If the WordPress mobile app (for iOS or Android) cannot connect to your site, it usually means the XML-RPC or REST API endpoint is blocked. Here is how to fix it.
XML-RPC is blocked by a security plugin or server rule
Many security plugins (Wordfence, iThemes Security, etc.) block xmlrpc.php to prevent brute-force attacks. The WordPress mobile app needs XML-RPC or the REST API to communicate with your site. Check your security plugin settings and whitelist the WordPress app, or switch to using JetPack for the app connection.
01. XML-RPC May Be Blocked
Test if XML-RPC is accessible by visiting yourdomain.com/xmlrpc.php in your browser. You should see "XML-RPC server accepts POST requests only." If you see a 403 error or blank page, it is blocked.
To unblock:
- Security plugins - Check Wordfence, iThemes Security, All In One WP Security, or similar plugins for an XML-RPC disable option and turn it off (or whitelist the app)
- .htaccess rules - Check for rules blocking xmlrpc.php. Look for lines like
Deny from allinside a<Files xmlrpc.php>block and remove or comment them out - ModSecurity - Server-level rules may block XML-RPC. If you cannot find a plugin or .htaccess block, open a ticket and we can check
02. REST API Issues
The WordPress app can also use the REST API instead of XML-RPC. Test it by visiting yourdomain.com/wp-json/ in your browser. You should see a JSON response. If you see an error, check:
- Permalink structure - The REST API requires pretty permalinks. Go to Settings > Permalinks and make sure it is not set to "Plain." See SEO Friendly URLs.
- Security plugins - Some plugins disable the REST API for unauthenticated users
03. JetPack Connection
The WordPress app works best when your site has JetPack installed and connected to WordPress.com. JetPack provides an alternative connection method that bypasses XML-RPC restrictions. If you prefer not to enable XML-RPC, install JetPack and log into the app with your WordPress.com account.
04. SSL Certificate Issues
If your site uses HTTPS but has an invalid or expired SSL certificate, the app may refuse to connect. Check your SSL status in cPanel > Security > SSL/TLS Status. See SSL Certificates and HTTPS.
App Still Not Connecting?
If the app cannot connect after checking these items, open a ticket with the error message the app shows.
Open a Support TicketQuick Recap
- Test xmlrpc.php - Visit yourdomain.com/xmlrpc.php to check if it is blocked
- Check security plugins for XML-RPC or REST API blocks
- Check .htaccess for rules blocking xmlrpc.php
- Install JetPack as an alternative connection method
- Verify SSL certificate is valid
WordPress mobile app troubleshooting · Last updated March 2026 · Browse all WordPress articles
