Why is Jetpack trying to connect to my site?

  • Resolved drgonzo3000

    (@drgonzo3000)


    1 year, 8 months ago

    I’m continually seeing more and more requests from Jetpack trying to access my site. It’s attempting to make rest calls and access the XMLRPC. Both endpoints are blocked for security reasons. I have never installed jetpack and have no intention of doing so. They are coming from various IP address on the 192.0.*.* block. What do I need to do to get this to stop outside of blocking the entire AUTOMATTIC cidr range?

    Ashburn, Virginia, United States arrived from https://labs.gonzoinc.com/?rest_route=%2Fwp%2Fv2%2Fusers%2Fme&_method=get&fields=id%2Cusername%2Cid_… and was blocked for Manual block by administrator at https://labs.gonzoinc.com/?rest_route=%2Fwp%2Fv2%2Fusers%2Fme&_method=get&fields=id%2Cusername%2Cid_wpcom…
    1/8/2025 9:38:52 AM (1 hour 2 mins ago)  
    IP: 192.0.102.228 Hostname: 192.0.102.228
    Human/Bot: Bot
    Jetpack by WordPress.com
    Ashburn, Virginia, United States arrived from https://labs.gonzoinc.com/?rest_route=%2Fwp%2Fv2%2Fusers%2Fme&_method=get&fields=id%2Cusername%2Cid_… and was blocked for Manual block by administrator at https://labs.gonzoinc.com/?rest_route=%2Fwp%2Fv2%2Fusers%2Fme&_method=get&fields=id%2Cusername%2Cid_wpcom…
    1/8/2025 9:38:52 AM (1 hour 2 mins ago)  
    IP: 192.0.102.228 Hostname: 192.0.102.228
    Human/Bot: Bot
    Jetpack by WordPress.com
Viewing 4 replies - 1 through 4 (of 4 total)
  • Bruce (a11n)

    (@bruceallen)

    Happiness Engineer

    1 year, 8 months ago

    Hi @drgonzo3000

    I took a look and the requests are coming because your site has WooCommerce installed, and there’s integration with WooCommerce Payments (which requires a Jetpack connection, but the plugin is not needed).

    In addition, your site is using the Storefront theme (WordPress.com’s default WooCommerce theme), which has some built-in integrations with Jetpack services.

    Thread Starter drgonzo3000

    (@drgonzo3000)

    1 year, 8 months ago

    WooCommerce Payments is not a plugin I have installed, I use a Paypal plugin to process payments.

    Jetpack functionality in the storefront theme is only loaded if Jetpack is installed. So the class-storefront-jetpack.php should never be loading on my site. https://github.com/search?q=repo%3Awoocommerce%2Fstorefront++jetpack&type=code

    Also, these are inbound requests from WordPress servers not outbound requests from something embedded in my instance. So the question still stands, why is Jetpack trying to gather data from my site?

    It’s attempting to hit an endpoint that doesn’t exist and using a token and hash so I assume it’s trying to authenticate.
    ?rest_route=/jetpack/v4/connection/data&_for=jetpack

    Bruce (a11n)

    (@bruceallen)

    Happiness Engineer

    1 year, 8 months ago

    Hi @drgonzo3000

    Thank you for the additional information.

    Did you ever have WooCommerce Payments and then remove it? From our end it does look that way, because we have a Jetpack Site ID for labs.gonzoinc.com, which says that the Jetpack connection was through WooCommerce Payments.

    I’ve removed that connection from our end. Can you monitor and see if this resolves the issue?

    Thread Starter drgonzo3000

    (@drgonzo3000)

    1 year, 8 months ago

    It was possibly installed when the site was originally created and testing out payment plugins, but I don’t specifically remember what all plugins we tested.

    Regardless I never authorized Jetpack to connect to my site to harvest data through a different plugin that has zero mention of it also installing a Jetpack sniffer to harvest data from my site. Then years later after the original plugin was uninstalled, jetpack has still continually tried to make a connection to my site. Jetpack is basically spyware at that point as it installed itself without direct authorization, generated the necessary auth tokens to allow access to rest endpoints it created and then never unregistered itself when the plugin was removed.

    I thank you for unregistering my site, but I have already blocked the entire WordPress CIDR block at the firewall to ensure it stops.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Why is Jetpack trying to connect to my site?’ is closed to new replies.