If Jetpack is blocking your access to your own WordPress site, showing a "blocked by Jetpack" message, or causing 403/503 errors, it's usually because Jetpack's Brute Force Protection feature has flagged your IP. This can also happen when ModSecurity on the server conflicts with Jetpack's security features. Here's how to fix it and prevent it from happening again.
Whitelist Your IP in Jetpack
If you're locked out by Jetpack's Brute Force Protection:
- Access your site via FTP or cPanel File Manager
- Rename the Jetpack plugin folder:
wp-content/plugins/jetpacktojetpack_disabled - Log into WordPress, go to Jetpack > Settings > Security, whitelist your IP
- Rename the folder back to
jetpack
01. Jetpack Brute Force Protection Block
Jetpack's Brute Force Protection feature tracks failed login attempts across all WordPress sites connected to WordPress.com. If your IP triggers too many failed logins (even on other sites), Jetpack blocks it globally. This means you can get blocked from your own site because of failed logins on a completely unrelated WordPress site.
If You Can Still Access wp-admin
- Go to Jetpack > Settings > Security
- Find "Brute force attack protection"
- Add your IP to the whitelist - enter your IP address (search "what is my IP" in Google)
- Click Save
If You're Completely Locked Out
- Connect via FTP - use FileZilla or cPanel File Manager
- Navigate to
wp-content/plugins/ - Rename
jetpacktojetpack_disabled. This deactivates Jetpack and removes the block - Log into WordPress - you should now have access
- Rename the folder back to
jetpack - In WordPress admin - go to Plugins, reactivate Jetpack, then whitelist your IP in Jetpack > Settings > Security
If your IP changes frequently (dynamic IP from your ISP), consider disabling Jetpack Brute Force Protection entirely and using the server-side firewall (CSF) instead. CSF already provides login failure protection and doesn't have the cross-site blocking issue.
02. ModSecurity Conflicts
Jetpack communicates with WordPress.com servers for features like site stats, downtime monitoring, and security scanning. Some of these requests can trigger ModSecurity rules on the server, causing 403 errors or broken Jetpack features.
Symptoms
- Jetpack dashboard shows "connection error" or "site is not accessible"
- Jetpack features intermittently stop working
- Error log shows ModSecurity blocks related to Jetpack XML-RPC calls
Fix
Check cPanel > Errors for ModSecurity entries mentioning xmlrpc.php or Jetpack user agents. If you find them, open a support ticket with the error log entries. We can whitelist the specific ModSecurity rules for your account without disabling security broadly.
Don't disable ModSecurity entirely just to fix Jetpack. XML-RPC is a frequent attack vector and ModSecurity provides important protection. We can surgically whitelist Jetpack's traffic while keeping protection for everything else.
03. Jetpack Connection Issues
If Jetpack can't connect to WordPress.com ("Your Jetpack has a glitch"), check these:
- XML-RPC enabled - Jetpack requires XML-RPC. Some security plugins disable it. Make sure
xmlrpc.phpis accessible. Test by visitingyourdomain.com/xmlrpc.php- it should show "XML-RPC server accepts POST requests only" - WordPress.com IPs whitelisted - if you have IP restrictions in .htaccess or a security plugin, Jetpack's servers need access. Jetpack uses WordPress.com IP ranges which change frequently; Jetpack's own documentation has the current list
- SSL issues - Jetpack requires a working SSL certificate. If your site has mixed content or an expired certificate, the connection may fail. See our Mixed Content guide
- Server firewall (CSF) blocking Automattic's IPs - if Jetpack reports it cannot connect to your site, the server firewall may be blocking WordPress.com/Automattic IP ranges. Those ranges change often, so rather than chase them, open a ticket with the exact Jetpack error and we will whitelist Jetpack's current ranges for your account.
False "Site Is Offline" Alerts
Jetpack's Monitor feature emails you when it thinks your site is down, and it sometimes fires false alarms - a brief network blip between WordPress.com and the server rather than a real outage. If you get an "offline" alert but your site loads normally in a browser, it is almost always a false positive. Confirm from an outside network with our Up or Down checker before worrying. If the alerts are frequent and always false, turn off Jetpack Monitor and use a dedicated uptime service (see the alternatives below).
04. Lighter Alternatives to Jetpack
Jetpack is a large plugin that bundles many features, most of which you probably don't use. If you're only using it for one or two features, lighter alternatives reduce resource usage and avoid the connection/blocking issues:
- Site stats - use Google Analytics or the Jetpack Stats standalone plugin (without full Jetpack)
- Brute force protection - already provided by the server firewall (CSF/LFD). Or use Wordfence (free)
- Downtime monitoring - UptimeRobot (free for up to 50 monitors)
- Contact forms - WPForms Lite, Contact Form 7
- Image CDN - Cloudflare (free) or ShortPixel
- Related posts - Yet Another Related Posts Plugin (YARPP)
We've seen sites cut their load time in half just by replacing Jetpack with individual lightweight plugins for the features they actually use. If your site is hitting resource limits, Jetpack is one of the first plugins to evaluate.
Need Help With Jetpack Issues?
If Jetpack is causing persistent problems on your site, open a ticket. We can check the server-side logs and ModSecurity rules to find the specific conflict.
Open a Support TicketFrequently Asked Questions
Why is Jetpack blocking access to my own WordPress site?
Jetpack's Brute Force Protection can flag your IP and show a blocked-by-Jetpack message or a 403 or 503 error, even on your own site. It can also conflict with the server ModSecurity firewall. The usual cause is the protection feature misreading your activity as an attack.
How do I fix a blocked-by-Jetpack error?
Unblock your IP from the Jetpack Protect settings in your WordPress dashboard or WordPress.com account, or wait for the temporary block to expire. If it recurs, review the ModSecurity conflict and consider a lighter security plugin, since the server already provides firewall protection.
Does Jetpack conflict with server security on shared hosting?
It can. Jetpack's security features overlap with the server ModSecurity and firewall, which can cause double-blocking or false positives. On our hosting the server already protects you, so Jetpack's heavy security modules are often unnecessary.
Is there a lighter alternative to Jetpack?
Yes. Jetpack bundles many features and adds overhead, so on shared hosting a lighter, single-purpose plugin for just the feature you need is usually better. The server already handles brute-force and firewall protection, so you can avoid the heaviest Jetpack modules.
Quick Recap: Fix Jetpack Blocks
If you only do 5 things from this guide, do these:
- Locked out? - rename the jetpack plugin folder via FTP to disable it, then log in
- Whitelist your IP - in Jetpack > Settings > Security after regaining access
- Check error logs - cPanel > Errors for ModSecurity blocks on xmlrpc.php
- Consider lighter alternatives - Jetpack is heavy; individual plugins may serve you better
- Don't disable ModSecurity - ask support for a targeted rule exception instead
Last updated November 2026 · Browse all WordPress articles · See also: WordPress Security Guide
