GOMAX ULTIMATE 5.39.0 lets your WordPress site POST a signed JSON event straight to any URL you choose — your own server, n8n, Make, Zapier or a Slack relay — the moment an order, lead, review or low-stock warning happens, with no middleman subscription and no data ever passing through a vendor cloud. You point a webhook at an endpoint, pick the events, and GOMAX delivers them reliably with a signing secret, automatic retries and a delivery log.
Webhooks are how modern software talks to itself: "this happened, here's the data, do something." On WordPress that usually means renting a connector service that sits between your site and your tools, watching your data go by. GOMAX flips that — the webhook fires from your site directly to your endpoint, and nothing is in the middle.
Key takeaways
- Fire events to your own URLs. New order, order status change, order completed, new lead, low stock, new user, published post, new comment/review — delivered as JSON to the endpoints you configure.
- Every delivery is signed. GOMAX signs the body with a per-webhook secret using HMAC-SHA256, so your receiver can verify the request genuinely came from your site.
- Reliable by design. Delivery is asynchronous (it never slows down the shopper or the admin), with automatic retry and exponential backoff, plus a delivery log you can inspect and replay.
- No middleman, pay-once. There's no per-task metering and no third-party connector — events go straight from your WordPress install to your destination.
- You stay in control. Two GPT permissions (read and manage) are off by default, and events only ever go to the URLs you set.
Why "first-party" webhooks matter
Connector platforms are convenient, but they mean your orders, customer emails and lead details flow through someone else's servers, often on a monthly plan that charges per task. For a store that values privacy — or just doesn't want another subscription — that's the wrong trade.
A first-party webhook removes the intermediary. When an order is created, your site signs the event and POSTs it to, say, your self-hosted n8n instance or a small script on your own VPS. The data goes from you to you. That fits a pay-once, self-hosted philosophy exactly: the capability lives inside the plugin you already own, and the events reach only the endpoints you trust.
How it works
Create a webhook with the URL and the events you care about, and GOMAX returns a signing secret — once. From then on, whenever a matching event occurs, GOMAX builds a JSON payload like this and POSTs it to your URL:
- Headers include
X-GOMAX-Event,X-GOMAX-Delivery,X-GOMAX-TimestampandX-GOMAX-Signature: sha256=…. - The signature is
HMAC-SHA256("{timestamp}.{raw body}", secret). Your receiver recomputes it with the shared secret and compares — if they match, the event is authentic and hasn't been tampered with. - The body carries the event name and a
dataobject (for an order: id, number, status, total, currency, customer email, and more).
Delivery happens after the response is sent to the visitor, so checkout and admin actions never wait on your endpoint. If your receiver is down or returns an error, GOMAX retries with increasing delays and records every attempt — status, HTTP code and error — in a delivery log you can review, and you can replay any delivery on demand.
What you can build with it
- Push new orders into a self-hosted dashboard, spreadsheet or accounting tool.
- Send new leads to your CRM or a Slack/Discord channel the instant they're captured.
- Trigger an n8n or Make flow on low stock to reorder or notify a supplier.
- Post a message when a new review lands, or when a specific post goes live.
Because it's plain signed HTTP, anything that can receive a POST can consume it — no proprietary SDK required.
Frequently asked questions
Do I need Zapier or another connector service?
No. That's the point. GOMAX delivers events directly from your WordPress site to your own endpoint. Zapier, Make or n8n can receive the webhook if you want to build a flow there, but nothing has to sit between your site and your data.
How does my receiver know the event is genuine?
Each delivery is signed with your webhook's secret using HMAC-SHA256 over "{timestamp}.{body}", sent in the X-GOMAX-Signature header. Your endpoint recomputes the signature with the same secret and compares — a match proves authenticity and integrity, and the timestamp lets you reject replays.
Will webhooks slow down my checkout or admin?
No. Deliveries run asynchronously after the page response is sent, so the shopper and the admin never wait on your endpoint. Failures retry in the background with exponential backoff.
What happens if my endpoint is temporarily down?
GOMAX retries automatically with increasing delays and logs every attempt with its HTTP status. You can also inspect the delivery log and manually replay any delivery once your endpoint is back.
Where does the event data go?
Only to the URLs you configure. GOMAX ULTIMATE is self-hosted and privacy-first — no event data is ever sent to GOMAX or any vendor cloud.
Top comments (0)