diff --git a/CHANGELOG.md b/CHANGELOG.md
index 989e3f7a9298cd552d47d5d56106a41c80a23eb3..6715ef3bb8fd93f758c216b4f0354ee04f9aa93c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -70,6 +70,7 @@ be deprecated eventually.
 - [#2636](https://github.com/influxdata/telegraf/pull/2636): Add `message_len_max` option to `kafka_consumer` input
 - [#1100](https://github.com/influxdata/telegraf/issues/1100): Add collectd parser
 - [#1820](https://github.com/influxdata/telegraf/issues/1820): easier plugin testing without outputs
+- [#2493](https://github.com/influxdata/telegraf/pull/2493): Check signature in the GitHub webhook plugin
 
 ### Bugfixes
 
diff --git a/etc/telegraf.conf b/etc/telegraf.conf
index 63e41d7bbcd45203006048778aec67951d98ab88..07ae5ac8fd0366eb9d21a87d2f670e49c985820b 100644
--- a/etc/telegraf.conf
+++ b/etc/telegraf.conf
@@ -2382,6 +2382,7 @@
 #
 #   [inputs.webhooks.github]
 #     path = "/github"
+#     # secret = ""
 #
 #   [inputs.webhooks.mandrill]
 #     path = "/mandrill"
diff --git a/plugins/inputs/webhooks/github/README.md b/plugins/inputs/webhooks/github/README.md
index 68594cd78f86b9c5e68cbdf433b3f6079e16eb80..908d92a639d575beec203e4f46522f998904783d 100644
--- a/plugins/inputs/webhooks/github/README.md
+++ b/plugins/inputs/webhooks/github/README.md
@@ -2,6 +2,8 @@
 
 You should configure your Organization's Webhooks to point at the `webhooks` service. To do this go to `github.com/{my_organization}` and click `Settings > Webhooks > Add webhook`. In the resulting menu set `Payload URL` to `http://<my_ip>:1619/github`, `Content type` to `application/json` and under the section `Which events would you like to trigger this webhook?` select 'Send me <b>everything</b>'. By default all of the events will write to the `github_webhooks` measurement, this is configurable by setting the `measurement_name` in the config file.
 
+You can also add a secret that will be used by telegraf to verify the authenticity of the requests.
+
 ## Events
 
 The titles of the following sections are links to the full payloads and details for each event. The body contains what information from the event is persisted. The format is as follows:
diff --git a/plugins/inputs/webhooks/github/github_webhooks.go b/plugins/inputs/webhooks/github/github_webhooks.go
index a31c6fdf2280c9ac33dd90776572c561d3991167..0bb792bf5df088743fbcbf5d75b381d2211d82d1 100644
--- a/plugins/inputs/webhooks/github/github_webhooks.go
+++ b/plugins/inputs/webhooks/github/github_webhooks.go
@@ -1,6 +1,9 @@
 package github
 
 import (
+	"crypto/hmac"
+	"crypto/sha1"
+	"encoding/hex"
 	"encoding/json"
 	"io/ioutil"
 	"log"
@@ -11,8 +14,9 @@ import (
 )
 
 type GithubWebhook struct {
-	Path string
-	acc  telegraf.Accumulator
+	Path   string
+	Secret string
+	acc    telegraf.Accumulator
 }
 
 func (gh *GithubWebhook) Register(router *mux.Router, acc telegraf.Accumulator) {
@@ -23,12 +27,19 @@ func (gh *GithubWebhook) Register(router *mux.Router, acc telegraf.Accumulator)
 
 func (gh *GithubWebhook) eventHandler(w http.ResponseWriter, r *http.Request) {
 	defer r.Body.Close()
-	eventType := r.Header["X-Github-Event"][0]
+	eventType := r.Header.Get("X-Github-Event")
 	data, err := ioutil.ReadAll(r.Body)
 	if err != nil {
 		w.WriteHeader(http.StatusBadRequest)
 		return
 	}
+
+	if gh.Secret != "" && !checkSignature(gh.Secret, data, r.Header.Get("X-Hub-Signature")) {
+		log.Printf("E! Fail to check the github webhook signature\n")
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
 	e, err := NewEvent(data, eventType)
 	if err != nil {
 		w.WriteHeader(http.StatusBadRequest)
@@ -108,3 +119,14 @@ func NewEvent(data []byte, name string) (Event, error) {
 	}
 	return nil, &newEventError{"Not a recognized event type"}
 }
+
+func checkSignature(secret string, data []byte, signature string) bool {
+	return hmac.Equal([]byte(signature), []byte(generateSignature(secret, data)))
+}
+
+func generateSignature(secret string, data []byte) string {
+	mac := hmac.New(sha1.New, []byte(secret))
+	mac.Write(data)
+	result := mac.Sum(nil)
+	return "sha1=" + hex.EncodeToString(result)
+}
diff --git a/plugins/inputs/webhooks/github/github_webhooks_test.go b/plugins/inputs/webhooks/github/github_webhooks_test.go
index 0ec9917264374689ca588bdf375924ecf3eecf8b..65041e4a061251b9d376e8f721e399e40567d2e8 100644
--- a/plugins/inputs/webhooks/github/github_webhooks_test.go
+++ b/plugins/inputs/webhooks/github/github_webhooks_test.go
@@ -21,6 +21,19 @@ func GithubWebhookRequest(event string, jsonString string, t *testing.T) {
 	}
 }
 
+func GithubWebhookRequestWithSignature(event string, jsonString string, t *testing.T, signature string, expectedStatus int) {
+	var acc testutil.Accumulator
+	gh := &GithubWebhook{Path: "/github", Secret: "signature", acc: &acc}
+	req, _ := http.NewRequest("POST", "/github", strings.NewReader(jsonString))
+	req.Header.Add("X-Github-Event", event)
+	req.Header.Add("X-Hub-Signature", signature)
+	w := httptest.NewRecorder()
+	gh.eventHandler(w, req)
+	if w.Code != expectedStatus {
+		t.Errorf("POST "+event+" returned HTTP status code %v.\nExpected %v", w.Code, expectedStatus)
+	}
+}
+
 func TestCommitCommentEvent(t *testing.T) {
 	GithubWebhookRequest("commit_comment", CommitCommentEventJSON(), t)
 }
@@ -100,3 +113,23 @@ func TestTeamAddEvent(t *testing.T) {
 func TestWatchEvent(t *testing.T) {
 	GithubWebhookRequest("watch", WatchEventJSON(), t)
 }
+
+func TestEventWithSignatureFail(t *testing.T) {
+	GithubWebhookRequestWithSignature("watch", WatchEventJSON(), t, "signature", http.StatusBadRequest)
+}
+
+func TestEventWithSignatureSuccess(t *testing.T) {
+	GithubWebhookRequestWithSignature("watch", WatchEventJSON(), t, generateSignature("signature", []byte(WatchEventJSON())), http.StatusOK)
+}
+
+func TestCheckSignatureSuccess(t *testing.T) {
+	if !checkSignature("my_little_secret", []byte("random-signature-body"), "sha1=3dca279e731c97c38e3019a075dee9ebbd0a99f0") {
+		t.Errorf("check signature failed")
+	}
+}
+
+func TestCheckSignatureFailed(t *testing.T) {
+	if checkSignature("m_little_secret", []byte("random-signature-body"), "sha1=3dca279e731c97c38e3019a075dee9ebbd0a99f0") {
+		t.Errorf("check signature failed")
+	}
+}
diff --git a/plugins/inputs/webhooks/webhooks.go b/plugins/inputs/webhooks/webhooks.go
index fcddbebd7f6e31af1ebc4917604095bc43587da1..bc8519d7a4ede62457898e0017f1f8f69765879d 100644
--- a/plugins/inputs/webhooks/webhooks.go
+++ b/plugins/inputs/webhooks/webhooks.go
@@ -47,6 +47,7 @@ func (wb *Webhooks) SampleConfig() string {
 
   [inputs.webhooks.github]
     path = "/github"
+    # secret = ""
 
   [inputs.webhooks.mandrill]
     path = "/mandrill"