Postback is a simple HTTP callback. After a successful vote we request your URL with the player parameter and their IP. Your script marks that account as having voted and grants points or items.
Security: whitelist this website’s public IP in your firewall and in your postback script. Reject every other source. Prefer HTTPS.
1. Set your Postback URL
Dashboard → Edit server → Vote Rewards → Postback URL:
https://YOURDOMAIN/postback.php
- The filename is arbitrary — use any path your stack prefers.
- Only public
http/https URLs are accepted.
- Localhost, private LAN IPs, and URL credentials are rejected (SSRF protection).
- We follow a small number of redirects and time out after a few seconds so voting stays fast.
2. Build incentive voting links
Append a parameter so each player is identified when they land on the vote page:
/GAME/server/SLUG/vote?p=PARAMETER
Replace GAME and SLUG with your listing values. Your server edit page shows the exact URL for that listing.
| Piece |
Rules |
PARAMETER / p_resp |
Letters, numbers, _, - only · max 32 characters · username, account id, or any id you track |
ip |
IPv4 or IPv6 of the voter as seen by this list (Cloudflare / proxy aware) |
| Prefill query |
?p= or ?username= on the vote URL |
3. What we call after a vote
Only on success:
https://YOURDOMAIN/postback.php?p_resp=PARAMETER&ip=USERIP
If the player did not complete a valid vote, we send no request.
Worked examples
| Incentive link |
Our callback |
/minecraft/server/your-server-slug/vote?p=1234 |
…/postback.php?p_resp=1234&ip=123.123.123.123 |
/minecraft/server/your-server-slug/vote?p=Razor |
…/postback.php?p_resp=Razor&ip=123.123.123.123 |
Conclusion: when we hit your postback with p_resp=Razor, player Razor has voted. The ip value is the address they used on this list — useful for your own abuse checks.
What your script should do
- Verify the request comes from this list’s public IP.
- Sanitize
p_resp and ip (never trust raw input).
- Confirm the account / character exists in your database.
- Apply your own reward cooldown if you need something stricter than 24 hours.
- Grant points, coins, or items; log the event; return HTTP 200.
postback.php example
Host this on your domain (the rewards site), not necessarily on this vote list. Set VOTE_LIST_IP to this website’s outbound public IP before going live. Turn DEBUG on while testing.
/**
* Example vote postback receiver for YOUR game website / CMS.
*
* Configure this URL on your listing under Dashboard → Edit server → Vote Rewards.
* This list will call it ONLY after a successful vote:
*
* https://yoursite.com/postback.php?p_resp=PARAMETER&ip=USERIP
*
* PARAMETER is the username / account id the player entered on the vote form
* (or the value from ?p= on your incentive voting link).
*
* Docs: /voting-check
*/
define('DEBUG', 0); // set to 1 to write _postback.log
define('LOG_FILE', __DIR__ . '/_postback.log');
/**
* Only accept callbacks from the vote list's public IP.
* Leave empty to skip the allowlist (not recommended in production).
*
* Example: define('VOTE_LIST_IP', '203.0.113.10');
*/
define('VOTE_LIST_IP', '');
$ipRequest = $_SERVER['HTTP_CF_CONNECTING_IP']
?? (isset($_SERVER['HTTP_X_FORWARDED_FOR'])
? trim(explode(',', (string) $_SERVER['HTTP_X_FORWARDED_FOR'])[0])
: null)
?? $_SERVER['REMOTE_ADDR']
?? '';
$ipRequest = trim((string) $ipRequest);
if (VOTE_LIST_IP !== '' && $ipRequest !== VOTE_LIST_IP) {
if (DEBUG) {
error_log(date('[Y-m-d H:i] ') . "[Invalid] Request from {$ipRequest}" . PHP_EOL, 3, LOG_FILE);
}
http_response_code(403);
exit('Forbidden');
}
if (DEBUG) {
error_log(date('[Y-m-d H:i] ') . "[OK] Valid callback: {$ipRequest}" . PHP_EOL, 3, LOG_FILE);
}
// Clean parameters from the vote list (letters, numbers, underscore, hyphen).
$p = preg_replace('/[^A-Za-z0-9_\-]+/', '', (string) ($_GET['p_resp'] ?? '')) ?? '';
$userIp = preg_replace('/[^0-9a-fA-F:\.]+/', '', (string) ($_GET['ip'] ?? '')) ?? '';
if ($p === '') {
http_response_code(400);
exit('Missing p_resp');
}
if (DEBUG) {
error_log(date('[Y-m-d H:i] ') . "[GET] Parameters [p_resp]={$p} [ip]={$userIp}" . PHP_EOL, 3, LOG_FILE);
}
// ---------------------------------------------------------------------------
// Connect to your database, verify account $p exists, enforce your own
// cooldown if needed, then grant vote points / items to $p (voted from $userIp).
// We send p_resp + ip ONLY when that player successfully voted on the list.
// ---------------------------------------------------------------------------
http_response_code(200);
echo 'OK';
Same sample lives in the project as examples/postback.php.
