If you're at all serious about using webhooks, you should create the webhook you want to use using the API. That is the only way to get Shopify to send you a proper authenticated webhook since the API "create" uses your API key to inform Shopify of who your App is. Without using that authentication method, your webhook is open to abuse and there is not much you can do to protect yourself.
It is worth it. The built-in notification tests are relics of a bygone age... good for a gentle ping at best.