_webhook_verified', function ( string $canonical_platform ): void {
    set_transient( 'my_webhook_last_verified_' . $canonical_platform, time(), DAY_IN_SECONDS );
} );