WhatsApp Webhooks Explained for Business Owners

If you have ever asked your developer "why did that customer message not reach our CRM", the answer is almost always webhooks. You do not need to write code to understand them, and understanding them will save you a very expensive afternoon one day.

What a webhook actually is

Normally your software asks a service for new data: "any new messages? any new messages?" That is polling, and it is slow and wasteful.

A webhook flips it. You give Meta a web address of yours, and whenever something happens — a customer messages you, a message is delivered, someone reads it — Meta sends that event to your address within a second. Your system does not ask; it gets told.

Everything real-time in a WhatsApp CRM depends on this: chats appearing in the inbox, delivery ticks, read receipts, bot replies, auto-assignment.

The five events that matter to a business

• Message received — a customer wrote to you. This is the one that fills your inbox.
• Message sent, delivered, read — the ticks. Your reports are built on these.
• Message failed — the one people ignore until a campaign goes nowhere.
• Template status — your template was approved or rejected by Meta.
• Quality or limit change — your number's rating changed, or your messaging limit moved.

That last one deserves attention. If nobody is watching it, the first sign of trouble is a campaign that will not send.

What goes wrong, in the order it actually happens

1. The SSL certificate expires. Meta refuses to deliver to an address with a bad certificate. Messages stop appearing, and nothing in your inbox explains why.
2. The server is slow. If your endpoint does not answer quickly, Meta treats it as failed and retries. Keep the endpoint dumb and fast: accept the event, store it, process later.
3. Someone changes the URL during a site migration and forgets this one setting.
4. Duplicate events. Meta can send the same event more than once. If your system is not checking the message ID, customers get two replies from your bot.
5. Silent token expiry. The access token behind the integration expires and nobody is alerted.

What Meta does when your server is down

It retries, with increasing gaps, for a limited period. Short outages are usually invisible to you because the events arrive late rather than never. Long outages mean lost events — customer messages that never reached your system at all, with no error anywhere for your staff to see.

This is why uptime on that one endpoint matters more than uptime on your website.

Three questions to ask whoever built your setup

1. "What happens if the webhook endpoint is down for an hour?" The answer should mention retries and a way to reconcile missed messages.
2. "How do we know if it stops working?" The answer should be an alert, not "a customer will tell us".
3. "Are we checking for duplicate events?" The answer should be yes, by message ID.

If you are comparing platforms rather than building, these are also fair questions for a vendor — see our comparison of WhatsApp CRM software.

The short version

A webhook is Meta telling your system that something happened. It is the plumbing behind every real-time feature you paid for. You do not need to understand the code, but you do need someone to be alerted when it breaks — because when it breaks, nothing looks broken. The messages simply stop.

Frequently Asked Questions

What is a WhatsApp webhook in simple terms?

It is a web address you give Meta so that it can notify your system the moment something happens — a customer messages you, a message is delivered or read, or a template is approved. Without it, your inbox would have to keep asking Meta for updates instead of being told instantly.

Why did our WhatsApp messages stop reaching our CRM?

The most common causes are an expired SSL certificate on the webhook address, a slow or down server, or a URL that changed during a website migration. In each case Meta cannot deliver the event, and nothing in your inbox shows an error.

Can we lose customer messages because of a webhook problem?

Yes. Meta retries for a limited period, so short outages only cause delays, but a long outage means events are dropped and those customer messages never reach your system. This is why the endpoint needs its own uptime alert.