I started to set up GitHub webhooks with Jenkins, and I got it working as https://jenkins.mydomain.com/github-webhook/ - without any username and password provided by GitHub. I want to secure it with a username and password (or some other means, if there's a better/more commonly used auth method for this), but before that I want to make sure that this unauthenticated webhook URL access is secured so that it's not freely.

I'm using global security with built-in Active Directory and Project-based Matrix Authorization Strategy, and anonymous users don't have any access to anything. My Jenkins server is behind an apache2 reverse-proxy.