What GitHub Hookshot does
GitHub webhooks send an HTTP POST with a JSON or URL-encoded payload to a configured endpoint whenever a subscribed event occurs, covering activity such as push, pull_request, issues, workflow runs, releases, deployments, and security alerts. Payloads are capped at 25 MB, and events that generate larger payloads are not delivered. Each delivery includes identifying headers such as X-GitHub-Event and X-GitHub-Delivery, and the User-Agent always begins with the prefix GitHub-Hookshot/.
How to identify GitHub Hookshot
Temso identifies GitHub Hookshottraffic by matching the request's User-Agent header against this pattern. User-agent strings can be spoofed, so treat a match as an indication, not proof.
GitHub-Hookshot\/GitHub Hookshot FAQ
What is GitHub Hookshot?
GitHub-Hookshot is the User-Agent prefix on GitHub's webhook deliveries, the HTTP POST requests GitHub sends to a configured endpoint when events such as push, pull_request, or issues occur in a repository or organization.
Can I block GitHub Hookshot with robots.txt?
No. GitHub webhook deliveries are not crawler traffic; they are sent only to endpoints that someone configured a webhook for on GitHub, so robots.txt does not apply. To stop them, delete or edit the webhook configuration on GitHub that targets your URL.
About Operational Bots
Monitoring, security scanning, link previews, webhooks, and feed fetchers: the utility traffic that keeps integrations and shared links working.
Most of this traffic is service-critical or user-triggered. Webhooks and previews don't follow robots.txt, and blocking them tends to break things you rely on.
