Help centre · Detectabli

Connecting WordPress through a firewall

Updated 13 October 2026

On this page

In plain language

Detectabli's WordPress connection reaches your site from a fixed address. When a security plugin, a CDN or your host's firewall stands in between, this page says what to allow - and what each connection problem in Detectabli means.

Detectabli's address

Detectabli's WordPress connection reaches your site from this address:

52.70.192.200

It is shared by every Detectabli customer's WordPress connection, and it has no IPv6 counterpart - allow this address, IPv4 only.

Each request from the WordPress connection also carries the user agent Detectabli-WordPress/1.0 (+https://detectabli.com).

Allow Detectabli by address, not by user agent - anyone can send that user agent.

What allowing this address lets through

Allowing an address in a firewall, a CDN or a security plugin exempts every request from it from that tool's rules, on every page of your site. Most allowlists work that way, Wordfence's and Cloudflare's included.

Only Detectabli's WordPress connection uses this address - no other Detectabli feature sends requests from it. And every request from it is a WordPress REST API request (see What Detectabli requests): Detectabli refuses to send one anywhere else on your site, a redirect included.

The address is shared by every Detectabli customer's WordPress connection, so any Detectabli account can make it read your site's REST API without signing in - entering your site's address to connect it is enough. Allowing it lets those reads past your tool too, including REST routes the tool would otherwise hide from everyone else, such as the routes a plugin that locks the REST API hides.

Requests that change anything, or that sign in, go only to a site whose owner connected it, with the Application Password or the plugin they approved.

So it is your call. If your tool can limit an exception to part of your site, you can use that instead (see what to allow). Or leave your firewall as it is: Detectabli then can't connect, shows the problem in Settings → Connections, and nothing on your site changes.

What Detectabli requests

Detectabli's WordPress connection calls your site over HTTPS, through the WordPress REST API: under /wp-json/ on your site's address, or ?rest_route= on a site without pretty permalinks. It requests:

The REST index (/wp-json/) - read before signing in, to find WordPress and the page where you approve Application Passwords.
The wp/v2 routes - your WordPress user, your posts and pages, and Detectabli's own Application Password, which it removes when you disconnect - signed in with the Application Password you approved.
The detectabli/v1 routes, when the Detectabli plugin is installed. Every one of those requests is signed, so only Detectabli can make it.

Those are the requests Detectabli makes itself. Your site can redirect one of them to another WordPress REST API route, on your site or another host, and Detectabli follows it there. Every request from Detectabli's address is a WordPress REST API request - Detectabli refuses to send one anywhere else, a redirect included. For what allowing it lets through, see What allowing this address lets through.

Signed-in requests carry an Authorization header, and it has to reach WordPress: a host or proxy that strips it makes WordPress refuse the password (see Your host).

Connecting with an Application Password opens WordPress's approval page in your own browser - that request comes from you, not from Detectabli's address. If something stops you reaching wp-admin, sign in to WordPress the way you usually do, then connect again.

You may see more than one Detectabli password under Users → Profile → Application Passwords - for example when an approval never made it back to Detectabli. A Detectabli password the connection is not using is safe to delete. The one in use shows a recent Last Used date; deleting that one stops the connection until the site is connected again.

Requests from your site

With the Detectabli plugin installed, your site calls Detectabli too: it sends HTTPS requests to api.detectabli.com to connect, to say when a post or page changes, and for the Detectabli panel in the block editor.

If wp-config.php defines WP_HTTP_BLOCK_EXTERNAL, WordPress refuses every outgoing request to a host it doesn't list. Add Detectabli's host to WP_ACCESSIBLE_HOSTS in wp-config.php:

wp-config.php

define( 'WP_ACCESSIBLE_HOSTS', 'api.detectabli.com' );

If WP_ACCESSIBLE_HOSTS is already defined, add api.detectabli.com to its list, separated by a comma, rather than defining it twice.

If your host filters outgoing traffic, ask them to allow HTTPS (port 443) to api.detectabli.com.

An Application Password connection makes no request from your site - only the plugin does.

To check, press Test connection under Settings → Detectabli in WordPress. When the site can't reach Detectabli, that screen says so and links here.

What to allow, tool by tool

Allow Detectabli's address in every layer in front of WordPress - a CDN, a firewall plugin, your host. Each step below adds an exception for it, and in most tools that exception covers every request from it, on every page of your site - see What allowing this address lets through.

Wordfence

In WordPress, open Wordfence → Firewall → All Firewall Options. Under Advanced Firewall Options, add the address to Allowlisted IP addresses that bypass all rules and save.

As that setting's name says, every request from the address then skips all of Wordfence's firewall rules, on every page of your site.

Cloudflare

In the Cloudflare dashboard for your domain, open Security rules and choose Create rule → IP access rules. Enter the address, set the action to Allow, and create it.

An IP access rule set to Allow lets every request from that address past your custom rules, rate limiting rules and WAF managed rules, on every path of your domain.

An IP access rule is also what keeps Bot Fight Mode from challenging Detectabli: a WAF custom rule can't make an exception to it.

Sucuri

In the Sucuri Firewall dashboard, select your site, open Access Control → Allow IP Addresses, and add the address.

Solid Security

In WordPress, open Security → Settings → Global Settings and add the address to Authorized IPs, so its lockouts never block Detectabli.

All-In-One WP Security

Add the address to its IP allowlist.

Its Disallow unauthorized REST requests setting refuses the REST index to anyone not signed in, and it has no exception by address - while it is on, Detectabli shows the REST API is locked.

“Disable REST API” and similar plugins

Plugins that lock the REST API to signed-in users stop Detectabli before it can sign in: it reads your REST index (/wp-json/) first. If the plugin can make exceptions by IP address, add Detectabli's address. If it lets you choose routes instead, allow the index route for visitors who aren't signed in - every route that reads or changes your content still needs the Application Password.

Your host

Some hosts run a firewall of their own in front of WordPress, often ModSecurity rules. If requests are blocked and none of your plugins logged it, ask your host to allow Detectabli's address.

On Apache hosts that run PHP as CGI or FastCGI, the Authorization header can be dropped before WordPress sees it, and WordPress then refuses the password. Add this line to the .htaccess file in your WordPress folder, or ask your host to pass the header through:

.htaccess

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

Troubleshooting by problem

Detectabli names the problem in Settings → Connections, and on the page where you approve a plugin connection. Find it here. The code under each answer is the one to quote if you contact support.

A firewall blocked Detectabli

Something in front of WordPress - a security plugin, a CDN or your host's firewall - answered instead of WordPress, usually with a block or challenge page.

Allow Detectabli's address in each of them (what to allow), then press Test connection in Settings → Connections, or connect again.

Code site_blocked

The REST API is locked to signed-in users

WordPress is there, but its REST API only answers people who are signed in - a setting in a security plugin, or a plugin that locks the REST API. Detectabli reads the REST index before it signs in.

Allow the REST API for Detectabli's address in that plugin (see plugins that lock the REST API). If the plugin can't make an exception, Detectabli can't connect while that setting is on.

On a site already connected with the Detectabli plugin, the same setting locks the plugin's own routes (detectabli/v1). Pulls and Update on WordPress keep working - they sign in with the Application Password. What goes through the plugin waits until the REST API is allowed for Detectabli:

Sending a post's SEO title and description to your SEO plugin.
Sending a post's schema.
The page-builder check, which tells whether a post is built with a page builder.
The plugin's half of Test connection and of the nightly check.

Allow the REST API for Detectabli's address in that plugin (see plugins that lock the REST API), then press Test connection in Settings → Connections.

Code rest_locked

Application Passwords aren't available

WordPress offers Application Passwords only over HTTPS, and some security plugins remove them. Both ways of connecting need them - the Detectabli plugin creates one too.

Check the site's address under Settings → General in WordPress starts with https://, and allow Application Passwords in your security plugin's settings. Then connect again.

Code app_passwords_unavailable

WordPress didn't accept the password

WordPress refused Detectabli's Application Password: it was removed in WordPress, or the Authorization header never reached WordPress.

If the password was removed under Users → Profile, connect the site again. If it keeps happening, your host may be stripping the Authorization header - see Your host.

Code credentials_rejected

Your WordPress user can't connect a site

Only an Editor or an Administrator can connect a site to Detectabli.

Code insufficient_role

Detectabli couldn't find WordPress at that address

The address answered, but not with WordPress's REST API - it is another kind of site, or a parked domain.

Use the address your site's homepage is on. If the site is WordPress, check that /wp-json/ opens at that address in your browser.

A WordPress installed in a folder whose name looks like a file, such as /site.v2/, can't be connected, with the Detectabli plugin or an Application Password.

Code not_wordpress

Detectabli couldn't reach the site

Nothing answered: the address doesn't exist, its HTTPS certificate isn't valid, or the connection failed.

Check the address, and that the site is online with a valid certificate. If it opens for you, a firewall may be dropping Detectabli's requests without an answer - allow Detectabli's address.

Code site_unreachable

That address isn't on the public internet

It points to a private network, or redirects to one - a site on your own computer or an intranet. Detectabli can only reach a site the internet can reach.

Connect the site's public address.

Code blocked_address

WordPress signs in on another address

The site's sign-in and approval page (wp-admin) is on a different address from the site itself, so an Application Password approved there can't be used.

Install the Detectabli plugin and connect from Settings → Detectabli in WordPress - the plugin doesn't use that page. Or connect a site that signs in on its own address.

Code authorize_offsite

The site took too long to answer

Detectabli waits a few seconds for each answer. A slow host, a heavy plugin, or a firewall holding the request open can take longer.

Try again. If it keeps happening, check the site's speed with your host, and that nothing is holding back Detectabli's address.

Code slow_site

The site redirected Detectabli's request

A request that changes something was sent somewhere else - the site's address changed (www, or http to https), or a redirect plugin caught it. Detectabli never follows a redirect with a change, so nothing was sent.

Check that the address in Settings → Connections is the one WordPress uses (Settings → General in WordPress), and the rules in your redirect plugin. If the site moved, see Moved sites, staging and backups.

Code unexpected_redirect

Detectabli reached the site, but not the plugin

The Detectabli plugin isn't installed or isn't active - or a security plugin blocks its routes (detectabli/v1).

Check Detectabli is active under Plugins, allow Detectabli's address, then connect again from Settings → Detectabli in WordPress.

Without the plugin, SEO titles and descriptions in Yoast SEO or Rank Math, a post's structured data and change notices wait for it - Detectabli says which ones need the plugin, and never skips one silently.

Code plugin_not_found

Your site didn't confirm the connection

Detectabli asked the plugin that started the connection to confirm it, and the site didn't answer as that plugin - the link was opened for another site, or a firewall stopped the request.

Start again from Settings → Detectabli in that site's WordPress admin. If it fails again, allow Detectabli's address.

Code challenge_failed

The plugin on the site isn't connected any more

The plugin was reinstalled, or its settings were reset, so it no longer holds the connection.

Disconnect the site in Settings → Connections, then connect again from Settings → Detectabli in WordPress.

Code plugin_not_connected

The connection was never finished

The connection was approved, but Finish connecting was never pressed in WordPress, and the approval has expired.

Disconnect it in Settings → Connections, then connect again from Settings → Detectabli in WordPress and press Finish connecting.

Code pairing_unfinished

The site now reports a different address

The plugin on the site says its address changed - the site moved, or it is a copy.

If it moved, press This site moved here under Settings → Detectabli at the new address. See Moved sites, staging and backups.

Code home_changed

The old address still serves the site

The address you are connecting looks like a copy - a staging site or a backup - because the old address still answers as the same WordPress site.

Connect it as a separate site, or wait until the old address no longer serves the site and connect again.

Code old_site_live

Detectabli couldn't tell whether the site moved

The old address didn't answer clearly - it may be down for a moment, or something in front of it is blocking Detectabli.

Try again in a few minutes. If the site has left the old address for good, confirm the move with Move it here.

Code old_site_unclear

Syncing is paused

Detectabli pauses syncing with a site once its connection has failed for 3 days. Pulls, sends and change checks stop until it works again.

Fix the problem that Settings → Connections names - it is one of the others on this page - then press Test connection there. One passing test resumes syncing.

Code site_disabled

Moved sites, staging and backups

With the Detectabli plugin - when the site's address changes, the plugin notices and pauses.

Moved for good: at the new address, open Settings → Detectabli, press This site moved here and approve. Once the old address no longer serves the site, Detectabli moves the connection there and keeps the posts you imported linked.
A staging or backup copy: press Disconnect this copy on the copy. The original stays connected, and pressing Connect on the copy afterwards connects it as a site of its own.
While the old address still serves the site, nothing moves: choose Connect as a separate site to connect the copy as a site of its own, and the original stays connected with its posts.
If the move also changed the site's security keys (the salts in wp-config.php), the plugin still notices: at a new address it shows the same This site moved here and Disconnect this copy choice. If the keys changed but the address didn't (a restore, or new keys), it says so and pauses: press Connect again and approve. Detectabli reconnects the same site, with the posts you imported still linked.

With an Application Password - once the site and its database have moved, press Site moved? beside the site in Settings → Connections and enter the new address. Posts imported from it stay linked. A staging copy, or a site rebuilt from an export file, is a separate site: connect it with Connect instead.

Either way, Detectabli never moves a connection while the old address still answers as the site - that would take its posts from a site that is still live.