Secure inbound webhooks with HMAC, rate limits, audit logs, and Slack alerts
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 19 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Slack.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Set - Security Config (Edit Fields (Set)): sets 14 fields: hmacSecret, signatureHeaderName, signaturePrefix…
- Code: runs custom JavaScript code
- Code: runs custom JavaScript code
- If: checks a condition and branches into true / false
- Respond - Rate Limited (429) (Respond to Webhook): sends the response back to the webhook caller
- Code: runs custom JavaScript code
- Code: runs custom JavaScript code
- Code: runs custom JavaScript code
- Code: runs custom JavaScript code
- Code: runs custom JavaScript code
…plus 7 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (8)
- Webhook
n8n-nodes-base.webhook - Edit Fields (Set)
n8n-nodes-base.set - Code
n8n-nodes-base.code - If
n8n-nodes-base.if - HTTP Request
n8n-nodes-base.httpRequest - No Operation, do nothing
n8n-nodes-base.noOp - Respond to Webhook
n8n-nodes-base.respondToWebhook - Slack
n8n-nodes-base.slack
From the author
Quick Overview This workflow adds a hardened security layer in front of an inbound n8n webhook, applying rate limiting, HMAC signature verification, replay and timestamp protection, payload validation, optional IP allow-listing, audit logging via an HTTP…