Publish to your own site with a webhook

{
  "title": "How to Brew Better Coffee at Home",
  "slug": "how-to-brew-better-coffee-at-home",
  "content": "Great coffee starts with fresh beans...\n\n## Choose the right grind\n\n- **French press:** coarse\n- **Espresso:** fine\n\n...",
  "metaDescription": "Learn how to brew better coffee at home with the right beans, grind size and water temperature.",
  "topics": ["Coffee Brewing", "Home Barista"],
  "tags": ["Coffee Brewing", "Home Barista"],
  "status": "published",
  "bannerUrl": "https://cdn.example.com/banners/how-to-brew-better-coffee.jpg",
  "featuredImageUrl": "https://cdn.example.com/banners/how-to-brew-better-coffee.jpg"
}

{
  "_test": true,
  "title": "LazySEO Webhook Test",
  "slug": "lazyseo-webhook-test",
  "content": "<p>This is a test payload from LazySEO to verify your webhook endpoint is working.</p>",
  "status": "draft"
}

{
  "title": "[TEST] LazySEO Test Article",
  "slug": "lazyseo-test-article",
  "content": "<h1>LazySEO Test Article</h1><p>This is a <strong>test article</strong> sent by LazySEO ...</p>",
  "metaDescription": "Test article from LazySEO integration test.",
  "status": "draft",
  "tags": ["lazyseo-test"]
}

{
  "id": "123",
  "url": "https://www.example.com/blog/how-to-brew-better-coffee-at-home"
}

// npm install express marked
const express = require('express');
const crypto = require('crypto');
const { marked } = require('marked');

const app = express();
const SECRET = process.env.LAZYSEO_SECRET; // same value as "Signing Secret" in LazySEO
const posts = new Map(); // replace with your database or CMS

// Keep the raw body: the signature is computed over the exact bytes LazySEO sent.
app.use('/lazyseo-webhook', express.raw({ type: 'application/json', limit: '10mb' }));

function hasValidSignature(rawBody, header) {
  if (!SECRET) return true; // no Signing Secret configured
  if (!header) return false;
  const expected = 'sha256=' + crypto.createHmac('sha256', SECRET).update(rawBody).digest('hex');
  const a = Buffer.from(header);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// "content" is Markdown for generated articles and HTML for articles edited
// in the LazySEO editor. Same check LazySEO uses: HTML starts with a block tag.
function contentToHtml(content) {
  const isHtml = /^\s*<(!doctype|html|head|body|div|p|h[1-6]|ul|ol|table|section|article|header|main|figure|blockquote)[\s>]/i.test(content);
  return isHtml ? content : marked.parse(content); // keeps embedded HTML such as <figure> or <iframe>
}

app.all('/lazyseo-webhook', (req, res) => {
  if (!hasValidSignature(req.body, req.get('X-Signature'))) {
    return res.status(401).json({ error: 'invalid signature' });
  }
  const data = JSON.parse(req.body.toString('utf8'));

  if (req.method === 'DELETE') {
    posts.delete(String(data.externalId));
    return res.json({ ok: true });
  }
  if (data._test) {
    return res.json({ ok: true }); // "Quick test" ping: don't create a post
  }

  // Create, or update when LazySEO sends an article again (same slug / externalId)
  const id = String(data.externalId || data.slug);
  posts.set(id, {
    title: data.title,
    slug: data.slug,
    html: contentToHtml(data.content || ''),
    excerpt: data.metaDescription || '',
    image: data.featuredImageUrl || null,
    tags: data.tags || [],
    draft: data.status !== 'published',
  });

  // Return the post id and its public URL
  res.json({ id, url: 'https://www.example.com/blog/' + data.slug });
});

app.listen(3000);

<?php
// lazyseo-webhook.php
// Needs a "posts" table with a UNIQUE index on "slug",
// and Parsedown for Markdown: composer require erusev/parsedown
require __DIR__ . '/vendor/autoload.php';
$secret = getenv('LAZYSEO_SECRET'); // same value as "Signing Secret" in LazySEO
$raw = file_get_contents('php://input');

header('Content-Type: application/json');

if ($secret) {
    $expected = 'sha256=' . hash_hmac('sha256', $raw, $secret);
    $given = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
    if (!hash_equals($expected, $given)) {
        http_response_code(401);
        echo json_encode(['error' => 'invalid signature']);
        exit;
    }
}

$data = json_decode($raw, true);
if (!is_array($data)) {
    http_response_code(400);
    echo json_encode(['error' => 'invalid JSON']);
    exit;
}

$pdo = new PDO('mysql:host=localhost;dbname=blog;charset=utf8mb4', 'db_user', 'db_password');

if ($_SERVER['REQUEST_METHOD'] === 'DELETE') {
    $pdo->prepare('DELETE FROM posts WHERE id = ?')->execute([$data['externalId'] ?? '']);
    echo json_encode(['ok' => true]);
    exit;
}

if (!empty($data['_test'])) {
    echo json_encode(['ok' => true]); // "Quick test" ping: don't create a post
    exit;
}

// "content" is Markdown for generated articles and HTML for articles edited in
// the LazySEO editor. HTML starts with a block tag; render everything else.
$content = (string) ($data['content'] ?? '');
$isHtml = preg_match('/^\s*<(!doctype|html|head|body|div|p|h[1-6]|ul|ol|table|section|article|header|main|figure|blockquote)[\s>]/i', $content);
$html = $isHtml ? $content : (new Parsedown())->text($content);

// Create the post, or update it if the slug already exists
$sql = 'INSERT INTO posts (slug, title, content, excerpt, image_url, status)
        VALUES (:slug, :title, :content, :excerpt, :image, :status)
        ON DUPLICATE KEY UPDATE title = VALUES(title), content = VALUES(content),
          excerpt = VALUES(excerpt), image_url = VALUES(image_url), status = VALUES(status)';
$pdo->prepare($sql)->execute([
    ':slug'    => $data['slug'],
    ':title'   => $data['title'],
    ':content' => $html,
    ':excerpt' => $data['metaDescription'] ?? '',
    ':image'   => $data['featuredImageUrl'] ?? null,
    ':status'  => ($data['status'] ?? '') === 'published' ? 'published' : 'draft',
]);

$stmt = $pdo->prepare('SELECT id FROM posts WHERE slug = ?');
$stmt->execute([$data['slug']]);
$id = $stmt->fetchColumn();

echo json_encode([
    'id'  => $id,
    'url' => 'https://www.example.com/blog/' . $data['slug'],
]);

<?php

namespace App\Controller;

use App\Entity\BlogPost;
use Doctrine\ORM\EntityManagerInterface;
use League\CommonMark\GithubFlavoredMarkdownConverter;
use Symfony\Component\DependencyInjection\Attribute\Autowire;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Routing\Attribute\Route;

/**
 * Receives articles from LazySEO (Webhook integration) and saves them as BlogPost.
 *
 * In LazySEO: Integrations > Add integration > Webhook
 *   Endpoint URL:   https://your-site.com/lazyseo/webhook
 *   Method:         POST
 *   Signing Secret: the same value as LAZYSEO_WEBHOOK_SECRET in your .env.local
 *
 * Needs: composer require league/commonmark
 */
final class LazySeoWebhookController
{
    public function __construct(
        private readonly EntityManagerInterface $em,
        #[Autowire('%env(LAZYSEO_WEBHOOK_SECRET)%')]
        private readonly string $secret,
    ) {
    }

    #[Route('/lazyseo/webhook', name: 'lazyseo_webhook', methods: ['POST'])]
    public function __invoke(Request $request): JsonResponse
    {
        $raw = $request->getContent();

        // 1. Verify the signature (HMAC-SHA256 of the raw body, header "X-Signature: sha256=<hex>").
        if ($this->secret !== '') {
            $expected = 'sha256=' . hash_hmac('sha256', $raw, $this->secret);
            if (!hash_equals($expected, (string) $request->headers->get('X-Signature', ''))) {
                return new JsonResponse(['error' => 'invalid signature'], 401);
            }
        }

        $data = json_decode($raw, true);
        if (!is_array($data) || empty($data['title']) || empty($data['slug'])) {
            return new JsonResponse(['error' => 'invalid payload'], 400);
        }

        // 2. LazySEO's "Quick test" sends {"_test": true}: answer OK without creating a post.
        if (!empty($data['_test'])) {
            return new JsonResponse(['ok' => true]);
        }

        // 3. "content" is Markdown for generated articles and HTML for articles edited in
        //    the LazySEO editor. Convert Markdown to HTML; keep HTML as it is.
        $content = (string) ($data['content'] ?? '');
        $isHtml = (bool) preg_match('/^\s*<(!doctype|html|div|p|h[1-6]|ul|ol|table|section|article|figure|blockquote)[\s>]/i', $content);
        $html = $isHtml ? $content : (string) (new GithubFlavoredMarkdownConverter())->convert($content);

        // 4. Create the post, or update it when LazySEO re-sends the same article.
        $repo = $this->em->getRepository(BlogPost::class);
        $post = null;
        if (!empty($data['externalId'])) {
            $post = $repo->find((int) $data['externalId']);
        }
        $post ??= $repo->findOneBy(['slug' => $data['slug']]) ?? new BlogPost();

        $post->setSlug((string) $data['slug'])
            ->setTitle((string) $data['title'])
            ->setContent($html)
            ->setExcerpt(isset($data['metaDescription']) ? (string) $data['metaDescription'] : null)
            ->setImageUrl($data['featuredImageUrl'] ?? $data['bannerUrl'] ?? null)
            ->setTags(array_values(array_filter((array) ($data['topics'] ?? $data['tags'] ?? []), 'is_string')))
            ->setStatus(($data['status'] ?? 'published') === 'draft' ? 'draft' : 'published')
            ->touch();

        $this->em->persist($post);
        $this->em->flush();

        // 5. Reply with the post id and its public URL (LazySEO stores both).
        return new JsonResponse([
            'id' => (string) $post->getId(),
            'url' => 'https://your-site.com/blog/' . $post->getSlug(),
        ]);
    }
}

// Entity (src/Entity/BlogPost.php): fields slug (unique), title, content (TEXT),
// excerpt, imageUrl, tags (JSON), status, publishedAt, updatedAt; then run
// php bin/console make:migration && php bin/console doctrine:migrations:migrate
// .env.local: LAZYSEO_WEBHOOK_SECRET=<same value as Signing Secret in LazySEO>
// security.yaml access_control (first line): - { path: ^/lazyseo/webhook, roles: PUBLIC_ACCESS }