The WordPress app doesn't work with my website

Knowledgebase

WordPress | Updated 2026

If the WordPress mobile app (for iOS or Android) cannot connect to your site, it usually means the XML-RPC or REST API endpoint is blocked. Here is how to fix it.

In This Guide

XML-RPC May Be Blocked
REST API Issues
JetPack Connection Required
SSL Certificate Issues

Most Common Cause

XML-RPC is blocked by a security plugin or server rule

Many security plugins (Wordfence, iThemes Security, etc.) block xmlrpc.php to prevent brute-force attacks. The WordPress mobile app needs XML-RPC or the REST API to communicate with your site. Check your security plugin settings and whitelist the WordPress app, or switch to using JetPack for the app connection.

01. XML-RPC May Be Blocked

Test if XML-RPC is accessible by visiting yourdomain.com/xmlrpc.php in your browser. You should see "XML-RPC server accepts POST requests only." If you see a 403 error or blank page, it is blocked.

To unblock:

Security plugins - Check Wordfence, iThemes Security, All In One WP Security, or similar plugins for an XML-RPC disable option and turn it off (or whitelist the app)
.htaccess rules - Check for rules blocking xmlrpc.php. Look for lines like Deny from all inside a <Files xmlrpc.php> block and remove or comment them out
ModSecurity - Server-level rules may block XML-RPC. If you cannot find a plugin or .htaccess block, open a ticket and we can check

02. REST API Issues

The WordPress app can also use the REST API instead of XML-RPC. Test it by visiting yourdomain.com/wp-json/ in your browser. You should see a JSON response. If you see an error, check:

Permalink structure - The REST API requires pretty permalinks. Go to Settings > Permalinks and make sure it is not set to "Plain." See SEO Friendly URLs.
Security plugins - Some plugins disable the REST API for unauthenticated users

03. JetPack Connection

The WordPress app works best when your site has JetPack installed and connected to WordPress.com. JetPack provides an alternative connection method that bypasses XML-RPC restrictions. If you prefer not to enable XML-RPC, install JetPack and log into the app with your WordPress.com account.

04. SSL Certificate Issues

If your site uses HTTPS but has an invalid or expired SSL certificate, the app may refuse to connect. Check your SSL status in cPanel > Security > SSL/TLS Status. See SSL Certificates and HTTPS.