Webhooks

Discord webhook security

By ESN Systems, makers of ESN Guardian. Updated November 3, 2026.

A Discord webhook URL works like a password: anyone who has it can post in your channel. Here is how webhooks get abused, a checklist to lock them down, and what to do when one leaks.

Guardian is on every server at no cost. Setup takes about five minutes.

Add Guardian to Discord Grade your server first

What a Discord webhook is

A webhook is a URL that posts messages into one channel. Discord's Intro to Webhooks article shows how they are made: Server Settings → Integrations → Webhooks, or the channel's own settings. Tools like GitHub, YouTube notifiers and status pages use them to post updates without a full bot.

The catch is in how they work. Discord's webhook developer docs describe executing a webhook as a request to its URL with the token in it, and no Discord login is needed. Anyone who has the URL can post as that webhook, with any name and avatar they like, as often as Discord's rate limits allow. The URL is the password.

How webhooks get abused

Leaked URLs. A webhook URL pasted in a public GitHub repo, a screenshot, a shared bot config or a support ticket can be found and used to spam your channel, including @everyone pings if the webhook is allowed to mention.
Fake announcements. Because a webhook can use any name and avatar, an attacker can post a message that looks like it came from your staff or your bot, usually with a scam link.
Backdoors after a hack. When a staff account is taken over, attackers often create a webhook. Fixing the account doesn't remove it, so the spam keeps coming later.
Too many people with Manage Webhooks. Every role with that permission can create a webhook and read existing webhook URLs in the channels it can manage.

Webhook security checklist

Limit Manage Webhooks. Only admins and the bots that really need it. Never give it to @everyone. Our permissions checker flags it in any permission number or bot invite link.
Review webhooks regularly. Server Settings → Integrations lists every webhook and who created it. Delete the ones nothing uses.
Treat URLs like passwords. Keep them in environment variables or a secrets store, not in code you commit or files you share.
Leaked a URL? Replace it. Delete the webhook and make a new one. Changing its name doesn't change the URL.
Check after any incident. After a raid, nuke or hacked mod account, look for webhooks created during it.
Mind the mentions. If an integration doesn't need to ping @everyone, post it in a channel where @everyone mentions are off.

Guardian watches webhook creation and replaces a spamming webhook with a fresh URL.

Add ESN Guardian

How ESN Guardian protects your webhooks

Anti-nuke watches webhooks. Webhook creation is one of the actions Guardian's anti-nuke counts. An account that starts creating webhooks in a hurry is stopped like any other nuker.
Webhook rotate (Watchtower). When a webhook starts spamming, Watchtower can delete it and recreate it with the same name, avatar and channel, so your integration keeps its look while the leaked URL stops working. By default staff get a Rotate button in the log; /watchtower set lets it do this on its own.
Webhook copies in snapshots. Guardian's snapshots keep the webhook list, so after a cleanup you know what used to exist.
Grade and audit. The security grade and /audit run flag roles with Manage Webhooks and channels where @everyone can create webhooks, two of the most common weak spots.

Set it up

Add Guardian and run /guardian setup.
Run /watchtower status to see the webhook guard and how it is set.
Run /audit run and fix any Manage Webhooks findings it shows.
Take a snapshot with /snapshot take so you have a copy of your current webhook list.

Sources: Discord's Intro to Webhooks article and webhook developer docs. Checked November 3, 2026.

Questions

Can anyone use my Discord webhook URL?

Yes. Anyone who has the URL can post through the webhook without logging in. Treat it like a password, and delete and recreate the webhook if it leaks.

How do I stop webhook spam on Discord?

Delete the spamming webhook and create a new one, remove Manage Webhooks from roles that don't need it, and review Server Settings → Integrations for webhooks you don't recognise. Guardian can rotate a spamming webhook to a new URL for you.

Does renaming a webhook change its URL?

No. Only deleting and recreating the webhook gives it a new URL.

Who can see webhook URLs in my server?

Members with the Manage Webhooks permission can see and create webhooks in the channels they manage, so keep that permission to admins and the bots that need it.

Running your own Discord bot? ESN Hosting runs Discord bots 24/7, from $0.50/mo →