Title: server didn’t send an API key Last modified: September 7, 2020 --- # server didn’t send an API key * Resolved [Gary H](https://wordpress.org/support/users/axe6st/) * (@axe6st) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/) * I recently added SSL certificates to a few of my sites and now I notice that wordfence can’t scan. The scan stops saying it was stopped after a few seconds. I tried the curl command and get an error that my server didn’t send an API key. Under diagnostics tab I get this wp_remote_post() test back to this server failed! Response was: 403 Forbidden. I tried opening up the port 443 for outgoing traffic to the wordfence servers, no luck. I’ve been troubleshooting this all day and seems like it’s just a simple setting I’m missing. My site is running on windows server 2019, latest version of wordpress and all plugins are updated, latest version of MySql server, version 7.4 PHP. I don’t think it’s an issue with any plugins because it does the same on all sites that have SSL enabled and working. I have a few that I didn’t put SSL on and they work fine. Any help woul dbe greatly appreciated. Thank you all. Axe * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fserver-didnt-send-an-api-key%2F%3Foutput_format%3Dmd&locale=en_US) to see the link]_ Viewing 15 replies - 1 through 15 (of 17 total) 1 [2](https://wordpress.org/support/topic/server-didnt-send-an-api-key/page/2/?output_format=md) [→](https://wordpress.org/support/topic/server-didnt-send-an-api-key/page/2/?output_format=md) * Plugin Support [WFAdam](https://wordpress.org/support/users/wfadam/) * (@wfadam) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13377058) * Hello [@axe6st](https://wordpress.org/support/users/axe6st/) and thanks for reaching out! * Navigate to **Tools > Diagnostics > Debugging Options > Enable SSL Verification**, make sure that is checked. Save that and then try to scan again. * 403 error means something is blocking POST request to `admin-ajax.php` file on your website, this file is located in “/wp-admin” directory, are you sure you aren’t blocking access to this directory by any way? we have seen some users blocking access to this directory by adding a couple of lines in “.htaccess” file, can you double check that? Also, I have seen this resolved by the host removing security restrictions on access `admin-ajax.php` as well. * Let me know what you find on your end and if this helps! * Thanks! * Thread Starter [Gary H](https://wordpress.org/support/users/axe6st/) * (@axe6st) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13377140) * Thanks for your reply. I have enable ssl verification checked. I use IIS IP address restrictions to block the wp-admin folder but I have the wordfence servers IP address range in there as allowed. I also did change that to default feature setting set to allow all and made no difference. I ran the curl command listed in another article about a similar issue and it came back saying server didn’t send an api key. I checked my IIS logs but didn’t find anything helpful in there. I followed the guide at wordfence titled scan won’t start. I can get to the admin- ajax.php also. I’m lost as to where to check next but I’m wondering if when I set up my SSL I missed something and it’s only half correct. Axe * Plugin Support [WFAdam](https://wordpress.org/support/users/wfadam/) * (@wfadam) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13377195) * I will run a test on your SSL, in the meantime, can you send a diagnostic report to **wftest @ wordfence . com**? You can find the link to do so at the top of the **Wordfence Tools > Diagnostics** page. Then click on **“Send Report by Email”**. Please add your forum username where indicated and _respond here after you have sent it._ * Thanks [@axe6st](https://wordpress.org/support/users/axe6st/) ! * Thread Starter [Gary H](https://wordpress.org/support/users/axe6st/) * (@axe6st) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13377488) * Diagnostic report sent. Thank you. I checked my SSL also using a tool called iisencrypt. There’s a section named drown under the protocols that seems to be not supported. Also, I made sure TLS 1.2 is enabled and I am getting this message in windows event viewer An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The TLS connection request has failed. Axe6st * Plugin Support [WFAdam](https://wordpress.org/support/users/wfadam/) * (@wfadam) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13377582) * Thanks for sending that diagnostic report [@axe6st](https://wordpress.org/support/users/axe6st/) * I also just realized you mentioned you are running on a windows server: Wordfence is tested and works on Linux or other Unix type operating systems. We do not recommend using Wordfence on Windows/IIS. Though we have reports of Wordfence working on IIS and other Windows web server platforms they are not officially supported. * Also, look over this as well for information on SSL: [https://www.wordfence.com/help/advanced/system-requirements/#general-system-requirements](https://www.wordfence.com/help/advanced/system-requirements/#general-system-requirements) * The diagnostic report looked good, its connecting back to itself without any issues and all the connections are correct. * Do this for me: - Go to the Tools > Diagnostics page - In the “Debugging Options” section check the circle “Enable debugging mode” - Click to “Save Changes”. - Start a new scan - Copy the last 20 lines from the Log (click the “Show Log” link) or so of the activity log and paste them in the post. * Let’s see where the scan is stopping at. As this isn’t supported on a windows server, I want to just make sure all the settings are correct for you. * Thanks again! * Thread Starter [Gary H](https://wordpress.org/support/users/axe6st/) * (@axe6st) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13377608) * This is what was added to the log from the new scan attempt. Sep 08 11:23:09] Calling Wordfence API v2.26:[https://noc1.wordfence.com/v2.26/?k=8592d1b2d838528add53321214c0a0336d2372bcbe60600743188b20412b2b6a03636c9d90b8052eb069c298b9397fc1352143e74b82ca52fa6a77e2164dfdab41479930c1b7b3f77a7a1f3375871fc9&s=eyJ3cCI6IjUuNS4xIiwid2YiOiI3LjQuMTEiLCJtcyI6ZmFsc2UsImgiOiJodHRwczpcL1wvcGFja2FnaW5nZHluYW1pY3MuY29tIiwic3NsdiI6MjY5NDg4MjU1LCJwdiI6IjcuNC45IiwicHQiOiJjZ2ktZmNnaSIsImN2IjoiNy43MC4wIiwiY3MiOiJPcGVuU1NMXC8xLjEuMWciLCJzdiI6Ik1pY3Jvc29mdC1JSVNcLzEwLjAiLCJkdiI6IjguMC4xOCJ9&betaFeed=0&action=timestamp](https://noc1.wordfence.com/v2.26/?k=8592d1b2d838528add53321214c0a0336d2372bcbe60600743188b20412b2b6a03636c9d90b8052eb069c298b9397fc1352143e74b82ca52fa6a77e2164dfdab41479930c1b7b3f77a7a1f3375871fc9&s=eyJ3cCI6IjUuNS4xIiwid2YiOiI3LjQuMTEiLCJtcyI6ZmFsc2UsImgiOiJodHRwczpcL1wvcGFja2FnaW5nZHluYW1pY3MuY29tIiwic3NsdiI6MjY5NDg4MjU1LCJwdiI6IjcuNC45IiwicHQiOiJjZ2ktZmNnaSIsImN2IjoiNy43MC4wIiwiY3MiOiJPcGVuU1NMXC8xLjEuMWciLCJzdiI6Ik1pY3Jvc29mdC1JSVNcLzEwLjAiLCJkdiI6IjguMC4xOCJ9&betaFeed=0&action=timestamp)[ Sep 08 11:23:16] Calling Wordfence API v2.26:[https://noc1.wordfence.com/v2.26/?k=8592d1b2d838528add53321214c0a0336d2372bcbe60600743188b20412b2b6a03636c9d90b8052eb069c298b9397fc1352143e74b82ca52fa6a77e2164dfdab41479930c1b7b3f77a7a1f3375871fc9&s=eyJ3cCI6IjUuNS4xIiwid2YiOiI3LjQuMTEiLCJtcyI6ZmFsc2UsImgiOiJodHRwczpcL1wvcGFja2FnaW5nZHluYW1pY3MuY29tIiwic3NsdiI6MjY5NDg4MjU1LCJwdiI6IjcuNC45IiwicHQiOiJjZ2ktZmNnaSIsImN2IjoiNy43MC4wIiwiY3MiOiJPcGVuU1NMXC8xLjEuMWciLCJzdiI6Ik1pY3Jvc29mdC1JSVNcLzEwLjAiLCJkdiI6IjguMC4xOCJ9&betaFeed=0&action=resolve_ips](https://noc1.wordfence.com/v2.26/?k=8592d1b2d838528add53321214c0a0336d2372bcbe60600743188b20412b2b6a03636c9d90b8052eb069c298b9397fc1352143e74b82ca52fa6a77e2164dfdab41479930c1b7b3f77a7a1f3375871fc9&s=eyJ3cCI6IjUuNS4xIiwid2YiOiI3LjQuMTEiLCJtcyI6ZmFsc2UsImgiOiJodHRwczpcL1wvcGFja2FnaW5nZHluYW1pY3MuY29tIiwic3NsdiI6MjY5NDg4MjU1LCJwdiI6IjcuNC45IiwicHQiOiJjZ2ktZmNnaSIsImN2IjoiNy43MC4wIiwiY3MiOiJPcGVuU1NMXC8xLjEuMWciLCJzdiI6Ik1pY3Jvc29mdC1JSVNcLzEwLjAiLCJkdiI6IjguMC4xOCJ9&betaFeed=0&action=resolve_ips)[ Sep 08 11:23:24] Scan stop request received. [Sep 08 11:23:28] Ajax request received to start scan. [Sep 08 11:23:28] Entering start scan routine [Sep 08 11:23:28] Got value from wf config maxExecutionTime: 0 [Sep 08 11:23:28] Got max_execution_time value from ini: 300 [Sep 08 11:23:28] ini value of 300 is higher than value for WORDFENCE_SCAN_MAX_INI_EXECUTION_TIME (90), reducing [Sep 08 11:23:28] getMaxExecutionTime() returning half ini value: 45 [Sep 08 11:23:28] Starting cron via proxy at URL [https://noc1.wordfence.com/scanp/packagingdynamics.com/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&scanMode=standard&cronKey=547ad1fa3e9a8131671287a117d252bb&k=8592d1b2d838528add53321214c0a0336d2372bcbe60600743188b20412b2b6a03636c9d90b8052eb069c298b9397fc1352143e74b82ca52fa6a77e2164dfdab41479930c1b7b3f77a7a1f3375871fc9&ssl=1&signature=37e7fed95746f7e240d8cf931c638d8f95a0de3b6f8d74f4ef7f7cdf94fe8129](https://noc1.wordfence.com/scanp/packagingdynamics.com/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&scanMode=standard&cronKey=547ad1fa3e9a8131671287a117d252bb&k=8592d1b2d838528add53321214c0a0336d2372bcbe60600743188b20412b2b6a03636c9d90b8052eb069c298b9397fc1352143e74b82ca52fa6a77e2164dfdab41479930c1b7b3f77a7a1f3375871fc9&ssl=1&signature=37e7fed95746f7e240d8cf931c638d8f95a0de3b6f8d74f4ef7f7cdf94fe8129)[ Sep 08 11:23:28] Scan process ended after forking. * Plugin Support [WFAdam](https://wordpress.org/support/users/wfadam/) * (@wfadam) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13377640) * [@axe6st](https://wordpress.org/support/users/axe6st/) * Lets try to change the execution time: - Kill the existing scan if it is still running (The “Start New Scan” button turns in to a “Stop” button while the scan is running) - Go to your Scan > Scan Options and Scheduling page and locate the “Performance Options” Set “Maximum execution time for each scan stage” to 20 on the options page - Click to “Save Changes” * On occasion, this fixes it straight away. That’s because adding 20 for the **“ Maximum execution time for each scan stage”** tells the scan to pause every 20 seconds and start again where it left off. If this fixes the issue and scans run again, you can leave all the settings above. * Thread Starter [Gary H](https://wordpress.org/support/users/axe6st/) * (@axe6st) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13377690) * No luck. It’s interesting that right after I click scan, it shows this. [SEP 08 11:33:51] Scan stop request received. Wordfence does work on my sites that don’t have SSL enabled. And I’m wondering what the error in the event viewer is about that says none of the cipher suites supported by the client application are supported by the server. I’m at a loss, but does that mean I need to add cipher suites used by wordfence? Or am I reading too much into that? Axe6st * Plugin Support [WFAdam](https://wordpress.org/support/users/wfadam/) * (@wfadam) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13377986) * Just looking over the scan log again, it looks like `https://noc1.wordfence.com/` might be getting blocked as well. Ensure to whitelist this and make sure your host is not blocking this as well. * When did this start happening? As soon as you added SSL? * Also try to enable Tools > Diagnostics > Debugging Options > Start all scans remotely * Let me know if this helps! * Thanks! * Thread Starter [Gary H](https://wordpress.org/support/users/axe6st/) * (@axe6st) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13378250) * I’m assuming it started when I enabled SSL, but to be honest, I didn’t check wordfence for a week or 2 after enabling SSL since it seemed to be working correctly. I whitelisted that url in IIS but still no luck. If I try to ping it doesn’t ping back. Probably not supposed to though. If I got to the url I whitelisted in a web browser I get a blank page that says Your site did not send an API key when contacting the Wordfence servers, so I think that means my server is not blocking that url. I also just added rules to the windows firewall allowing all wordfence server IP’s to connect. After restarting the server I am still getting the same messages. Axe6st * Plugin Support [WFAdam](https://wordpress.org/support/users/wfadam/) * (@wfadam) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13378294) * In your scan log that we enabled, can you find the line: `Starting cron with normal ajax at URL` – copy and paste that URL in a browser and tell me the result. * If its a 403, then the admin-ajax.php is being blocked. * Let me know what you find. * Thanks! * Thread Starter [Gary H](https://wordpress.org/support/users/axe6st/) * (@axe6st) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13378354) * That’s a really long url. I tried it in a browser and I get 400 bad request. Tried it on both my server and my home pc. AXe6st * Thread Starter [Gary H](https://wordpress.org/support/users/axe6st/) * (@axe6st) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13378372) * OK, I looked the view full log and I was using a shortened url. With the correct url I get OK with https on that url. Axe6st * Plugin Support [WFAdam](https://wordpress.org/support/users/wfadam/) * (@wfadam) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13378391) * Something is blocking access to your `admin-ajax.php` then. Typically when I see this, you need to contact the host for help resolving it. * Also, as I mentioned before, Wordfence is not technically supported on the Windows platform. * You could attempt to reinstall Wordfence as the last shot, just to ensure it was nothing wrong with the plugin. * you can backup your Wordfence settings via the Export option (Wordfence > Tools > Import/Export Options and click Export. You can also take note of the current Whitelisted URLs you have in Wordfence > Firewall > All Firewall Options > Whitelisted URLs as these are not included in the Import/Export, and will be lost during the re-install. Here is what is exported: [https://www.wordfence.com/help/tools/import-export/](https://www.wordfence.com/help/tools/import-export/) During the export, you will be given a long string of text. Keep this safe, you’ll need it in a few minutes. * After that, enable the option to Delete Wordfence tables and data on deactivation in Wordfence > All Options > General Wordfence Options. You will want to remember to disable this after you reinstall Wordfence again. * After you enable that option, you can deactivate Wordfence from the Plugins area of your site, then delete it. Next, from the plugins area, search for and re- install Wordfence like normal. * It will be like setting Wordfence up for the first time. You will need to enter an email address, and then go into Wordfence > Tools > Import/Export Options and paste that string of text into the Import Wordfence Options field and click the button there. * The firewall will be in Learning Mode by default for 7 days. I would recommend switching this to “Enabled and Protected” as soon as possible. * Hope this helps! * Thanks! * Thread Starter [Gary H](https://wordpress.org/support/users/axe6st/) * (@axe6st) * [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/#post-13378426) * Did you see my second post, it says OK with https. Is that still saying something is blocking ajax? One of my first steps was to uninstall it completely and reinstall it. I don’t mind having to set up the features I want again, but I’ll try again a little later and save my settings and then test before and after importing my settings back in. I have to run out for a while so I’ll update you here later. Thanks for your help. Axe6st Viewing 15 replies - 1 through 15 (of 17 total) 1 [2](https://wordpress.org/support/topic/server-didnt-send-an-api-key/page/2/?output_format=md) [→](https://wordpress.org/support/topic/server-didnt-send-an-api-key/page/2/?output_format=md) The topic ‘server didn’t send an API key’ is closed to new replies. * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865) * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/) * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq) * [Support Threads](https://wordpress.org/support/plugin/wordfence/) * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/) * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/) ## Tags * [api key](https://wordpress.org/support/topic-tag/api-key/) * [SSL](https://wordpress.org/support/topic-tag/ssl/) * 17 replies * 2 participants * Last reply from: [WFAdam](https://wordpress.org/support/users/wfadam/) * Last activity: [5 years, 11 months ago](https://wordpress.org/support/topic/server-didnt-send-an-api-key/page/2/#post-13381830) * Status: resolved