Hi @ccselkie, thanks for your question.
XML-RPC requests are one of the most common brute force/credential stuffing attack methods. Using long unique passwords and 2FA for your administrative accounts should let you open this up if it’s affecting functionality on your site. Notably Jetpack and the WordPress app might need it.
In your case, check that Wordfence’s “Disable XML-RPC authentication” isn’t checked Wordfence > Login Security > Settings. This route can also be blocked entirely using .htaccess so see if yours contains something like this and remove it:
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
If XML-RPC is still blocked after checking .htaccess and Wordfence’s settings aren’t the cause, you may need to speak with your host to see if they block this by design.
Thanks,
Peter.
Hello,
My host had blocked xmlrpc.php so we have now turned this off (see attached) however, I am still not receiving the data.
What else can I do to fix this?
Hi @ccselkie, thanks for checking those things and letting us know.
To rule Wordfence in/out as the cause for analytics not reaching its destination, place Wordfence in Learning Mode. From the Wordfence Dashboard click on Manage WAF. Then you will see Basic Firewall Options > Web Application Firewall Status. Change the option to Learning Mode. You could then attempt to navigate your site, pull some stats, or any other activities that might make analytics appear. If they start to come through, switch the WAF from Learning Mode back to Enabled and Protecting to see if it continues to work afterwards.
If that doesn’t seem to make any difference, check your Live Traffic page for cases of the bot or IP(s) of your analytics being blocked. When clicking the block line (or “eye” icon), it will state the reason in red text. In many cases, an “ADD PARAM TO FIREWALL ALLOWLIST” button appears in this section which you can click to allow these types of request in future.
Let us know if you see any reason given that you’re not sure how to solve. Sometimes following our instructions on “throttling” bots instead of blocking them can yield results in this area: https://www.wordfence.com/help/firewall/rate-limiting/
If you don’t see Wordfence blocking your analytics provider’s bot or related traffic at all, you may need to speak with your host or analytics provider to see if everything else has been configured correctly.
Let us know how you get on,
Peter.
