Webhook System

The OC Magento Bridge plugin sends signed HTTP POST requests to Magento whenever WordPress content changes. Magento uses these webhooks to purge only the affected cache entries, keeping cached content fresh without full cache flushes.

WordPress Hooks That Trigger Webhooks

WordPress Hook	Event Sent	Object Type
save_post	post_created or post_updated	post or page
delete_post	post_deleted	post or page
wp_update_nav_menu	menu_updated	nav_menu
edited_term	term_updated	category or post_tag
delete_term	term_deleted	category or post_tag

Post revisions and autosaves do not trigger webhooks.

Webhook Payload

{
  "event": "post_updated",
  "object_type": "post",
  "object_id": 42,
  "slug": "my-post-slug",
  "timestamp": 1700000000
}

HMAC-SHA256 Signing

Each webhook is signed using the API key as the HMAC secret. The signature is sent in the X-OC-Bridge-Signature header:

X-OC-Bridge-Signature: abc123def456...

On the Magento side, Controller/Webhook/CachePurge.php verifies the signature by computing the HMAC-SHA256 of the raw request body using the stored API key and comparing with hash_equals().

Magento Webhook Endpoint

The Magento webhook controller listens at:

POST /wordpress/webhook/cachepurge

Enter this URL in the WordPress plugin settings as the Magento Webhook URL.

Non-Blocking Delivery

Webhooks are sent using wp_remote_post() with blocking: false. This means the webhook is dispatched asynchronously - WordPress does not wait for Magento’s response before continuing. The webhook timeout is 10 seconds.

Cache Tag Mapping

After verifying the webhook signature, Magento maps the object_type to cache tags and purges them:

object_type	Cache Tags Purged
post	WORDPRESS_POST, WORDPRESS_POST_{object_id}
page	WORDPRESS_POST, WORDPRESS_POST_{object_id}
category	WORDPRESS_CATEGORY
post_tag	WORDPRESS_TAG
nav_menu	WORDPRESS_MENU