Protecting webhooks