diff --git a/CHANGELOG.md b/CHANGELOG.md
index 989e3f7a9298c..6715ef3bb8fd9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -70,6 +70,7 @@ be deprecated eventually.
 - [#2636](https://github.com/influxdata/telegraf/pull/2636): Add `message_len_max` option to `kafka_consumer` input
 - [#1100](https://github.com/influxdata/telegraf/issues/1100): Add collectd parser
 - [#1820](https://github.com/influxdata/telegraf/issues/1820): easier plugin testing without outputs
+- [#2493](https://github.com/influxdata/telegraf/pull/2493): Check signature in the GitHub webhook plugin
 
 ### Bugfixes
 
diff --git a/etc/telegraf.conf b/etc/telegraf.conf
index 63e41d7bbcd45..07ae5ac8fd036 100644
--- a/etc/telegraf.conf
+++ b/etc/telegraf.conf
@@ -2382,6 +2382,7 @@
 #
 #   [inputs.webhooks.github]
 #     path = "/github"
+#     # secret = ""
 #
 #   [inputs.webhooks.mandrill]
 #     path = "/mandrill"
diff --git a/plugins/inputs/webhooks/github/README.md b/plugins/inputs/webhooks/github/README.md
index 68594cd78f86b..908d92a639d57 100644
--- a/plugins/inputs/webhooks/github/README.md
+++ b/plugins/inputs/webhooks/github/README.md
@@ -2,6 +2,8 @@
 
 You should configure your Organization's Webhooks to point at the `webhooks` service. To do this go to `github.com/{my_organization}` and click `Settings > Webhooks > Add webhook`. In the resulting menu set `Payload URL` to `http://<my_ip>:1619/github`, `Content type` to `application/json` and under the section `Which events would you like to trigger this webhook?` select 'Send me <b>everything</b>'. By default all of the events will write to the `github_webhooks` measurement, this is configurable by setting the `measurement_name` in the config file.
 
+You can also add a secret that will be used by telegraf to verify the authenticity of the requests.
+
 ## Events
 
 The titles of the following sections are links to the full payloads and details for each event. The body contains what information from the event is persisted. The format is as follows:
diff --git a/plugins/inputs/webhooks/github/github_webhooks.go b/plugins/inputs/webhooks/github/github_webhooks.go
index a31c6fdf2280c..0bb792bf5df08 100644
--- a/plugins/inputs/webhooks/github/github_webhooks.go
+++ b/plugins/inputs/webhooks/github/github_webhooks.go
@@ -1,6 +1,9 @@
 package github
 
 import (
+	"crypto/hmac"
+	"crypto/sha1"
+	"encoding/hex"
 	"encoding/json"
 	"io/ioutil"
 	"log"
@@ -11,8 +14,9 @@ import (
 )
 
 type GithubWebhook struct {
-	Path string
-	acc  telegraf.Accumulator
+	Path   string
+	Secret string
+	acc    telegraf.Accumulator
 }
 
 func (gh *GithubWebhook) Register(router *mux.Router, acc telegraf.Accumulator) {
@@ -23,12 +27,19 @@ func (gh *GithubWebhook) Register(router *mux.Router, acc telegraf.Accumulator)
 
 func (gh *GithubWebhook) eventHandler(w http.ResponseWriter, r *http.Request) {
 	defer r.Body.Close()
-	eventType := r.Header["X-Github-Event"][0]
+	eventType := r.Header.Get("X-Github-Event")
 	data, err := ioutil.ReadAll(r.Body)
 	if err != nil {
 		w.WriteHeader(http.StatusBadRequest)
 		return
 	}
+
+	if gh.Secret != "" && !checkSignature(gh.Secret, data, r.Header.Get("X-Hub-Signature")) {
+		log.Printf("E! Fail to check the github webhook signature\n")
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
 	e, err := NewEvent(data, eventType)
 	if err != nil {
 		w.WriteHeader(http.StatusBadRequest)
@@ -108,3 +119,14 @@ func NewEvent(data []byte, name string) (Event, error) {
 	}
 	return nil, &newEventError{"Not a recognized event type"}
 }
+
+func checkSignature(secret string, data []byte, signature string) bool {
+	return hmac.Equal([]byte(signature), []byte(generateSignature(secret, data)))
+}
+
+func generateSignature(secret string, data []byte) string {
+	mac := hmac.New(sha1.New, []byte(secret))
+	mac.Write(data)
+	result := mac.Sum(nil)
+	return "sha1=" + hex.EncodeToString(result)
+}
diff --git a/plugins/inputs/webhooks/github/github_webhooks_test.go b/plugins/inputs/webhooks/github/github_webhooks_test.go
index 0ec9917264374..65041e4a06125 100644
--- a/plugins/inputs/webhooks/github/github_webhooks_test.go
+++ b/plugins/inputs/webhooks/github/github_webhooks_test.go
@@ -21,6 +21,19 @@ func GithubWebhookRequest(event string, jsonString string, t *testing.T) {
 	}
 }
 
+func GithubWebhookRequestWithSignature(event string, jsonString string, t *testing.T, signature string, expectedStatus int) {
+	var acc testutil.Accumulator
+	gh := &GithubWebhook{Path: "/github", Secret: "signature", acc: &acc}
+	req, _ := http.NewRequest("POST", "/github", strings.NewReader(jsonString))
+	req.Header.Add("X-Github-Event", event)
+	req.Header.Add("X-Hub-Signature", signature)
+	w := httptest.NewRecorder()
+	gh.eventHandler(w, req)
+	if w.Code != expectedStatus {
+		t.Errorf("POST "+event+" returned HTTP status code %v.\nExpected %v", w.Code, expectedStatus)
+	}
+}
+
 func TestCommitCommentEvent(t *testing.T) {
 	GithubWebhookRequest("commit_comment", CommitCommentEventJSON(), t)
 }
@@ -100,3 +113,23 @@ func TestTeamAddEvent(t *testing.T) {
 func TestWatchEvent(t *testing.T) {
 	GithubWebhookRequest("watch", WatchEventJSON(), t)
 }
+
+func TestEventWithSignatureFail(t *testing.T) {
+	GithubWebhookRequestWithSignature("watch", WatchEventJSON(), t, "signature", http.StatusBadRequest)
+}
+
+func TestEventWithSignatureSuccess(t *testing.T) {
+	GithubWebhookRequestWithSignature("watch", WatchEventJSON(), t, generateSignature("signature", []byte(WatchEventJSON())), http.StatusOK)
+}
+
+func TestCheckSignatureSuccess(t *testing.T) {
+	if !checkSignature("my_little_secret", []byte("random-signature-body"), "sha1=3dca279e731c97c38e3019a075dee9ebbd0a99f0") {
+		t.Errorf("check signature failed")
+	}
+}
+
+func TestCheckSignatureFailed(t *testing.T) {
+	if checkSignature("m_little_secret", []byte("random-signature-body"), "sha1=3dca279e731c97c38e3019a075dee9ebbd0a99f0") {
+		t.Errorf("check signature failed")
+	}
+}
diff --git a/plugins/inputs/webhooks/webhooks.go b/plugins/inputs/webhooks/webhooks.go
index fcddbebd7f6e3..bc8519d7a4ede 100644
--- a/plugins/inputs/webhooks/webhooks.go
+++ b/plugins/inputs/webhooks/webhooks.go
@@ -47,6 +47,7 @@ func (wb *Webhooks) SampleConfig() string {
 
   [inputs.webhooks.github]
     path = "/github"
+    # secret = ""
 
   [inputs.webhooks.mandrill]
     path = "/mandrill"