Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To run a Telegram bot webhook on a VPS, point a DNS name at the server, expose an HTTPS endpoint on a Telegram-supported port, terminate TLS with a certificate for that exact hostname, proxy the request to a bot process listening privately on localhost, and register the URL with setWebhook. Telegram then pushes JSON Update objects to your endpoint. Verify the installation with getWebhookInfo before troubleshooting the application.
What a Telegram webhook does
A webhook is Telegram’s push-based delivery method. Instead of your bot repeatedly asking Telegram for updates with getUpdates, Telegram sends an HTTPS POST request whenever an update is available. The request body is a JSON-serialized Update object, such as a private message, command, callback query, or edited message.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Polling and webhooks are mutually exclusive for a bot. While an outgoing webhook is active, getUpdates cannot be used normally. If you want to return to polling, remove the webhook first with deleteWebhook.
The public endpoint must satisfy all of these conditions:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
- It resolves from public DNS to the VPS’s public IPv4 address. Telegram’s webhook guide states that IPv6 is not currently supported for webhook delivery.
- It uses TLS 1.2 or newer and a certificate whose Common Name (CN) or Subject Alternative Name (SAN) matches the webhook hostname.
- It listens directly on one of Telegram’s supported ports: 443, 80, 88, or 8443.
- It returns a successful HTTP response promptly. Slow work should be queued or handed to a background worker after the update has been accepted.
- It forwards the request to the bot process without relying on an HTTP-to-HTTPS redirect. Telegram’s FAQ says, “Redirects are not supported.”
Recommended VPS architecture
Keep the bot application private and let a reverse proxy handle the public connection. A typical layout is:
Telegram servers
|
| HTTPS :443
v
VPS public IPv4
|
| Nginx TLS termination
v
127.0.0.1:8080 <-- bot applicationOnly Nginx (or another reverse proxy) needs to be reachable from the internet. The application can listen on 127.0.0.1:8080, so unrelated machines cannot connect to it directly. The proxy presents the certificate, checks the request path and optional secret header, and passes the JSON body to the bot.
Recommended Free Tools
You can use a different reverse proxy or a containerized deployment, but the operational requirements remain the same: public DNS, a supported port, valid TLS, forwarding to the private process, logging, and a restart strategy.
Prerequisites: VPS, DNS, firewall, and bot process
Choose a reachable VPS
Use a VPS with a public IPv4 address and enough CPU, memory, and network capacity for your bot’s workload. Telegram’s webhook guide requires IPv4 for webhook servers. Make sure your provider’s network firewall and the operating system firewall both permit inbound TCP traffic on the port you select.
Create the DNS record
Create an A record such as bot.example.com that points to the VPS’s public IPv4 address. Wait for the record to resolve publicly before registering the webhook. The hostname in the DNS record, certificate, Nginx configuration, and setWebhook URL must be identical.
For example, check resolution from a machine outside the VPS network:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11dig +short bot.example.comThe result should include the VPS address. If it returns an old address, no address, or an address belonging to a proxy you did not configure, Telegram will not reach the intended server.
Open only the required public port
Port 443 is the usual choice because it is the standard HTTPS port. Telegram also supports 80, 88, and 8443. The selected port must be allowed by every firewall layer: the VPS provider’s security group, the host firewall, and any local container or network policy.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Run the bot privately
Start the bot’s HTTP server on a loopback address, for example 127.0.0.1:8080. Its webhook route must accept POST requests with Telegram’s JSON body and return a successful status quickly. Validate the JSON, enqueue expensive work, and respond before image processing, external API calls, or long database jobs can cause a timeout.
Do not bind the application to 0.0.0.0 unless you have a specific reason and a firewall rule that protects it. Public exposure should normally be limited to the reverse proxy.
Install and configure Nginx for the webhook
Obtain a certificate for the exact hostname
Use a trusted certificate for bot.example.com when possible. The certificate’s CN or SAN must match the hostname Telegram receives in the webhook URL. Configure Nginx with the complete certificate chain, including intermediate certificates. Serving only the leaf certificate can make Telegram reject the connection even when browsers appear to work.
Telegram states that a webhook requires SSL/TLS encryption regardless of the port. A certificate for a different subdomain, an expired certificate, or a chain missing its intermediate certificate is not sufficient.
Serve the final HTTPS endpoint directly
Do not configure the webhook URL to return a 301 or 302 redirect to another URL. Telegram does not follow redirects for webhook requests. If you operate a separate HTTP site, its redirect can remain for ordinary visitors, but the webhook’s configured URL must be the final HTTPS location and must answer directly.
Example Nginx server block
The following example uses the secret path /telegram-webhook-7f2d9c4a and forwards to a bot listening on 127.0.0.1:8080. Replace the example path, hostname, certificate locations, and upstream port with your values.
server {
listen 443 ssl http2;
server_name bot.example.com;
ssl_certificate /etc/letsencrypt/live/bot.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/bot.example.com/privkey.pem;
location = /telegram-webhook-7f2d9c4a {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}The exact-match location (location =) prevents accidental routing of similarly named paths. Test and reload Nginx after editing:
sudo nginx -t
sudo systemctl reload nginxConfirm that the bot process is listening before testing the proxy:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
ss -ltnp | grep 8080Choose a secret webhook path and request token
Use a long, unguessable path rather than a predictable route such as /webhook. Telegram recommends a secret path because an attacker who does not know the path cannot easily send arbitrary requests to the bot endpoint. Treat the path as a credential: do not publish it in documentation, screenshots, or access logs that are broadly shared.
The Bot API also supports the secret_token parameter. When configured, Telegram includes an X-Telegram-Bot-Api-Secret-Token header with every webhook request. Your application or reverse proxy should reject a request when the header is missing or does not exactly match the configured value.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The documented length range for secret_token is 1–256 characters. Generate a high-entropy value, store it in an environment variable or secret manager, and compare it using a constant-time method in application code when your framework provides one. A secret header supplements the unguessable path; it does not replace TLS.
Validate the header in the application
TELEGRAM_WEBHOOK_SECRET='store-this-outside-source-control'Your webhook handler should perform this sequence:
- Read
X-Telegram-Bot-Api-Secret-Token. - Compare it with the configured secret.
- Return an authorization failure without processing the body if the value is absent or incorrect.
- Parse and validate the JSON
Updateonly after the header passes. - Queue slow work and return a successful response promptly.
If you validate at Nginx instead, ensure the proxy still forwards valid Telegram requests and does not log the secret value.
Register the webhook with Telegram
Using a trusted certificate
Call setWebhook with the complete HTTPS URL. The token identifies the bot, so do not place it in a script committed to a repository or paste it into a public issue. Shell history and process logs can also expose command-line secrets.
curl -F "url=https://bot.example.com/telegram-webhook-7f2d9c4a"
"https://api.telegram.org/bot<YOUR_BOT_TOKEN>/setWebhook"A successful API response indicates that Telegram accepted the webhook configuration. It does not prove that your application can process a real update; use getWebhookInfo and send a test message afterward.
Using a self-signed certificate
Telegram supports a self-signed certificate when you upload the public PEM certificate during registration. The private key remains on the VPS. Telegram’s self-signed guide explicitly instructs you to upload the certificate with the certificate parameter.
curl -F "url=https://bot.example.com/telegram-webhook-7f2d9c4a"
-F "certificate=@public-cert.pem"
"https://api.telegram.org/bot<YOUR_BOT_TOKEN>/setWebhook"The certificate must still identify the webhook hostname correctly. Self-signing changes trust distribution; it does not remove the requirement for TLS or a matching name.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Optional registration parameters
When your bot needs them, pass secret_token and allowed_updates in the form data. Telegram documents max_connections from 1 to 100, with a default of 40. Increasing it can allow more simultaneous deliveries, but your application, database, and upstream services must be able to handle the resulting concurrency.
curl -F "url=https://bot.example.com/telegram-webhook-7f2d9c4a"
-F "secret_token=$TELEGRAM_WEBHOOK_SECRET"
-F 'allowed_updates=["message","callback_query"]'
-F "max_connections=40"
"https://api.telegram.org/bot<YOUR_BOT_TOKEN>/setWebhook"Use an explicit allowed_updates list only when you understand which update types your bot requires. Excluding a type prevents Telegram from delivering it.
Verify delivery with getWebhookInfo
Query the current configuration:
curl "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getWebhookInfo"Inspect these fields:
| Field | What it tells you | How to use it |
|---|---|---|
url |
The URL Telegram is currently using. | Check the hostname, port, path, and HTTPS scheme character for character. |
pending_update_count |
Updates waiting to be delivered. | A growing value usually means Telegram cannot complete delivery or the application is responding too slowly. |
last_error_date |
Time of the most recent delivery error. | Compare it with proxy and application logs. |
last_error_message |
Telegram’s description of the latest failure. | Use it to distinguish TLS, connection, HTTP, and routing problems. |
max_connections |
Configured simultaneous delivery limit. | Compare it with the bot’s worker and database capacity. |
allowed_updates |
Update types selected for delivery. | Confirm that the event you are testing is not excluded. |
Now send a message to the bot and watch both logs. You should see an HTTPS POST at the exact configured path, an upstream request to the local bot port, and a successful response. Log request status, latency, and a request identifier, but redact the bot token, secret header, and sensitive message content.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Systematic troubleshooting
The hostname does not resolve to the VPS
Check the public A record with dig or another DNS diagnostic tool. Correct stale or conflicting records and wait for DNS caching to expire. Confirm that the hostname used in setWebhook is the same one covered by the certificate and configured in Nginx.
Certificate hostname mismatch
Issue a certificate whose CN or SAN exactly matches the webhook hostname. A certificate for example.com does not automatically cover bot.example.com unless the latter is included as a SAN. Re-register the webhook only after the corrected certificate is served on the selected port.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Telegram reports an incomplete certificate chain
Configure Nginx with a bundle containing the leaf certificate and all required intermediate certificates. In common Nginx installations this is a fullchain file rather than the leaf-only certificate. Reload Nginx after changing the bundle.
The selected port is unsupported or blocked
Use only 443, 80, 88, or 8443. Open that TCP port in the provider firewall and on the VPS, then verify that Nginx is listening on it. Port 443 is generally the least surprising choice. A service listening on a different port cannot receive Telegram webhook traffic even if local tests succeed.
The webhook URL returns a redirect
Remove the redirect for the exact webhook location. Telegram’s FAQ says redirects are unsupported, so a request that receives 301 or 302 will not be delivered through the redirected URL. Register the final HTTPS endpoint directly.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Nginx returns 404 or 405
Compare the request path with the exact-match location and confirm that the route accepts POST rather than only GET. Ensure the path has not been altered by a trailing slash, URL decoding rule, or another server block selected by a different server_name.
Nginx cannot connect to the bot
Check that the bot process is running and listening on the address and port in proxy_pass. If the process listens on 127.0.0.1, Nginx must run on the same VPS. Review Nginx’s error log for connection-refused or timeout messages and verify that a local request reaches the handler.
Requests arrive but Telegram keeps retrying
Return a successful HTTP response as soon as the update is safely accepted. Move long-running work to a queue or background worker. Inspect application exceptions, upstream timeouts, and response status codes. A handler that crashes after receiving the body or responds with repeated 4xx/5xx statuses can cause pending_update_count to rise.
The secret-token check rejects every request
Confirm that the value supplied to setWebhook is exactly the value loaded by the application, including capitalization and punctuation. Check that Nginx forwards the X-Telegram-Bot-Api-Secret-Token header and that no middleware strips it. Do not log the value while diagnosing the issue; log only whether the header was present and whether validation passed.
No updates arrive after setWebhook succeeds
Read getWebhookInfo first. A nonzero pending count or a recent error points to delivery, TLS, DNS, firewall, proxy, or response problems. If those fields are clear, send a new test message and verify that the bot is subscribed to the relevant update type. Also check that your allowed_updates selection did not exclude the event.
Polling no longer works
That is expected while the webhook is active. Remove it before switching modes:
curl "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/deleteWebhook"After deletion, start the polling worker and use getUpdates. Do not run polling and webhook delivery concurrently for the same bot.
Operations and security after deployment
Keep credentials out of logs and source control
The bot token grants control over the Bot API. Store it in an environment variable, a protected service configuration, or a secret manager. Avoid putting it in shell history, Nginx URLs, monitoring dashboards, or exception messages. Rotate it if it is exposed.
Use a service manager
Run the bot under a system service or container supervisor that restarts it after a crash and starts it after a reboot. Configure health checks that test the local handler, while a separate external check verifies DNS, TLS, and the public path. Restart behavior should not create duplicate workers that process the same update unpredictably.
Monitor the delivery path
- Alert on a sustained increase in
pending_update_count. - Record
last_error_messageand its timestamp from periodicgetWebhookInfochecks. - Track Nginx response status, upstream latency, connection failures, and certificate expiry.
- Keep enough application capacity for the configured
max_connections; the API permits 1–100 and defaults to 40. - Redact tokens, secret headers, authorization values, and private message content from logs.
Renew certificates before expiry
Automated renewal is preferable for a trusted certificate. After renewal, reload the proxy and test the exact webhook URL. If you use a self-signed certificate, repeat the certificate upload through setWebhook when the public certificate changes.
Quick Recap
Deployment choices at a glance
| Decision | Common choice | Important consequence |
|---|---|---|
| TLS management | Automated trusted certificate | Simple client trust and renewal, but renewal and reload automation must be monitored. |
| TLS management | Self-signed certificate | Upload the public PEM with certificate during setWebhook; replace the upload when the certificate changes. |
| Proxy | Nginx | Terminates TLS and forwards the exact webhook path to localhost. |
| Proxy | Another reverse proxy | Equally valid if it serves the final HTTPS endpoint, preserves the POST body and secret header, and returns promptly. |
| Public exposure | Port 443 | Standard HTTPS and usually the easiest firewall and certificate configuration. |
| Public exposure | 80, 88, or 8443 | Supported by Telegram, but the chosen port must be opened and served with TLS; redirects still do not work. |
| Request security | Secret path plus secret_token |
Provides two independent checks before JSON processing. |
| Runtime | System service or container | Choose based on your restart, logging, deployment, and scaling requirements; keep the bot port private. |
Final validation checklist
- The DNS A record resolves the webhook hostname to the VPS public IPv4 address.
- The certificate CN or SAN matches that hostname and the complete chain is served.
- Nginx listens on 443, 80, 88, or 8443, and the corresponding firewall rules are open.
- The webhook URL reaches the final HTTPS endpoint without a redirect.
- The proxy forwards the exact secret path to the bot’s private localhost port.
- The application accepts Telegram JSON POST bodies, validates the optional secret header, and responds promptly.
setWebhookreturns success, andgetWebhookInfoshows the expected URL and no accumulating errors.- A real test message appears in proxy and application logs without exposing credentials.
- Polling is disabled while the webhook is active, and the bot has a documented switch-back procedure using
deleteWebhook.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
