Under the Hood: How Wisper Secures Webhooks and Defends Against Spam

Whenever a WordPress site exposes a public endpoint for live chat or webhooks, security must be designed in from day one. An unsecured webhook allows attackers to forge specialist messages, spam group chats, or drain AI API quotas.

1. Secret Token Verification (X-Telegram-Bot-Api-Secret-Token)

When Wisper registers your webhook with Telegram, it generates a cryptographically secure 48-character token. Telegram includes this secret in every payload header as X-Telegram-Bot-Api-Secret-Token.

Our webhook handler validates this header using PHP's timing-attack-safe hash_equals() function. Any request lacking the exact secret is rejected with an immediate 401 Unauthorized before parsing the body or touching the database.

2. Multi-Layer Anti-Spam for Website Visitors

To prevent automated spam bots from flooding your Telegram group with messages, Wisper employs silent client-side defenses:

• Honeypot trap: Hidden input fields invisible to human users that bots greedily fill out.
• Timestamp verification: Enforces a minimum human typing duration before a message can be dispatched.
• Per-session rate limiting: Restricts message frequency to prevent script flooding.