Every submission, pushed to your own endpoint as signed JSON — the second it happens. Your CRM, your automation tool, your rules.
{
"event": "form_submission",
"submission_id": "8f3c-4a9e-77b1",
"form": { "id": 12, "title": "Contact" },
"fields": {
"email": { "value": "jane@example.com" }
},
"consent": { "accepted": true }
}
A webhook is the shortest path between a form and the rest of your stack. The moment someone submits, QueryCue sends the answers to a URL you choose as a plain JSON POST. What sits at the other end is up to you — an n8n or Make scenario, a Zapier catch hook, your own CRM endpoint, a Slack relay you wrote yourself.
The payload is straightforward on purpose: the event, a submission reference, the form’s ID and title, the timestamp, and every answer with its label and value. If the visitor gave a required consent, the consent record travels with it — the exact wording they agreed to, a version hash of that text, the privacy URL and the time. Your CRM doesn’t just get the lead; it gets the proof.
Set one endpoint globally, or give a single form its own URL — or switch the webhook off for that form entirely. And because the webhook fires whether or not you store submissions in WordPress, you can run forms that never keep a copy at all: the data passes straight through to your system and leaves nothing behind.
Most webhook plugins fire and forget: they send the request and never look at the answer, so the day your endpoint returns a 500, the leads simply stop arriving and nobody notices. QueryCue reads the response. A failed delivery is retried, written to a log you can look at, and — if it still doesn’t get through — reported to you in the WordPress admin.
Settings → Webhook: one field for the URL, and a button that sends a test payload right away so you see the receiver’s answer. A typo in the URL surfaces while you’re setting it up, not on your first real lead. Add a signing secret if you want one — stored encrypted, never shown again.
Any form can point at its own URL from the builder’s properties panel — or opt out of the webhook completely. Applications to one system, contact requests to another.
The submission is validated and the payload is queued — encrypted — then delivered right after the visitor’s request has finished. They never wait on your endpoint, no matter how slow it is.
QueryCue reads the response. A 2xx and it’s done. Anything else — an error, a timeout, an endpoint that’s briefly down — and it tries again: three attempts, immediately, after a minute, after half an hour. Every attempt lands in the delivery log, and if all of them fail, you get told.
The payload is queued and sent after the visitor’s request is done. Your automation tool having a slow morning cannot delay — or fail — someone’s submission. The form says thank you either way.
Failed deliveries are retried three times, every attempt is logged with its HTTP status, and a lead that still doesn’t arrive raises a red notice in your admin. No silent losses.
The agreed wording, its version hash and the timestamp ride in the payload. The system that stores the lead also stores the evidence that you were allowed to.
Set a shared secret and every request carries X-QCF-Signature: sha256=… — an HMAC-SHA256 over the exact body. Your endpoint recomputes it and rejects anything that doesn’t match, so nobody can forge a lead into your CRM. The secret itself is stored encrypted and never sent to a browser.
The other direction matters just as much: a webhook URL is an outbound request made by your server, which is exactly what an attacker wants (SSRF). QueryCue treats every target as hostile until proven otherwise — only http/https, the hostname resolved (IPv4 and IPv6), and every resulting address checked, on every attempt. Private and reserved ranges are refused: localhost, your LAN, and the cloud metadata address that leaks provider credentials. Redirects are not followed, so a 302 can’t smuggle the request somewhere else.
Hosting your automation tool inside your own network on purpose? One filter — qcf_webhook_allow_url — lets you allow that specific target, deliberately, in code. And qcf_webhook_payload lets you reshape the JSON to whatever schema your CRM expects. The defaults stay safe.
The webhook is one exit. Combine it with the others — or replace them:
Signed JSON to any endpoint you choose, per form, retried and logged — without slowing anyone down. Webhooks come with Pro.