If the WordPress mobile app (for iOS or Android) cannot connect to your site, it usually means the XML-RPC or REST API endpoint is blocked. Here is how to fix it.
XML-RPC is blocked by a security plugin or server rule
Many security plugins (Wordfence, iThemes Security, etc.) block xmlrpc.php to prevent brute-force attacks. The WordPress mobile app needs XML-RPC or the REST API to communicate with your site. Check your security plugin settings and whitelist the WordPress app, or switch to using JetPack for the app connection.
01. XML-RPC May Be Blocked
Test if XML-RPC is accessible by visiting yourdomain.com/xmlrpc.php in your browser. You should see "XML-RPC server accepts POST requests only." If you see a 403 error or blank page, it is blocked.
To unblock:
- Security plugins - Check Wordfence, iThemes Security, All In One WP Security, or similar plugins for an XML-RPC disable option and turn it off (or whitelist the app)
- .htaccess rules - Check for rules blocking xmlrpc.php. Look for lines like
Deny from allinside a<Files xmlrpc.php>block and remove or comment them out - ModSecurity - Server-level rules may block XML-RPC. If you cannot find a plugin or .htaccess block, open a ticket and we can check
02. REST API Issues
The WordPress app can also use the REST API instead of XML-RPC. Test it by visiting yourdomain.com/wp-json/ in your browser. You should see a JSON response. If you see an error, check:
- Permalink structure - The REST API requires pretty permalinks. Go to Settings > Permalinks and make sure it is not set to "Plain." See SEO Friendly URLs.
- Security plugins - Some plugins disable the REST API for unauthenticated users
03. JetPack Connection
The WordPress app works best when your site has JetPack installed and connected to WordPress.com. JetPack provides an alternative connection method that bypasses XML-RPC restrictions. If you prefer not to enable XML-RPC, install JetPack and log into the app with your WordPress.com account.
04. SSL Certificate Issues
If your site uses HTTPS but has an invalid or expired SSL certificate, the app may refuse to connect. Check your SSL status in cPanel > Security > SSL/TLS Status. See SSL Certificates and HTTPS.
App Still Not Connecting?
If the app cannot connect after checking these items, open a ticket with the error message the app shows.
Open a Support TicketFrequently Asked Questions
Why can the WordPress mobile app not connect to my site?
Usually the XML-RPC or REST API endpoint the app relies on is blocked, by a security plugin, by server rules, or by an SSL issue. The app uses these endpoints to talk to your site, so if they are blocked it cannot connect.
How do I fix the WordPress app not connecting?
Make sure XML-RPC (xmlrpc.php) and the REST API (/wp-json/) are reachable and not blocked by a security plugin or .htaccess rule, confirm your SSL certificate is valid, and check the Jetpack connection if the app uses it. Re-enable the endpoint the app needs, then reconnect.
Is it safe to enable XML-RPC for the app?
XML-RPC is a common brute-force and amplification target, so if you enable it for the app, pair it with login protection and strong passwords, or restrict access. The modern app increasingly uses the REST API instead, so enabling just the REST API may be enough.
Why does the app fail with an SSL error?
The app requires a valid SSL certificate. If yours is missing, expired, or for the wrong hostname, the app refuses to connect. Confirm AutoSSL has issued a valid certificate for the exact domain you entered in the app, then retry.
Quick Recap
- Test xmlrpc.php - Visit yourdomain.com/xmlrpc.php to check if it is blocked
- Check security plugins for XML-RPC or REST API blocks
- Check .htaccess for rules blocking xmlrpc.php
- Install JetPack as an alternative connection method
- Verify SSL certificate is valid
WordPress mobile app troubleshooting · Last updated November 2026 · Browse all WordPress articles
