Discord Webhook Deleter

When a webhook is still needed but its URL is compromised, the sequence matters. Create the replacement first, update every consumer, verify the new one posts, and only then delete the old one - reversing that order leaves a gap where nothing works.

Consumers are easy to lose track of. A webhook set up for a CI pipeline may also be referenced by a monitoring script and a status page, and deleting it silently breaks the ones nobody remembered.

Keeping a note of what each webhook feeds, in the webhook name itself, makes this tractable. Discord shows the name in channel settings, and a name like 'ci-build-alerts' answers the question that an auto-generated one does not.

A webhook URL contains its own token, and there is no rotation mechanism. If the URL leaks, the only remedy is deleting the webhook - which immediately breaks anything legitimately using it, so replacing it means creating a new one and updating every consumer.

Deletion can be done from channel settings with Manage Webhooks, or by sending a DELETE request to the webhook URL itself. The second works without any server permission, because possession of the token is the authorisation.

That second route is worth understanding: anyone holding a leaked URL can delete the webhook as easily as post to it. A leaked webhook is not only a spam risk but a denial-of-service one against whatever depended on it.

Webhooks accumulate. Integrations get set up, abandoned and forgotten, and each one remains a live posting route into a channel indefinitely. Channel settings lists every webhook on a channel, including ones created by bots and by other members.

A periodic review is worth doing on any server with integrations, and the question for each entry is simply whether you can name what uses it. Anything you cannot account for should be deleted - if something breaks, it was easier to find out this way than by discovering the URL in a public repository.

Old integrations leak webhook URLs all the time. If a URL was shared publicly or in a commit, deleting the webhook is the fastest way to stop people posting to the channel.