When a firewall, a security service, or Cloudflare sits in front of your site, it can sometimes block PowerSEC's requests. The site stays online and its own monitoring keeps reporting in, but actions sent from PowerSEC to your site (running a scan, refreshing your backup list, creating or restoring a backup) can be delayed or fail.
PowerSEC shows a notice on the site's page when this happens.
What keeps working while PowerSEC is blocked
Current plugin versions switch to fetching some pending actions themselves: the site asks PowerSEC for work instead of waiting to be called. Scans, backup creation, refreshing the backup list and a few read-only checks still complete this way, usually a minute or more later than normal.
Other actions — restoring a backup, deleting a backup, quarantining or deleting a file, updating plugins, and blocking or unblocking an address — are only sent directly to the site. They need PowerSEC to be allowed through.
How PowerSEC connects to your site
PowerSEC only calls your site's own PowerSEC plugin endpoints, in one of two forms:
/wp-json/powersec/v1/...
/?rest_route=/powersec/v1/...
The second form is used for sites where the first one is not reachable, so an allow rule must cover both. Every request is signed (HMAC) and identifies itself with this User-Agent:
PowerSEC-Central/1.0 (+https://powersec.io/security)
If your site uses Cloudflare
- Open the Cloudflare dashboard for your domain.
- Go to Security → WAF → Custom rules and create a new rule.
- Use Edit expression and enter:
(http.request.uri.path contains "/wp-json/powersec/v1/") or (http.request.uri.query contains "rest_route=/powersec/v1/")
- Set the action to Skip, and tick what your zone uses: the remaining custom rules, the managed rules, Super Bot Fight Mode (if shown), and under the product options Browser Integrity Check and Security Level.
- Save the rule. Changes take effect within a minute.
Bot Fight Mode (Cloudflare Free) works differently. Cloudflare states that Bot Fight Mode cannot be bypassed or skipped with custom rules or Page Rules. If Bot Fight Mode challenges PowerSEC, you can either turn it off (Security → Settings, filter by bot traffic, Bot Fight Mode), or leave it on: scans and backups keep working through the site fetching its own pending actions, a little later than normal, while the actions listed above stay unavailable. Super Bot Fight Mode (Cloudflare Pro, Business and Enterprise) does support Skip rules, so the rule above covers it.
If your site uses another firewall or a security plugin
- Allow requests to
/wp-json/powersec/v1/and to?rest_route=/powersec/v1/. - If the tool supports User-Agent rules, use
PowerSEC-Central/1.0only together with the path condition above, never on its own: anyone can send that User-Agent. - If a security plugin disables the WordPress REST API, allow the
powersec/v1namespace.
If PowerSEC says the plugin is unreachable
That usually means the PowerSEC plugin was deactivated or its REST routes were disabled. Log in to the site's WordPress admin and make sure the PowerSEC plugin is active.
Is this safe?
The exemption applies only to PowerSEC's own plugin endpoints, and every request must carry a valid signature made with keys that only your site and PowerSEC hold. The plugin rejects a request without it, whatever the firewall does.