Troubleshooting

The site won't pair

"Invalid or expired key": connection keys are single-use and short-lived. Generate a fresh key from Add site in the dashboard and paste it right away.
Registration can't reach FleetWP: the site must be able to make outbound HTTPS requests to app.fleetwp.io. Check that no firewall or security plugin is blocking outbound calls.

A firewall or WAF blocks FleetWP's commands

FleetWP talks to your site in two directions. The connector calls out to app.fleetwp.io (heartbeats, backup and scan results), and FleetWP calls in to your site's REST API to run commands (backups, updates, one-click login, security scans). A firewall, security plugin, or CDN that only inspects inbound traffic can let heartbeats through while silently blocking the inbound commands.

The tell-tale sign is a site that keeps checking in as connected but fails an action with an error like Site responded 403 — often with Cloudflare's Just a moment... challenge page in the body. That is a bot challenge stopping a legitimate server-to-server request, because there is no browser to solve it.

Every inbound FleetWP request is signed and identifies itself, so you can allowlist it precisely without weakening bot protection for anyone else:

User-Agent FleetWP-Connector (for example, FleetWP-Connector/1.0)
Request header X-FleetWP-Signature (present on every command)
Path /wp-json/fleetwp/v1/*

Cloudflare

Create a WAF custom rule (Security → WAF → Custom rules) with the action Skip, targeting Super Bot Fight Mode and Managed Challenge, using either match:

any(http.request.headers["x-fleetwp-signature"][*] ne "")

http.user_agent contains "FleetWP-Connector"

The header match is the most robust — it is present on every command and also covers plain-permalink sites, which FleetWP reaches via ?rest_route=. On the free plan, Bot Fight Mode has no per-request exceptions; turn it off while you run the action, or upgrade to configure Super Bot Fight Mode.

Allowlisting this path is safe: the connector verifies an HMAC signature on every request, so the firewall rule is redundant protection, not the only gate.

Signature or "time window" errors

Signed requests must land within a 5-minute window. If you see signature rejections, check the server clock. A WordPress host with a badly skewed clock will fail signature verification. Sync the server time (NTP) and retry.

The site shows "connected" but stays silent

The connector reports on a schedule via wp-cron. On low-traffic sites wp-cron may not fire often. If FleetWP raises an offline alert while the website itself is up, the connector isn't running its jobs. Configure a real system cron to hit wp-cron.php on a schedule:

# crontab: run wp-cron every 5 minutes
*/5 * * * * curl -s https://example.com/wp-cron.php?doing_wp_cron > /dev/null 2>&1

Backups fail or never complete

Backups run in the background and need enough disk space and PHP execution time to dump the database and archive wp-content. Very large sites on tight limits may time out. Try a database-only or files-only backup to narrow it down.
Confirm wp-cron is firing (see above). The archive step runs on a background cron event.

One-click login issues a single-use, 2-minute token and requires an admin account on the site. If it expires, just generate a new login URL.
Update commands require the connector to be current. If self-update is unavailable, reinstall the latest connector zip (see Install).

Still stuck?

Disconnect the site in the dashboard and pair it again with a fresh key. This clears any stale pushed configuration and re-establishes the secret.

On this page