CI-integrated webhooks for automated re-audits.

// Why this matters

SEO regressions ship silently.

Most SEO regressions are caused by deploys that change something the team did not realize affected SEO: a CSS change that breaks Core Web Vitals, a robots.txt edit that accidentally blocks a crawler, a template refactor that drops schema. None of these surface until the next manual audit, often weeks later. By then the damage is real and attribution is hard. CI-integrated webhooks fix the problem: every deploy triggers an audit, score regressions surface immediately in Slack, attribution is automatic.

// Before you start

What you need.

• Crawlux Pro or Team tier. Webhook callbacks require Pro or higher. The free tier produces audit JSON but does not POST callbacks.
• A webhook endpoint you control. Node, Python, Go, anything that can receive a POST and return 200 in under 5 seconds. The tutorial uses Node + Express examples.
• A Slack workspace with incoming webhooks. For the alert step. Create one at api.slack.com/messaging/webhooks.

// Step 1 of 5

Configure the Crawlux webhook.

In the Crawlux dashboard under Settings → Webhooks, create a new webhook. URL points to your endpoint. Subscribe to audit.completed and audit.failed events. Crawlux generates the signing secret; store it as CRAWLUX_WEBHOOK_SECRET in your environment.

// Step 2 of 5

Build the webhook handler.

The handler verifies the signature, parses the audit JSON, compares against the previous audit, and posts to Slack if the score regressed.

const express = require("express");
const crypto = require("crypto");
const fetch = require("node-fetch");

const app = express();
app.use(express.json({ verify: (req, _, buf) => { req.rawBody = buf; } }));

function verifySignature(rawBody, sig, secret) {
  const expected = crypto.createHmac("sha256", secret)
    .update(rawBody).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(sig.replace("sha256=", ""), "hex")
  );
}

app.post("/webhooks/crawlux", async (req, res) => {
  // 1. Verify signature
  const sig = req.headers["x-crawlux-signature"];
  if (!verifySignature(req.rawBody, sig, process.env.CRAWLUX_WEBHOOK_SECRET)) {
    return res.status(401).send("invalid signature");
  }

  // 2. Return 200 immediately
  res.status(200).send("ok");

  // 3. Process asynchronously
  const audit = req.body;
  const previous = await db.lastAudit(audit.domain);
  const delta = audit.score.overall - (previous?.score?.overall ?? audit.score.overall);
  await db.saveAudit(audit);

  // 4. Alert on regression > 5 points
  if (delta <= -5) {
    await postToSlack({
      domain: audit.domain,
      previous_score: previous.score.overall,
      current_score: audit.score.overall,
      delta,
      top_findings: audit.findings.slice(0, 3)
    });
  }
});

app.listen(3000);

// Step 3 of 5

Format the Slack alert.

Slack alerts should surface the score drop, the deploy that probably caused it, and the top 3 findings to investigate. Use Block Kit for readable formatting:

async function postToSlack({ domain, previous_score, current_score, delta, top_findings }) {
  const blocks = [
    {
      type: "header",
      text: { type: "plain_text", text: `SEO regression on ${domain}` }
    },
    {
      type: "section",
      fields: [
        { type: "mrkdwn", text: `*Previous score:*\n${previous_score}` },
        { type: "mrkdwn", text: `*Current score:*\n${current_score} (${delta})` }
      ]
    },
    {
      type: "section",
      text: {
        type: "mrkdwn",
        text: "*Top findings to investigate:*\n" +
              top_findings.map(f => `• ${f.title} (analyzer ${f.analyzer})`).join("\n")
      }
    }
  ];

  await fetch(process.env.SLACK_WEBHOOK_URL, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ blocks })
  });
}

// Step 4 of 5

Trigger audits from your deploy pipeline.

After each production deploy, call the Crawlux dashboard's manual audit trigger via the dashboard URL (or, once the API ships Q4 2026, via POST /audits). GitHub Actions example:

name: Post-deploy Crawlux audit

on:
  workflow_run:
    workflows: ["Deploy Production"]
    types: [completed]

jobs:
  trigger-audit:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Trigger Crawlux audit
        run: |
          # Pre-API: trigger via dashboard URL with auth
          curl -X POST "https://www.crawlux.com/api/dashboard/audits" \
            -H "Authorization: Bearer ${{ secrets.CRAWLUX_DASHBOARD_TOKEN }}" \
            -d '{"domain": "yourdomain.io"}'
          # Post-Q4 2026: use the API endpoint
          # curl -X POST https://api.crawlux.com/v1/audits ...

// Step 5 of 5

Test the full loop.

Three-step test before relying on the alerting:

1. Manual audit trigger. Trigger an audit from the Crawlux dashboard. Confirm your webhook handler receives the POST, verifies the signature, and returns 200.
2. Force a regression. Deploy a change you know damages SEO (add Disallow: / to robots.txt temporarily). Trigger an audit. Confirm the Slack alert fires with the expected score drop.
3. Roll back the test. Remove the bad change. Trigger another audit. Score returns to baseline. No alert fires (delta should be small or positive).

// Going further

What else you can wire up.

• Block deploys on critical regressions. Score drops over 15 points usually indicate a breaking change. Wire the audit into a deploy-gate check.
• Per-environment audits. Audit staging separately from production. Catch regressions before they ship.
• Auto-create issues. When alerts fire, auto-create a GitHub issue with the top 3 findings as the description.
• Dashboard integration. POST the audit JSON to your internal observability dashboard alongside other deploy metrics.

// Related

More reading.

• Webhooks documentation — full reference for payload shape and signature verification
• Audit JSON output — the schema your handler processes
• REST API reference — Q4 2026 endpoint surface
• SDKs — Node and Python SDKs with built-in signature verification