XMLRPC issues with Zapier and IFTTT

Hi @octanage,

Wordfence does not send out 405 error codes, nor does it provide an option to block xmlrpc.php specifically.

Can I have you check .htaccess to see if it may be blocked there?

Dave

thanks @wfdave for the prompt reply!
I have located the file, and searched for “xmlrpc” and didn’t find any mention.
I believe that rules out a block coming from .htaccess.

Any other angles to check?
Would Jetpack interfere with the list of IP addresses that can use xlmrpc?

Hi again!

Can I have you disable Wordfence temporarily to see if you can connect to your site via Zapier?

I think another plugin may be involved in this block, but I’m not sure.

Dave

Will do @wfdave. Thanks for the guidance. A few questions for me to prepare next steps:

How do I perform a test to see if a particular service (or IP) can use XMLRPC? I.e., how do I “simulate” XMLRPC behavior for request from a particular service?
This would speed up the test and minimize the time in which I have Wordfence off, thus decreasing vulnerabilities on my website.

Also: What types of plugins are likely to mess with XMLRPC?
This is to help me prioritize the individual tests.

Also, to articulate the following: Jetpack for instance is washing their hands and asking me to contact hosting provider to change XMLRPC settings… which might lead to a fix, but almost certainly is not fixing the root cause of the problem.

Hi again,

I personally use https://xmlrpc.eritreo.it/ to test if XMLRPC is working properly on my site. You do not need to type in your username/password to test.

Our stance on XML-RPC is that there is little to no benefit in disabling it.

https://www.wordfence.com/blog/2015/10/should-you-disable-xml-rpc-on-wordpress/

So i’m not sure if Wordfence is causing the issue with XML-RPC. Please let me know what happens when Wordfence is disabled though!

Dave

Thanks for sharing this, Dave. When there are multiple hands on deck, it really helps to understand the role of each player and who’s more likely to be the root cause of the issue.

I just wrote to my hosting company describing the issue and adding all the diags evidence. Will keep you posted.

Found the culprit: Speed Booster plugin

Developer decided to disable XML-RPC by default on the last update (early January 2019).

Very annoyed, frustrated, and disappointed at the GENIUS who decided to:
– add a security option to a speed optimization plugin
– disable by default what is enabled by default by WordPress

Wondering if I’m missing something in this narrative… good news is that things are working again.

I have tested my site with that https://xmlrpc.eritreo.it/ and it connects fine. Jetpack connects fine. My site is https://gjbricks.com/

But IFTTT and Zapier both throw errors.
IFTTT: “Blog URL is not a valid WordPress url”
Zapier: “authentication failed: The app returned “Not Found” with no further details.”

I have removed every plugin and disabled Cloudflare but they still won’t connect. But every test connection I try works just fine.

Anyone got any suggestions what to try next?