WP Ghost and Zapier Compatibility Setup Guide

WP Ghost is compatible with Zapier, but requires specific configuration. Zapier uses the WordPress XML-RPC API to communicate with your site for actions like creating posts, updating pages, and triggering workflows. WP Ghost’s recommended security practice is to disable XML-RPC access (since it’s a common attack vector), but Zapier requires it. The solution is to keep XML-RPC disabled for the public while whitelisting Zapier’s User Agent and IP addresses so only Zapier can use it.

Why Zapier Needs WP Ghost Configuration

Step 1: Allow XML-RPC Access for Zapier

If you’ve disabled XML-RPC in WP Ghost (recommended for security), you need to ensure Zapier can still reach it via the whitelist. The XML-RPC setting itself can stay disabled for the public – the whitelist overrides it for approved sources.

1. Go to WP Ghost > Change Paths > API Security.
2. Confirm that Disable XML-RPC access is enabled (this blocks public XML-RPC access, which is the secure default).
3. Click Save.

Step 2: Whitelist Zapier in WP Ghost Firewall

Add Zapier’s User Agent to the WP Ghost firewall whitelist so Zapier’s API calls can bypass the XML-RPC block.

1. Go to WP Ghost > Firewall > Whitelist.
2. Add the Zapier User Agent to the whitelist.
3. Optionally, add Zapier’s IP addresses. Zapier runs on AWS infrastructure, so you can download the latest IP ranges from Amazon’s official IP range list (JSON format).
4. Click Save.

Important: Zapier’s IP addresses can change over time because they use AWS infrastructure. If Zapier stops working after a period, the IP range may have changed. Check the Amazon official IP list for the latest addresses. The User Agent whitelist is more reliable since it doesn’t change when IPs rotate.

Alternative approach: If you don’t want to manage AWS IP ranges, whitelisting the Zapier User Agent alone is usually sufficient. The User Agent whitelist allows all Zapier traffic through regardless of which AWS IP address it originates from.

Verify the Setup

1. Go to your Zapier dashboard.
2. Create a test Zap that connects to your WordPress site (for example, create a new post).
3. Run the Zap and check that the action completes successfully.
4. Verify the post was created on your WordPress site.
5. Check WP Ghost’s Security Threats Log to confirm Zapier’s requests are going through the whitelist and not being blocked.

Troubleshooting

Zapier returns a connection error

Zapier can’t reach your site’s XML-RPC endpoint. Confirm the Zapier User Agent is whitelisted in WP Ghost > Firewall > Whitelist. If you use country blocking, make sure you’re not blocking the AWS region where Zapier’s servers are located (Zapier uses multiple AWS regions). Check WP Ghost’s Security Threats Log to see if Zapier’s requests are being blocked and by which rule.

Zapier worked initially but stopped later

Zapier’s IP addresses may have changed (they use AWS and IPs rotate). If you whitelisted specific IP addresses, update them from the Amazon official IP list. Alternatively, rely on User Agent whitelisting instead of IP whitelisting – User Agents don’t change when IPs rotate.

Zapier creates posts but with broken formatting

This is typically a Zapier formatting issue, not a WP Ghost conflict. Zapier passes content through the XML-RPC API as it receives it. Check your Zap’s content formatting settings. WP Ghost’s path security doesn’t affect post content created through the API.

Frequently Asked Questions

Is it safe to allow XML-RPC access for Zapier?

Yes, when done through the whitelist. The XML-RPC endpoint remains disabled for all public traffic. Only requests matching the whitelisted Zapier User Agent (and optionally, whitelisted IP addresses) can access it. This is much more secure than leaving XML-RPC open to everyone.

Can Zapier use the REST API instead of XML-RPC?

Zapier’s WordPress integration currently uses XML-RPC for most actions. Some newer Zapier integrations may use the REST API. If your Zaps use the REST API, you may need to ensure WP Ghost’s custom REST API path is accessible or whitelist the Zapier User Agent for REST API access as well. Check Zapier’s documentation for your specific integration.

Does this apply to other automation services like Make or IFTTT?

Yes, any external service that connects to WordPress via XML-RPC or the REST API needs similar whitelisting. The process is the same: whitelist the service’s User Agent and/or IP addresses in WP Ghost’s firewall. The specific User Agents and IP ranges will differ by service.

Related Tutorials

API and external service configuration:

• WP Ghost and ManageWP – Another external service compatibility guide.
• Compatible Plugins List – All plugins and services tested with WP Ghost.
• Emergency Disable – Recovery via FTP if needed.