What Razorpay Webhook does
Razorpay Webhook notifies merchant applications when events occur on a Razorpay account, such as payment.authorized, payment.failed, and order.paid. When a subscribed event fires, Razorpay sends an HTTP POST request with a JSON payload to the endpoint URL the merchant configured in the Dashboard, instead of requiring the application to poll APIs. Webhook URLs must use port 80 or 443, and Live and Test modes use separately configured URLs, with Test mode receiving events only for test transactions.
How to control Razorpay Webhook
Target Razorpay Webhook in your robots.txt with the Razorpay token. Rules apply per bot, so you can allow this one while blocking others, or the reverse.
Allow Razorpay Webhook
User-agent: Razorpay
Allow: /Block Razorpay Webhook
User-agent: Razorpay
Disallow: /Razorpay publishes a list of webhook source IP addresses so receiving servers can allowlist webhook traffic.
How to identify Razorpay Webhook
Temso identifies Razorpay Webhooktraffic by matching the request's User-Agent header against this pattern. User-agent strings can be spoofed, so treat a match as an indication, not proof.
RazorpayRazorpay Webhook FAQ
What is Razorpay Webhook?
Razorpay Webhook is the mechanism Razorpay uses to push event notifications to merchant applications. When a subscribed event such as a payment or order update occurs, Razorpay sends an HTTP POST request with a JSON payload to the endpoint URL configured in the merchant's Dashboard.
How do I block Razorpay Webhook?
You can add a robots.txt group with "User-agent: Razorpay" and "Disallow: /", but webhook deliveries only go to endpoint URLs that were configured in a Razorpay Dashboard. The reliable way to stop them is to remove or disable that webhook configuration, or block the traffic at your server.
About Operational Bots
Monitoring, security scanning, link previews, webhooks, and feed fetchers: the utility traffic that keeps integrations and shared links working.
Most of this traffic is service-critical or user-triggered. Webhooks and previews don't follow robots.txt, and blocking them tends to break things you rely on.
