Connect your site to SiteOps

// app/siteops-webhook/route.js — a Next.js route handler (Node runtime)
import crypto from "node:crypto";

const SECRET = process.env.SITEOPS_WEBHOOK_SECRET; // whsec_…

function signatureOk(raw, header) {
  const expected =
    "sha256=" + crypto.createHmac("sha256", SECRET).update(raw).digest("hex");
  const a = Buffer.from(header || "");
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

export async function POST(request) {
  // the exact bytes that arrived — check BEFORE parsing
  const raw = Buffer.from(await request.arrayBuffer());
  if (!signatureOk(raw, request.headers.get("x-siteops-signature"))) {
    return Response.json({ error: "bad signature" }, { status: 401 });
  }
  const delivery = request.headers.get("x-siteops-delivery");
  const post = JSON.parse(raw.toString("utf8"));

  const seen = await findDelivery(delivery); // your storage
  if (seen) return Response.json({ url: seen.url, duplicate: true });

  // create or update by (slug, locale); keep post.seo with the page
  const url = await upsertPost(post); // your storage → the page's public address
  await rememberDelivery(delivery, url);
  return Response.json({ url });
}

# Flask — the check itself is the same in any Python framework
import hashlib, hmac, json, os
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["SITEOPS_WEBHOOK_SECRET"].encode()  # whsec_…

def signature_ok(raw: bytes, header: str) -> bool:
    expected = "sha256=" + hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected.encode(), (header or "").encode())

@app.post("/siteops-webhook")
def siteops_webhook():
    raw = request.get_data()  # the exact bytes, before any JSON parsing
    if not signature_ok(raw, request.headers.get("X-SiteOps-Signature", "")):
        return {"error": "bad signature"}, 401
    delivery = request.headers.get("X-SiteOps-Delivery")
    post = json.loads(raw)

    seen = find_delivery(delivery)  # your storage
    if seen:
        return {"url": seen.url, "duplicate": True}

    # create or update by (slug, locale); keep post["seo"] with the page
    url = upsert_post(post)  # your storage → the page's public address
    remember_delivery(delivery, url)
    return {"url": url}

POST /siteops-webhook HTTP/1.1
Host: yoursite.com
Content-Type: application/json
X-SiteOps-Signature: sha256=922a3e7c1f54eb73aa8eba6c08269b8c567b588328152a2094eb96b7b113710c
X-SiteOps-Delivery: 5b0e2c1a-8f3d-4e6b-9a27-3c4d5e6f7a81

{"event":"post_published","html":"<p>Hello from SiteOps.</p>","locale":"en","publish_at":"2026-09-30T09:00:00Z","slug":"first-note","title":"Our first note","type":"post"}

HTTP/1.1 200 OK
Content-Type: application/json

{"url":"https://yoursite.com/blog/first-note"}

HTTP/1.1 200 OK
Content-Type: application/json

{"url":"https://yoursite.com/blog/first-note","duplicate":true}

Implement the SiteOps publishing webhook on my site (stack: <e.g. Next.js app router, WordPress, Rails>). The full contract is at https://siteops.me/guides/site-webhook.

1. Add a POST route at /siteops-webhook on the live, public domain, over https. SiteOps never follows a redirect, so the route must answer at the exact address saved in SiteOps (no http→https, apex→www or trailing-slash redirect in front of it).
2. Verify the X-SiteOps-Signature header before parsing anything: it is "sha256=" plus the hex HMAC-SHA256 of the raw request body, keyed with the whsec_ secret in the environment variable SITEOPS_WEBHOOK_SECRET. Compare in constant time; on a mismatch answer 401 and store nothing.
3. Deduplicate by the X-SiteOps-Delivery header only: if that id was stored before, answer 200 {"url": <the page's url>, "duplicate": true} and change nothing.
4. Parse the JSON. Always present: type ("post"), slug, title, html, publish_at, event ("post_published"). Optional: markdown, subtitle, locale, translation_group, canonical, assets [{url, alt, role}], alternates [{locale, url}], seo.
5. Create or update the post by (slug, locale) — an existing slug and locale is an edit of that page. On a create, use publish_at as the post's date; on an update keep the stored date (publish_at is then the modified time). Wrap html in the site's post template, and style <figure> and <figcaption> there (a picture with a line under it arrives as one). Store seo with the page whenever a delivery carries it — a delivery without seo keeps the stored head, never blank it — and render it into <head>: title, meta description, meta keywords, canonical, og:* tags (image_alt as og:image:alt), twitter:* tags, json_ld as an application/ld+json script, alternates as hreflang links.
6. Answer 200 {"url": "<the page's public address>"} within 20 seconds. Do slow work after answering — image processing, rebuilds, and the sitemap and IndexNow updates the site owns. If a retry arrives while the same delivery is still being stored, answer 503 with Retry-After: 5.
7. The site owns indexing: add the page to the sitemap and ping IndexNow once it is live — SiteOps does not.
8. Test the signature check with the sample delivery on the guide page: it must pass, and fail when one byte of the body changes.