What Jetpack Security Does in WordPress
Jetpack Security is a WordPress plugin suite from Automattic that helps protect sites with features such as brute-force protection, activity logging, downtime monitoring, malware scanning, and backups on eligible plans.
When it stops working, the impact can range from missing alerts to failed scans and disconnected protection modules.
This guide explains how to fix Jetpack security not working by checking the most common causes in a logical order.
The goal is to help you restore protection quickly while avoiding unnecessary changes to your site.
Check Whether Jetpack Is Connected Correctly
Jetpack depends on a valid connection between your WordPress site and WordPress.com.
If the connection breaks, security features may appear active in the dashboard but fail behind the scenes.
- Go to Jetpack > Dashboard and confirm the site is connected.
- Look for notices about authentication, disconnected modules, or action required messages.
- If prompted, reconnect using your WordPress.com account.
- Verify that the correct site URL is listed, especially if you recently changed domains, moved hosts, or switched from HTTP to HTTPS.
If your site was migrated recently, a stale connection is one of the most common reasons Jetpack security stops functioning.
Confirm That Security Features Are Enabled
Some users assume Jetpack Security is broken when the relevant feature was never activated.
Jetpack includes multiple modules, and each one may need to be enabled separately depending on your plan.
- Open the Jetpack settings area in WordPress.
- Check whether brute-force protection, scan, backup, and activity log features are switched on.
- Review your Jetpack subscription to make sure the plan includes the security tools you expect.
- Look for expired licenses, billing issues, or plan downgrades that may have disabled premium security tools.
If you only see a subset of security options, the issue may be related to your plan rather than a technical fault.
Test for Plugin and Theme Conflicts
WordPress plugin conflicts are a frequent cause of Jetpack issues.
Security plugins, caching tools, optimization plugins, and some firewall solutions can interfere with Jetpack requests or script loading.
How to isolate a conflict
- Temporarily deactivate all plugins except Jetpack.
- Check whether the security feature starts working again.
- Reactivate plugins one by one until the problem returns.
- Switch briefly to a default WordPress theme such as Twenty Twenty-Four if you suspect theme-level conflicts.
Pay close attention to plugins such as Wordfence, iThemes Security, Sucuri, Cloudflare integrations, caching plugins, and minification tools.
They may block API calls, alter JavaScript, or prevent Jetpack from communicating with WordPress.com.
Check Firewall, CDN, and Host Restrictions
Host-level firewalls, managed WordPress security systems, and content delivery networks can block Jetpack traffic.
Because Jetpack relies on remote services, even a legitimate request may be flagged if your host or CDN is configured too aggressively.
Review whether your environment blocks outbound or inbound requests to WordPress.com domains.
In many cases, Jetpack needs access to services such as WordPress.com, Jetpack servers, and Automattic APIs to keep security features updated.
- Ask your host whether XML-RPC or REST API access is restricted.
- Check whether a web application firewall is rate-limiting Jetpack requests.
- If you use Cloudflare, review firewall rules, bot protection, and JavaScript challenges.
- Ensure your host is not blocking loopback requests, which can affect scans, backups, and scheduled tasks.
On managed hosting platforms, support teams can often confirm whether their rules are interfering with Jetpack Security.
Verify REST API and XML-RPC Availability
Jetpack uses WordPress infrastructure that depends on the REST API and, in some cases, XML-RPC.
If either is disabled or blocked, Jetpack features may fail to sync, authenticate, or send status updates.
Common causes include security plugins that disable XML-RPC, custom firewall rules, or server hardening settings.
If you have deliberately disabled these interfaces, test whether re-enabling them restores Jetpack behavior.
- Check whether a security plugin is disabling XML-RPC.
- Confirm the REST API endpoint is accessible on your domain.
- Make sure HTTPS is configured correctly and the site’s certificate is valid.
- Look for redirect loops between HTTP and HTTPS that can interrupt Jetpack requests.
Update Jetpack, WordPress, and PHP
Outdated software can cause compatibility problems that affect Jetpack Security.
WordPress core updates, plugin updates, theme updates, and PHP version support all play a role in stable integration.
- Update WordPress to the latest stable version.
- Update Jetpack to the newest release.
- Update your theme and other plugins.
- Check your PHP version and move to a supported release if needed.
Older PHP versions can create errors that are difficult to trace, especially if security tools are timing out or failing silently.
Before changing PHP, confirm that your theme and plugins are compatible.
Review Site Health and Error Logs
WordPress includes a Site Health tool that can reveal configuration problems affecting Jetpack.
Server error logs can also show connection failures, permission issues, and timeout errors that are otherwise hidden from the dashboard.
Look for clues such as:
- cURL errors
- SSL certificate issues
- HTTP 403 or 429 responses
- Scheduled task failures
- Memory limit warnings
If a feature like scanning or backups is failing intermittently, logs often reveal whether the problem is caused by server timeout limits, missing PHP extensions, or insufficient memory.
Resync or Reconnect Jetpack
If Jetpack appears partially connected but security features still fail, a manual resync can clear stale state.
This is especially useful after site migrations, domain changes, or major plugin removals.
- Disconnect Jetpack from WordPress.com if the option is available.
- Reconnect the site using the correct administrator account.
- Confirm that the public and site URLs match your active domain.
- Re-enable security modules after reconnection.
In some cases, you may need to remove the plugin, reinstall it, and complete a fresh connection.
Do this only after confirming that your subscription details and site URL are correct.
Fix Problems with Backups, Scans, or Alerts Specifically
Jetpack Security includes several tools, and each can fail for a different reason.
Narrowing the problem by feature makes troubleshooting faster.
If backups are not working
- Check storage status and plan limits.
- Confirm that scheduled tasks are running.
- Verify that the server allows outbound connections and file access.
- Review disk space and permission settings.
If malware scans are not working
- Check whether scan scheduling is enabled.
- Confirm Jetpack can reach its remote services.
- Look for timeouts on large sites with many files.
- Exclude overly restrictive security rules that block scan requests.
If downtime or security alerts are missing
- Verify that notifications are enabled in Jetpack settings.
- Check the email address associated with the WordPress.com account.
- Review spam, promotion, or junk folders.
- Make sure your site can send outbound email properly if email delivery is also handled locally.
Use a Clean Troubleshooting Workflow
When Jetpack Security stops working, avoid changing multiple variables at once.
A structured process makes it easier to identify the root cause and keeps the site stable.
- Confirm the site is connected to WordPress.com.
- Verify the security feature is enabled and included in your plan.
- Test for plugin, theme, host, and firewall conflicts.
- Check REST API, XML-RPC, SSL, and scheduled task behavior.
- Update WordPress, Jetpack, PHP, and related plugins.
- Review logs, Site Health, and notifications for specific error messages.
If the problem persists after these checks, contact Jetpack support or your hosting provider with the exact error message, the affected feature, and the steps you already tested.
That information usually shortens resolution time and helps support identify whether the issue is local to your site, your host, or Jetpack itself.