Metorik Docs
Store Connection Errors

Your host or a security plugin is blocking Metorik

What this error means

Metorik connects to your store through the WooCommerce REST API (yourstore.com/wp-json/...). Your host's firewall or a security plugin is treating Metorik like a bot and blocking it, usually with a 403 Forbidden error, a Bot Verification page, a 429 Too Many Requests error or a "Your access to this site has been limited" message. Your store is fine; the firewall just needs to let Metorik in.

First: find out what's blocking

  1. Read the error title in Metorik. This guide covers "Your host or a security plugin is blocking Metorik", "Your host's bot check is blocking Metorik", "Sucuri is blocking Metorik", "Wordfence is blocking Metorik" and "Your site is limiting our requests". If the title names Sucuri or Wordfence, jump to that section below. If it mentions your host's bot check, see Hostinger or Other hosts.

  2. Check your security plugins. In WordPress, go to Plugins and look for Wordfence, Solid Security, All-In-One Security, WP Cerber, Shield, Patchstack or Jetpack.

  3. Check who hosts your site. If it's Hostinger, SiteGround, Kinsta, WP Engine, Cloudways or GoDaddy, use that section below.

  4. Using Cloudflare? Follow our Cloudflare guide instead.

Fix: whitelist Metorik

Whatever is blocking Metorik, you'll need these details to allowlist it:

Metorik's IP addresses: 23.239.31.174, 45.33.123.9, 45.33.116.36, 96.126.113.196, 173.255.205.248

Paths: /wp-json/* and /wc-api/*

Location: Metorik's servers are in the United States, so a rule that blocks visitors from the US will block Metorik too.

Not every tool can allowlist a path. Allowlisting all five IP addresses is enough in most cases.

Wordfence

  1. In WordPress, go to Wordfence → Firewall and open the Blocking tab.

  2. If any of Metorik's IP addresses are under Current blocks, select them and click Unblock.

  3. Open the Firewall Options page (look for All Firewall Options on the Firewall page).

  4. Under Advanced Options, add Metorik's IP addresses to Allowlisted IP addresses that bypass all rules and click Save Changes.

  5. Check Immediately block IPs that access these URLs doesn't include /wp-json/ or /wc-api/.

Allowlisted IPs also skip Wordfence's Rate Limiting (the "Your access to this site has been limited" message). (Wordfence: Firewall Options, Rate Limiting)

Sucuri

  1. Log in to the Sucuri firewall dashboard at waf.sucuri.net and select your website.

  2. Open the Access Control tab.

  3. Under Allow IP Addresses, enter each of Metorik's IP addresses and click Allow.

  4. Optionally, under Allow URL Paths, add /wp-json/ and /wc-api/ using Begins with.

(Sucuri: Allow an IP address, Allow a URL path)

Solid Security (now Kadence Security)

  1. In WordPress, go to Security → Firewall and open IP Management.

  2. Remove any of Metorik's IP addresses from Active Lockouts or Banned IPs.

  3. Add Metorik's IP addresses to Authorized IPs, one per line, and save.

  4. In Security → Settings → WordPress Tweaks, if REST API is set to Restricted Access, try Default Access.

  5. If you use Ban Users, make sure Ban User Agents doesn't match "Metorik".

(Solid Security: Firewall)

Other WordPress security plugins

  • All-In-One Security (AIOS): go to AIOS → Firewall → Block & allow lists, add Metorik's IP addresses under Allow list and click Save allow list. (AIOS)

  • WP Cerber: add Metorik's IP addresses to the White IP Access List on the Access Lists page. (WP Cerber)

  • Shield Security: in the Bots & IP Rules table, click Create New IP Rule and add each Metorik IP address to the bypass list. (Shield)

  • Patchstack: in the Patchstack App, go to Sites → your site → Protection → Additional Settings and add IP:23.239.31.174 (and so on for each IP) to Whitelist, one per line. (Patchstack)

  • Jetpack: add Metorik's IP addresses, separated by commas, to Always allowed IP addresses in Jetpack → Settings → Security or Jetpack → Protect → Firewall. (Jetpack)

Hostinger

Hostinger's CDN can't allowlist an IP address, so lower its security level instead.

  1. In hPanel, go to Websites → Dashboard → Performance → CDN and click Manage.

  2. Open the Security tab and set Security level to Medium or Low (never I'm Under Attack!).

  3. Open Traffic blocking and remove any IP rules that cover Metorik's IP addresses. If you have country rules that cover the United States, they will block Metorik too, because Metorik's servers are in the US, so remove those as well.

  4. Wait a minute, then click Retry in Metorik.

Still blocked? Send Hostinger the message below. Changing the security level needs a Business plan or higher. (Hostinger: Fix blocked legitimate requests, Security levels)

SiteGround

SiteGround's anti-bot system can only be adjusted by their support team.

  1. In Site Tools, go to Security → Blocked Traffic, open Manage Blocked IPs and delete any of Metorik's IP addresses.

  2. Open a ticket in SiteGround's Help Desk with the message below.

(SiteGround: Blocked Traffic, Anti-bot AI)

Kinsta

  1. In MyKinsta, go to Sites → your site → Bot protection and turn on Allow typical WordPress automations.

  2. If Metorik is still blocked, click Add exception, choose IP address, enter one of Metorik's IP addresses, select Allow and click Add exception.

  3. Repeat for each IP address.

  4. Check Sites → your site → IP Deny and delete any of Metorik's IP addresses.

Add exceptions to your live environment, not just staging. (Kinsta: Bot protection)

WP Engine

  1. In the User Portal, go to Sites → your environment → Web Rules.

  2. Under Access Rules, delete any Deny rule covering Metorik's IP addresses.

  3. If Metorik is still blocked, send WP Engine Support the message below, as server-level blocks can't be changed in Web Rules.

(WP Engine: Web Rules Engine)

Cloudways

  1. In the Cloudways Platform, open Servers, choose your server and click Security.

  2. In Incidents, click the three dots next to any Metorik IP address and whitelist it.

  3. In Firewall, click Add custom rules, select IP Address and whitelist each Metorik IP address, leaving TTL empty.

(Cloudways: Server Security Management)

GoDaddy

GoDaddy's Website Security firewall is powered by Sucuri.

  1. On your GoDaddy product page, next to Website Security and Backups, select Manage.

  2. Under Firewall/CDN, select the status, then Settings.

  3. Select Access Control, then Allow IP Addresses.

  4. Enter each Metorik IP address in Add new IP... and select Allow.

(GoDaddy: Allow or block website access)

Other hosts (cPanel, LiteSpeed, ModSecurity, Imunify360, BitNinja)

On most shared hosts, only the host can change the firewall, so send them the message below.

  • "Bot Verification" page: this is usually LiteSpeed's CAPTCHA protection, which only your host can change. (LiteSpeed)

  • ModSecurity: in cPanel, open ModSecurity and set your domain to Off to test. If Metorik connects, turn it back On and ask your host to whitelist the rule that blocked it. (cPanel)

  • Imunify360: if you've turned on Under Attack Mode in the WebShield tab, turn it off, then ask your host to whitelist Metorik's IP addresses. (Imunify360)

  • BitNinja: ask your host to allowlist Metorik's IP addresses or disable the WAF rule that blocked them. (BitNinja)

  • Headless stores on Vercel: in your project's Firewall, click Add New, choose System Bypass and add Metorik's IP addresses. (Vercel)

Message to send your host

Copy this into a support ticket or chat:

Hi! I use Metorik (https://metorik.com) for WooCommerce reporting, and your firewall or bot protection is blocking its requests to my store's WooCommerce REST API (403 Forbidden or a bot verification page).

Please allow these IP addresses through your firewall, WAF, bot protection, rate limiting and ModSecurity rules for my site:

23.239.31.174
45.33.123.9
45.33.116.36
96.126.113.196
173.255.205.248

Metorik's requests go to /wp-json/* and /wc-api/*. If a ModSecurity or WAF rule is being triggered, please whitelist that rule for these paths.

Thanks!

Verify it worked

  1. Wait a few minutes for the change to take effect.

  2. Go back to Metorik, click Retry, enter your store address again and approve the connection.

  3. If you see a different error, click How do I fix this? for help with that one.

Still stuck?

Send us a message using the chat in Metorik. Tell us who hosts your site, which security plugins you use and what the error says, and we'll help you track it down.

Further reading

Was this helpful?
Was this helpful?