Era Host hosting
EraHost – Free Domain, Cheap Hosting!
Client Area
Support 24/7
Menu

cPanel Webhooks — Automating Actions in cPanel & WHM

3 min read
16.06.2025

What Can You Do with cPanel Webhooks?

  • Automatically notify external systems when users create, modify, or delete accounts.
  • Trigger custom scripts when new domains, email accounts, or databases are created.
  • Integrate with third-party applications like billing systems or monitoring tools.
  • Log or audit events in an external system for security and compliance.
cPanel Hosting
Full control over your website
  • Convenient
  • Simple
  • Fast
  • Free 7-day trial
cPanel Hosting

How to Create a Webhook in WHM

To set up a webhook, you must use WHM's API.

cPanel Webhooks Automation Guide
cPanel Webhooks — POST callbacks for account/security/mail events.

For related cPanel automation topics, see Understanding the .cagefs Folder in CloudLinux and cpsrvd — cPanel Service Daemon.

Register a Webhook in WHM

Run the following command in SSH to create a webhook:

whmapi1 create_user_webhook url='https://yourserver.com/webhook-handler.php' event='Account::Create'

Replace https://yourserver.com/webhook-handler.php with your webhook URL.

This webhook will trigger every time a new cPanel account is created.

List Registered Webhooks

To see all active webhooks:

whmapi1 list_user_webhooks

This will display all registered webhooks, their URLs, and events.

Remove a Webhook

To delete a webhook:

whmapi1 delete_user_webhook url='https://yourserver.com/webhook-handler.php' event='Account::Create'

This removes the webhook from WHM.

Supported Events for Webhooks

cPanel & WHM support webhooks for various events, such as:

Event Name Trigger Description
Account::Create When a new cPanel account is created
Account::Remove When a cPanel account is deleted
Domain::Create When a new domain is added
Email::Create When a new email account is created
Database::Create When a new MySQL database is created

You can create webhooks for any of these events!

Example: Handling a Webhook Request (PHP)

If you set up a webhook, you need a script to handle the incoming request.

Create a webhook-handler.php file:

<?php
// Read webhook data
$data = json_decode(file_get_contents('php://input'), true);

// Log the webhook request
file_put_contents('webhook.log', print_r($data, true), FILE_APPEND);

// Respond to cPanel
http_response_code(200);
echo json_encode(["status" => "received"]);
?>

This logs webhook events and responds to cPanel.

Deploy this script on your server and update the webhook URL in WHM.

Summary of Webhook Management

Action Command/API
Create a Webhook whmapi1 create_user_webhook url='URL' event='EventName'
List All Webhooks whmapi1 list_user_webhooks
Delete a Webhook whmapi1 delete_user_webhook url='URL' event='EventName'
Handle Webhook Requests Create a PHP webhook handler

Now you can automate cPanel tasks with webhooks!

Frequently asked questions
Hook scripts (in `/usr/local/cpanel/hooks/`) run on the same server, synchronously, as the cpanel process. Webhooks fire HTTPS POST to a URL of your choice, asynchronously. Webhooks are easier to deploy (no shell access), survive cPanel upgrades, and can call out to off-server systems (Slack, monitoring). Hook scripts are more powerful but require server-side maintenance.
Three common causes: (1) endpoint blocks cPanel's outbound IP — check your firewall, (2) cert mismatch — cPanel verifies TLS by default, so self-signed certs fail; use a real cert or set `verify_ssl=0` on the webhook registration, (3) endpoint took > 30s to respond — cPanel times out and considers it failed. Check `/var/log/cpanel-webhook.log` for cPanel-side errors.
`Account::Created` and `Account::Removed` for billing/provisioning automation. `Mail::SendEmail` for outbound mail counting (catches abuse early). `Whostmgr::Accounts::Suspend` for status sync to monitoring. `cPHulk::login_failure` for fail2ban-style external IP blocking. Pick what fits the integration.
Modern cPanel (11.94+) supports HMAC-signed payloads via the `secret` parameter when registering. The webhook POST includes an `X-cPanel-Signature` header you verify on your end. Always use it; without it, an attacker who finds your webhook URL can spoof events. Older cPanel installs may not support signing — verify against IP allowlist instead.
Related articles
What is cpsess in cPanel & WHM?
"Retry Timeout Exceeded" in cPanel: What It Means and How to Fix It
How to Repair Horde Database (cphorde) in cPanel