chandelierrr

Hi @bentziwpbinder, thanks for reporting this, and we’re here to help.

Kadence Security’s dashboard and User Security screens load through the WordPress REST API and JavaScript, so when the dashboard is blank or filters/settings do not stick, it is usually an environment or conflict issue.

To narrow it down, please try these steps:

1. Update Kadence Security to the latest version.
2. Conflict test: deactivate all other plugins except Kadence Security, switch to a default theme (Twenty Twenty-Five), then check the dashboard and User Security filters again.
3. If you use JS minification/combine in a cache plugin, exclude Kadence Security scripts or turn that off temporarily.
4. Confirm the REST API is reachable: visit yoursite.com/wp-json/ in the browser. If that fails or redirects oddly, check server rules, security plugins, or Hide Backend settings.
5. Confirm your server allows the HTTP methods the REST API needs. Some hosts, WAFs, or .htaccess rules block <code class=””>PUT, <code class=””>PATCH, <code class=””>DELETE, or <code class=””>OPTIONS, which can prevent settings from saving and filters from applying. Your host or server admin can verify that <code class=””>GET, <code class=””>POST, <code class=””>PUT, <code class=””>PATCH, <code class=””>DELETE, and <code class=””>OPTIONS are allowed for /wp-json/ requests.
6. Add <code class=””>define( ‘SCRIPT_DEBUG’, true ); to wp-config.php temporarily, reload the Security pages, and note any new console errors.

If the conflict test fixes it, reactivate plugins one by one to find the culprit. If it still fails with only Kadence Security active, try deactivating and reinstalling a fresh copy from WordPress.org.

Let us know how it goes.

Hi @akhilalosious,

Thanks for reaching out and for including the Network tab details. That rest_no_route response is a helpful clue.

When you click No > Skip Site Scan, Kadence Security saves your answer and moves setup to the next step. That happens through a REST API request (a PUT to /wp-json/ithemes-security/v1/site-types/non-profit). The button itself does not run a scan, but it still needs that REST call to succeed.

Getting a 404 with rest_no_route on that action usually means WordPress received the request, but the server or something on the site blocked the specific method or route the plugin needs. 

Kindly try these steps for troubleshooting:

• Go to Settings → Permalinks and make sure you are not using Plain. Resave the permalinks to flush them.
• Confirm the REST API is working by visiting:
  • https://yoursite.com/wp-json
  • https://yoursite.com/wp-json/ithemes-security/v1/site-types 
  • You should see JSON, not a blank page or HTML error. 401 is okay.
• Confirm with your hosting provider that the server allows all REST HTTP methods: GET, POST, PUT, PATCH, DELETE, and OPTIONS (this is an important step)
• If the problem persists, rule out plugin or theme conflicts on a staging environment.

I hope this helps!

• This reply was modified 6 days, 9 hours ago by chandelierrr. Reason: incorrect format

Hi @jeffscroggs,

Glad you reached out, and thanks for sharing the error details.

The Fatal Error/Scan Failed entry doesn’t necessarily mean PHP crashed on your site. In Kadence Security, that log type means the File Change scan was interrupted before it could finish. Your log shows it stopped during the “get-files” step on the uploads chunk (when the plugin walks wp-content/uploads and hashes files to compare against the last scan).

The apple-touch-icon.png URL in the log is just the page request that happened to be running when the failure was recorded (notice there’s no logged-in user) and it’s not the file that caused the problem.

Kindly try these steps and observe if it resolves the error:

• In Security → Settings → Features → Site Check → File Change, under Excluded Files and Folders, consider excluding /wp-content/uploads (or specific heavy subfolders like backup/cache dirs if you use those).
• Under Ignore File Types, add extensions you don’t need monitored such as .pdf, .zip, .doc, .docx, if those make up most of your uploads.
• Wait for another File Change scan to run and check Security → Logs around the same time for related recovery entries. Those confirm a timeout/stuck scan rather than a specific bad file.
• If scans keep failing: enable Debug (under the Security menu), go to Scheduler, click Reset, then re-run your scans.
  • To enable Debug, open your wp-config.php file and paste this code: define('ITSEC_DEBUG', true); before the line that says /* That's all, stop editing! Happy publishing. */
• Ask your host (or check your server error log) whether PHP hit a max execution time limit around <code class=””>2026-06-11 19:19.

Let us know how it goes.

Hi @wp207,

Glad you reached out and we’re here to help!

In order to give you the next best steps, can you please confirm whether you’re referring to the Site Scan functionality of the plugin?

If so, kindly forward the raw details of the error that you’re seeing in Security > Logs.

If the problem is different, kindly elaborate the issue and if possible, include screenshots/error details.

Looking forward to your response.

Hi @isidore1964,

No worries at all, and glad you narrowed it down!

I’ll close this thread for now, but please don’t hesitate to reach out again anytime.

Hi @isidore1964,

Glad you reached out, and sorry you’re running into trouble after the update.

To help isolate the cause, we need a bit more detail from your site. Can you please provide more details about the problem? Specifically:

• What exactly breaks? For example: white screen, PHP error message, block editor won’t load, recipe pages or shortcodes broken, etc. A short list of steps to reproduce the issue helps a lot.
• Errors from WordPress debug logging by temporarily enabling it on a staging environment where the issue occurs. In wp-config.php, above the line that says /* That's all, stop editing! */, add or set:

define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
@ini_set( 'display_errors', 0 );

Then reproduce the problem once, and check wp-content/debug.log for new lines from that time.

• Your site environment details: WP version, PHP version, plugin versions, active theme

With the exact symptoms plus debug.log info, we can narrow this down much faster.

Thanks again for taking the time to report this.

Hi @jampotjaffa,

So sorry for the delayed response, and I’m glad you got the issues squared away!

I’m adding some of our help articles here for future reference that can help you when you encounter those issues again:

• Help! I’ve locked myself out of my site! – helpful when you get locked out or forgot the HBE URL.
• Encryption Key Management – can help you set a new encryption key or rotate the existing one, since there’s no option to edit the initial post.

I’ll mark this thread resolved now, but feel free to reach out again if you need help.