The GEOHATS webhook for Zapier, Make, n8n and your own backend

When to use the webhook

Use it when your site runs on a platform without a direct GEOHATS integration, or when you want an automation in the middle: post to a CMS that Zapier, Make or n8n supports, send a Slack message for review, save the page to a Google Doc, or call your own API. If you are on WordPress, Webflow, Shopify, Framer, Ghost, HubSpot, Wix or GitHub, a direct integration is simpler.

Setup

1. Create a catch hook: Webhooks by Zapier (Catch Hook) in Zapier, a Custom webhook in Make, a Webhook node in n8n, or an endpoint of your own.
2. In GEOHATS, open the website, go to Integrations, choose Webhook and paste the URL. It must be https.
3. GEOHATS sends a ping event. If your endpoint answers with a 2xx status, the connection is saved and your signing secret is shown. Copy it then.
4. Pick an auto-publish mode for the website: Off, Send as draft or Publish live (see auto-publish modes).

Events

Payload: pages

{
  "event": "page.publish",
  "sentAt": "2026-10-23T09:14:02.511Z",
  "page": {
    "title": "Best invoicing software for freelancers",
    "slug": "best-invoicing-software-for-freelancers",
    "excerpt": "A short summary taken from the page...",
    "bodyHtml": "<article>...</article>",
    "fullHtml": "<!doctype html><html>...</html>",
    "jsonLd": ["{\"@context\":\"https://schema.org\", ...}"],
    "status": "publish"
  }
}

Only pages that passed the GEOHATS quality gate are sent. The values above are illustrative; the structure is exact.

Payload: SEO fixes

{
  "event": "seo.fix",
  "sentAt": "2026-10-23T09:20:41.007Z",
  "fix": {
    "type": "meta_description",
    "pageUrl": "https://yoursite.com/pricing",
    "target": "",
    "value": "Plans for teams of every size...",
    "anchor": "",
    "revert": false
  }
}

• type is one of title, meta_description, canonical, faq_schema, article_schema, org_schema, image_alt or internal_link.
• target is the image src for image_alt or the link destination for internal_link; anchor is the phrase that becomes the link.
• value is the text, canonical URL, JSON-LD block or alt text to write.
• An undo arrives with revert: true. GEOHATS cannot read the previous value through a webhook, so the value it sends on undo is empty; your automation decides how to restore.

The fixes come from the site optimizer.

Verify the signature

When you connect, GEOHATS generates a random signing secret. Every request carries the header X-Geohats-Signature: sha256=<hex>, where the hex is the HMAC-SHA256 of the raw request body keyed with that secret. Recompute it and compare with a constant-time check. Verify the raw bytes before parsing: parsing and re-serializing the JSON can change them.

import crypto from "node:crypto";

// rawBody must be the exact bytes GEOHATS sent: verify BEFORE parsing JSON.
export function verifyGeohats(rawBody, signatureHeader, secret) {
  const expected =
    "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const got = Buffer.from(signatureHeader ?? "");
  const want = Buffer.from(expected);
  return got.length === want.length && crypto.timingSafeEqual(got, want);
}

// app/api/geohats/route.js (Next.js route handler)
import { verifyGeohats } from "./verify";

export async function POST(req) {
  const raw = await req.text();
  const ok = verifyGeohats(
    raw,
    req.headers.get("x-geohats-signature"),
    process.env.GEOHATS_WEBHOOK_SECRET,
  );
  if (!ok) return new Response("Bad signature", { status: 401 });

  const evt = JSON.parse(raw);
  if (evt.event === "page.publish") {
    // Create or update your post keyed by evt.page.slug, then return its URL.
    return Response.json({ url: `https://yoursite.com/blog/${evt.page.slug}` });
  }
  return Response.json({ ok: true }); // ping, page.draft, seo.fix
}

In Zapier, Make or n8n, verifying is optional. If your automation can run a code or crypto step, recompute the HMAC there the same way. If it cannot, keep the webhook URL private, because anyone who has it can send requests to it.

Your response

• Any 2xx status means success. Anything else is reported as a failed publish, and the page stays in GEOHATS to retry.
• Return the live URL on page.publish with a JSON body like {"url": "https://yoursite.com/blog/slug"}. GEOHATS records it if it starts with http(s) and is on a different host than the webhook URL (so echo services that return the request URL are ignored). That URL is what GEOHATS watches for citations in later scans.
• Answer within 20 seconds. GEOHATS stops waiting after that. If your automation takes longer, reply first and do the slow work afterwards.

Security notes

The webhook URL must be https, and GEOHATS refuses URLs that resolve to private or cloud-metadata network addresses. The connection settings, including the secret, are stored encrypted.

Related

• All publishing integrations
• WordPress publishing and the Connector plugin
• The GEOHATS MCP server, to publish from Cursor or Claude Code
• The AI content writer that produces the pages
• MCP servers for AI visibility compared

FAQ

Last updated October 24, 2026