XML-RPC policy » Allow Jetpack without opening XML-RPC

TL;DR

For a site that uses Jetpack, WP fail2ban Premium can keep XML-RPC blocked generally while allowing requests from Jetpack's source addresses. It updates the trusted Jetpack list automatically each week, while WordPress authentication and permissions continue to govern what the service can do.

Other XML-RPC callers remain subject to the endpoint block. Jetpack needs methods beyond pingbacks, so do not combine its allowlist with the pingbacks-only policy.

Make Jetpack the exception

Jetpack is a known caller with a defined reason to use XML-RPC. WP fail2ban lets you express that relationship directly: block the endpoint as the general rule and admit Jetpack as the exception.

You do not have to choose between disabling Jetpack and leaving XML-RPC publicly available to every source.

Let the allowlist follow the service

Service address ranges can change. A static list that was correct when you configured it can quietly become incomplete or obsolete.

WP fail2ban Premium updates the trusted Jetpack source list automatically each week. The access policy can keep pace without asking you to monitor and copy address changes by hand.

Make sure WordPress sees Jetpack's address

The allowlist works only when WP fail2ban receives Jetpack's original source address. If a CDN or reverse proxy sits in front of WordPress, configure the proxy boundary first; otherwise WP fail2ban may see the proxy rather than Jetpack.

More about getting the real client IP behind a proxy.

Preserve WordPress authentication

The allowlist permits Jetpack's requests to reach XML-RPC. It does not grant WordPress capabilities or bypass the authentication the integration normally uses.

WP fail2ban decides which sources may reach the interface; WordPress still decides what an authenticated caller may do there.

Block everyone outside the policy

Requests that are neither Jetpack nor another deliberate exception still meet the XML-RPC block. WP fail2ban refuses them and writes a hard event that fail2ban can enforce at the host firewall.

The exception remains narrow because the default remains closed.

More about XML-RPC policy.

More about allowing trusted IPs to use XML-RPC.