XMLRPC.php Still Being Blocked

Hi @thewatchman3,

Please try the method explained in the following answer first.

I understand the frustration. Let’s get MarsEdit working.

The “500 Error” suggests that a security rule (likely the WAF) is intercepting the complex XML data sent by MarsEdit and blocking it, even if the XML-RPC setting itself is open.

The Solution (Global Exclusion):
To guarantee access for your app without lowering your overall security, please add the endpoint to the Global Exclusion list. This bypasses all checks (WAF, etc.) for that specific URL.

1. Go to Security > Settings > General Settings.
2. Find the “Global URL Exclusions” box.
3. Add /xmlrpc.php on a new line.
4. Click Save.

Check your XML-RPC Mode:
Go to Security > Settings > Login & User Protection.
Ensure “XML-RPC Protection Mode” is set to “Smart Protection” (recommended) or “Enabled” (if Smart blocks it). Do NOT set it to “Completely Disabled”.

This combination (Exclusion + Enabled) will allow MarsEdit to connect flawlessly.

One last check:
Please also go to Security > Blocking Rules > Honeypot URLs (& WAF) and ensure that /xmlrpc.php is NOT in that list. Sometimes it is added there by mistake, which would instantly block any app trying to use it.

Best regards,

Advanced Ip Blocker

• This reply was modified 1 month, 4 weeks ago by IniLerm.

Advanced method:

1. Go to Security > Blocking Rules > Advanced Rules.
2.  + Add New Rule
3. Rule Name: MarsEdit
4. IF (All conditions must be met): Request URI -> Contains -> xmlrpc.php
5. Click AND to generate a new condition
6. AND User-Agent -> Contains -> MarsEdit
7. Action Allow (Bypass Security)
8. Click Save Rule.

• This reply was modified 1 month, 4 weeks ago by IniLerm.

Hi @thewatchman3,

Good news! We have just released version 8.8.0, which includes the fix for Application Passwords and XML-RPC compatibility.

Steps to fix your MarsEdit connection safely:

1. Update the plugin to version 8.8.0.
2. Re-enable 2FA for your user account (Security > Settings > Login & User Protection).
3. Test MarsEdit: It should now connect perfectly using your Application Password without being intercepted by the 2FA screen.

Important Security Note:
If you added /xmlrpc.php to the “Global URL Exclusions” list as a temporary workaround, please remove it now. With this update, you don’t need that exclusion anymore, and removing it ensures your site stays fully protected against brute-force attacks on that endpoint.

One more thing:
This update (v8.8.0) includes a major architectural upgrade for better performance and stability. After updating, we recommend clearing your browser cache (Ctrl+F5) and any server-side caches (like Redis/Object Cache) to ensure the new interface loads correctly.

Let me know if everything works as expected!

Best regards,

Advanced IP Blocker Team

Hi Greg,

I am sorry to hear that the issue persists. Since you are seeing a “Critical Error” message (Error 500) instead of a “Forbidden” message (Error 403), this means the plugin is encountering a PHP conflict or crash when MarsEdit tries to connect, rather than just blocking it.

To fix this, we need to know exactly what is crashing.

How to get the error log (Safely):

Please access your site files (via FTP or your Hosting File Manager) and edit the wp-config.php file in the root directory.

Look for define( ‘WP_DEBUG’, false ); and replace it with this block of code. This will enable logging to a file without showing errors to your visitors:

// =============================================================
// SAFE DEBUGGING (LOG ONLY, NO DISPLAY)
// =============================================================
// 1. Enable debug mode
define( 'WP_DEBUG', true );

// 2. Save errors to /wp-content/debug.log
define( 'WP_DEBUG_LOG', true ); 

// 3. DO NOT show errors on screen (Critical for live sites)
define( 'WP_DEBUG_DISPLAY', false );
@ini_set( 'display_errors', '0' );
// =============================================================

Next Steps:

1. Save the file.
2. Enable the plugin.
3. Trigger the error with MarsEdit again.
4. Go back to your files and look for a new file called debug.log inside the /wp-content/ folder.
5. Open it and verify the last lines. You will see a “Fatal Error” message pointing to a specific file and line number.

If you can paste that error message here (removing any sensitive paths), I can likely provide a fix immediately.

Thank you for your patience!

Best regards,

IniLerm

• This reply was modified 1 month, 3 weeks ago by IniLerm.